Extracting prog: 39m4.776063997s
Minimizing prog: 44m22.567040799s
Simplifying prog options: 0s
Extracting C: 37.602257195s
Simplifying C: 14m10.336113754s


extracting reproducer from 45 programs
testing a last program of every proc
single: executing 10 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-unshare-socketpair$unix-recvmmsg-prctl$PR_SCHED_CORE-semget$private-semop-timer_create-fcntl$lock-mprotect-timer_settime-keyctl$clear-sendmmsg$alg-recvmsg-socket
detailed listing:
executing program 0:
r0 = gettid()
unshare(0x6a040000)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r1 = semget$private(0x0, 0x20000000102, 0x0)
semop(r1, &(0x7f0000000240)=[{0x2, 0x0, 0x1800}, {0x0, 0xe65b}], 0x2)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0)
keyctl$clear(0x7, 0x0)
sendmmsg$alg(0xffffffffffffffff, &(0x7f000001ea00)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001c00)="5985d20392a438a118753a61ccd1d0e83101f02653a3db12a8785d9bcc59b58251f9ae571dc6a2d023b82407fbb8ae52a24b445059869df6095b826013c10bb7745d9edc0ef211452945180b52cc3986fb74d70cdc0194be37b376d2d4798d4e4463d042b1a462e80d80915fcffca56f2e0f5a6b6bff7e43eb6c80c1a8e85c077f4e980c3aa7b4b34562044059224e7280a86d55356ca279765d0943a185ac585ba7355885a40b0f4d02e5afe7b154deb20048d62307273f7069b86987af5b7fd9272d1ed5a9891e493deafa8a98f30c86803d00028221b891d3ae3437e26e9e0bbb0c152036ffebc06c5aa3fe55480e68414e7283793c5f93bf95ee471bf2b70abf696bb304bbecce852fd81439df022489675c1827a96f824378a80ce5338143bbc8fc3b1955bba34f2121cf485212c7cd8b50d81382605d28573b46b376e1092560f6d76c8ee2c4ebd9cf88665cec5acd5c2bb34ed1ce0338a7c1c8583914be1ef3a054e91f35a82147c0ef819f7971e12c18c5314df9e06bbbea133f82e638fd4646fb6a517fe75130f65392e8e1456fff3ae5cc7298b7bd6e7ea141808b4b4ec6930e7ee97e802a9a5c37c7bfaf6f8fd113b1e713e9d07cf0ddddf91965c29dbcc7a6478a071efe498458ee8428baeacd171ca321a88863d747ae8ba633f835401e66c831bec8d66ede3a6be8c9d6cd2e543df191a661d934e115c49db11cd3382aa4c378ea27b37078e4dbd52d5237873388f0b114dbcd77332e3cae456d8a96465a763709b9e33255b9648f186ae462f585dd729676a66e5dcba00b76ef82b9926d820d1f81f2ef2bdedb9727bc9b8420a16af0a3d49bfabaf53637b5712cd1efcfecefea443d99749398406a15af44464330fcc7ae05bc1319a403f17320384adf670171b10572b7a3c29224327d4da0cc98605adb69b143b75f495c3ee34b0e2df6119cdecfc9c14adac77c00225ba394a33c2031f7fd6fd5c51603133fd282b714d0206a61dcbfd9826847751c0828c7258b75739fc0f26cb4f5037652f608bfd156660b8ca43069fdfd27dc658b768b0842a71bd2191064e7c343710b26b4f94900dea847881b9269a250b165aa5b32cb02e853e01df7283f5aae557f555cdd110ffa52c5c702cb214934c5aa8a99c87b2ec9dd6717693827029ad477fa822c84c83303d04a6db313af73b83ef53d0caae2a0de16e13746d092a2e6260638245c57bf2904740ef4d4385b3fd888ea17795c712dbce6a559c71a8425deab805f99ec9f16cf268c5c6cb6cbbefe71115e62c85e9a0940b96a19a49b4a9373250c5b7a2446b4393aaa144ba32a9a0fff5cffc515d48691911a84ef869af3c3b08db4d8e44279b8ecf0753e88e5405897b4050db08c254cf0ff5b69a045bc62049218a573c6a395148454e91072768ddbd4326a0d247a0a4571ea894875a2f899f47487c3d2b62e51d8239633d3421fd79b0c32d05b99256614accf64ee6e2d51a3bdd221e79d6475e6ac68159923977200feba975e290d768d7255416a06c8f161fa39f7a04c4651d420f1d96703cb3773bd2a2a0c37b1603151c4cc47f0699900849509534f8ec5131cfee5d96d598e28d571328ca037a34ba31aa5e6d51fe2604f8316545f129f0ae8e0856888d3315ed22f6246852df12d67e3a64e7891df946b81495189341e9401406037cfb31490fcff4fc0406f2f70e2cabcd0fb8adeec4be909526dfa252a5aee0435df3a07e0897b86eaff8dd190f466b2a81e8a37ffb577bfb5feddefb292809c1d925c2f9cf27380dc78e74d74ceb1d31ebe84bbd2e6ce48dded3c55203966896ad1458d3d3095b9bacf250416ee27aa73a5c5d6ec6b2c9c323759ffe97df44481f796f4762e3245c0a88fd129dbafde688f2c57445665c623025a76748a9931a7f67c53faa4a155c9ba5caa38986462e48db7c580749bd372955244c9d4a17631f24b9b64036de9e97147b7056dcb54652fca36a037d0c3f754a303c594d8e04f706fe75e8f19607e6cc94ac60d83b4fc620a00b52605323391f3e005dcdb9be443b59d89760b605f32c07bef27a326863e07d770e7bb2853354f6404a83d099559e5a25849bd16c6381354ec45df14e3e16099a0cc299256118be93e47c025b01a2fe899c81411c8f6b74808562ecb2f91b8688b1617b93516b29162bf71db6e2dbee1ba98fba3cf6e7f56d90fbf017d2d81d2411515d73272bc167a55770deacb3d79dcfa1cb9c27e27585b521d3900e4fb280c1ba1f9e956bd1326bf162255f66b0189ae648a402e48cc61fdd20fd3a09070c88167730bf80b34cecfcb37a4046552d167f1993990e55e43ee58372455864de62d636d836477fca1ca355bce2eed04ca30751ad642e61862d1e29886b9acc5be9d6ab7e6eab7c89a7ebde051116ae5f12432caa8228c4dddb5221f7f5fafeef8d397ee0c7d94dfcd2fade21947c98bd89b071f4e24dfb43b46f1db5f1276d8d71e3cccca479cb612be6bd02e6f188403b85022ed0e9d42f9c4531a11659bfd144b4a49b6659be2a548658a66d7faa44622742d7c42d7f90caa2ca3a24d10c993a9b1c814f4e0b735615cbd9c00d6bf444d0ae1071f2b74023d2e53b9d2b79f6ddaeadcef3bcc5d13971b7f9c7e72d1a431e1d79234e1dab13ee758f741777d836905c7873de0192ecda15d3a224331fc2222f6793edd69da51befe4f772ec696e4e4e5deba877b52b91d8b7de4fd151e1009134cebf4a353e6219b21f131487b3fba0f4b7e39626c5c7583ed5073086ff735ce19cb786e8d1bf359b4c3a7bc29bbf9d441d914d7e842b88f0868d0f6a6fd41624271ad5e166d677ea5109b6c8e9d2fdfff9e944e9c9ad50b3cde7e3f229e2bbf81c6aaa7b7c8e5700362000b6509942bbed25253e0833a5f7a71975b780472ed6f3da3a2ba162f20b3b90d4a084acbb137129bbd9b65f3e9ba6886241d80ee90dcf7d64050d52e8550f21262a88395ca06b83a5b5d9c05426582c86fe7753019a71ecc84c59fae3239d195246306f153b301629fbc6bd6e3fbc6aff7d35d79c5c8046b61ec70e2b7356c9400477778990364091be2b74bdab711f5561ff137021fdf9e82a35fd5bf85673bbb2944cf1f36a2e25fa4dd948525621f7a14dc3c8d1e1f1ec9d334dddcf7f9487f3d3ec60106becfddc15ece3850215aa3231a543264263757c6417adde58eb6b624096ac5c7b96e4e294cc935ad9315669d03b80522e5b7f6207e325cc5e9a33cdd8d5512aa388e452674a936826d47f23097d33c4e4a1f2f0802a2b9be2a608f2f0ff27f6b041d70d268f848687d45e6e510691ad516c7d7038d4153fb30415e425a4cb9d879aee8ffbca65df46876151af9a583d9a3fb331fb1b616a8007fddba31bee77e420172cd2a2a140a3376db47d7336d958bfa6f4ae80f78310c9043a184258dbaa9bba0c2482d7eb70c2bd94d52587fb92fd80c58110b05ad6eb1623009cd263deb3cb219bfde713ef738dfed0b1c6254177d939e8c358cc69ddfa3e31aa4c3cbfe384d96749217ff3b2b45a15f34403fe327aa2f805d1eaf7ee7f187070032eceba18a11e4ccf7c2e3a4d5c72d1db7b0bb5dc2354ae7eb27dedb91a5571203835b482353950220ad39f21334135c6fdd22a71c6119ce5dfa292a71ad296b141663210872c192aa228e21068d717235f1186234de39e69e5904ead38314ef69b86a656371d9987d327a7064fc6e1acd7f822165b1e42da9bff573db1eaf2563552bf6dbb6591031883f5cf7e22d1f2e2522e5bb88fc4bdece187d7f2612886a7f314895d43dd2c9e1b731aec39014028590ea0c76f1cd7d71c96ed45ce31d5e38f38a36a95d54708875dd99d8612275450a700251c7f21742d31b9be6de5fcf63b7b639ff746f31537694b3005ddf6cc8375f25bd782bc784943b72bd19f938a449fe0a617b5b1430a4d506e3bf0a1f118b6e45e9e6a3515efd9ecd1a964c5459921b01a0cacf0d4e4659f06ee2e53123a2241b583072f91af6b82f51fa14622ead00697b2f511e7f54cc4e8b015bd03b4ebae849ec9f7738d945450ff8363aee60678b80a86e93326f6a87d73b1a114f6f6186e2a4365d66d5b74df15280c4060ec847da5a1baf1706e7a373f2ec73ad755bffdd5813cf5ce8cf8b07d4ac8b324293b7248145b35b13fe638f902c5e8147084c221591cefa221573080f49ed7b3479e9c81c4ec2e5e8df89ce0266f6023327aae85f74fc70085398ca9749a1b8467d3d2d7bdcfc4bb9af62721a4cf55a5d2600210eeda03de3b9353725eb991583d7226debf7e3d4b06d89c41599b3687d56571c6c810882e1060510b0e6480b4e3d8705c858e24897dd8bd936f9a16bd626b98dd55696aa2dea3c0a12a6b12f5befba90ea487134453b5a8e863b5446565730e9d84e019d664654568c3448bbddd8cccc15e4615addae0d732dafe6f54b229cd5689396720d0010dfea3f9e6d9793b51be5c4e39659e8eb604ec15ee7ae2a2961a8b815d9417795cdde0702d6cf7dcdc16f02365d7eee5dfc7a0a9ea3957672f00a209fb845e782777ef9e5c9e7aa7926bb93c3486a8612e222ddc9709d9a2acef6c60db859c4fd39f365bb22f90edd04f891fd3ccdff35c5eac56ec49d02063a7859aa14c938d575fb85cc26a3f3fb3ef4d8ce576e927dc54c27702aff904e133a6869ac4384ca6ce273d1a7f3b4ffb570dd097e607ade6733262b527c508e4ff7e09bb56432c36a38065c582210252efc06aa0d3fe0ea99e97e6ee88f80ad33bcb2cd0570b8f97488bfe09d4560b9ab44ec7ea5726d291460ab46d32922c1b37067425ff9abc8a4bf810879114dc266a575e1ddcbfd6ef2c51b624091b3ebe68ededfd94f883ae674b1f00be817a559b3c6376aa68f039628ae425191b7c7ba60e73b0fa3c4fe5533b4f8fe0b21f61a5f9e520e22cdbebd929048552b6d8d1d5c18fa9900b7786462e7e4d738e57485e9a6dd14a0fd37f0256613317df8ec3518c7eee50c59070a7276f8b0575426887f2cb5be122cc766a25a07132ef01611d0c2d3f16de29a8c0f39a3a5a3e9596b61fd4e518bcc52cdd2d87605ce9d9c5f2a6d4e11d2f94575b0d5de72d0b97d0a2cf32b5465c6a4ddb62d61b97f2331341c9d448ec775180f858394f2c0b2ee982b9f867d73f97d0e0e3b275ef49c7c262c4d6f5fac787edafaa8b79410b1288a0b52afd93c8584ff9d61eddfa0cada98bd3c200fc708078098764bbe304c44d62eff132415a917c022c9f7466318017da7b4649eb0fae58fcb716a1f295d84dd9ec14218beb0372c041aaa4421a8f75eaef5115f0f32aca8fd30fde0e9e08972e23faf5381eb18c626c0ce920261461c3dfe7f1e8b35ca16f7283de3af4bba5c384e256cd369568214101a8e27c94531a81fe4fba595a4455f8724eebea716d1a4940b3d787fc4bd6ad8aa403fceb74f316fb5a816890646338efb6f13aba195f127aa1b1107bf303b1f997c74d6f4f664d708f58c3b3ca063825405ad7a61260debf4b220443b6537f5ae94820ec62901944cc9023e655f82e0e31a13f351ed0336cbcfda8ae0b20025fb33e49f011f6aa708140cffefbd06f9b90fefc6f9d79f67495ff0b1a2f1ff075eda3fdd800088fc0583dc0e1e9f7f02673da61cc4466a2559d70cd90e453b11449442eb11f444e1203bc38754f7ad0d93bb91e40f9cd490d2dd5d7e2571c460718f94d4c61751c119fedbbbd28d7716ccb6aaa8bafae3756926ae8fccf3c5397a", 0xff8}, {&(0x7f0000000540)="43735ec9", 0x4}, {&(0x7f0000000080)="58c22ba236", 0x5}, {&(0x7f00000000c0)="9f7371161a7b253e2f0376003c347c6a", 0x10}], 0x4, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x400c4}], 0x1, 0x804)
recvmsg(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000002c00)=""/4088, 0xff8}, {&(0x7f0000000440)=""/39, 0x27}], 0x2, 0x0, 0x54}, 0x20002140)
socket(0x400000000010, 0x3, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-unshare-socketpair$unix-recvmmsg-prctl$PR_SCHED_CORE-semget$private-semop-timer_create-fcntl$lock-mprotect-timer_settime-keyctl$clear-sendmmsg$alg-recvmsg-socket
detailed listing:
executing program 0:
r0 = gettid()
unshare(0x6a040000)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r1 = semget$private(0x0, 0x20000000102, 0x0)
semop(r1, &(0x7f0000000240)=[{0x2, 0x0, 0x1800}, {0x0, 0xe65b}], 0x2)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0)
keyctl$clear(0x7, 0x0)
sendmmsg$alg(0xffffffffffffffff, &(0x7f000001ea00)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001c00)="5985d20392a438a118753a61ccd1d0e83101f02653a3db12a8785d9bcc59b58251f9ae571dc6a2d023b82407fbb8ae52a24b445059869df6095b826013c10bb7745d9edc0ef211452945180b52cc3986fb74d70cdc0194be37b376d2d4798d4e4463d042b1a462e80d80915fcffca56f2e0f5a6b6bff7e43eb6c80c1a8e85c077f4e980c3aa7b4b34562044059224e7280a86d55356ca279765d0943a185ac585ba7355885a40b0f4d02e5afe7b154deb20048d62307273f7069b86987af5b7fd9272d1ed5a9891e493deafa8a98f30c86803d00028221b891d3ae3437e26e9e0bbb0c152036ffebc06c5aa3fe55480e68414e7283793c5f93bf95ee471bf2b70abf696bb304bbecce852fd81439df022489675c1827a96f824378a80ce5338143bbc8fc3b1955bba34f2121cf485212c7cd8b50d81382605d28573b46b376e1092560f6d76c8ee2c4ebd9cf88665cec5acd5c2bb34ed1ce0338a7c1c8583914be1ef3a054e91f35a82147c0ef819f7971e12c18c5314df9e06bbbea133f82e638fd4646fb6a517fe75130f65392e8e1456fff3ae5cc7298b7bd6e7ea141808b4b4ec6930e7ee97e802a9a5c37c7bfaf6f8fd113b1e713e9d07cf0ddddf91965c29dbcc7a6478a071efe498458ee8428baeacd171ca321a88863d747ae8ba633f835401e66c831bec8d66ede3a6be8c9d6cd2e543df191a661d934e115c49db11cd3382aa4c378ea27b37078e4dbd52d5237873388f0b114dbcd77332e3cae456d8a96465a763709b9e33255b9648f186ae462f585dd729676a66e5dcba00b76ef82b9926d820d1f81f2ef2bdedb9727bc9b8420a16af0a3d49bfabaf53637b5712cd1efcfecefea443d99749398406a15af44464330fcc7ae05bc1319a403f17320384adf670171b10572b7a3c29224327d4da0cc98605adb69b143b75f495c3ee34b0e2df6119cdecfc9c14adac77c00225ba394a33c2031f7fd6fd5c51603133fd282b714d0206a61dcbfd9826847751c0828c7258b75739fc0f26cb4f5037652f608bfd156660b8ca43069fdfd27dc658b768b0842a71bd2191064e7c343710b26b4f94900dea847881b9269a250b165aa5b32cb02e853e01df7283f5aae557f555cdd110ffa52c5c702cb214934c5aa8a99c87b2ec9dd6717693827029ad477fa822c84c83303d04a6db313af73b83ef53d0caae2a0de16e13746d092a2e6260638245c57bf2904740ef4d4385b3fd888ea17795c712dbce6a559c71a8425deab805f99ec9f16cf268c5c6cb6cbbefe71115e62c85e9a0940b96a19a49b4a9373250c5b7a2446b4393aaa144ba32a9a0fff5cffc515d48691911a84ef869af3c3b08db4d8e44279b8ecf0753e88e5405897b4050db08c254cf0ff5b69a045bc62049218a573c6a395148454e91072768ddbd4326a0d247a0a4571ea894875a2f899f47487c3d2b62e51d8239633d3421fd79b0c32d05b99256614accf64ee6e2d51a3bdd221e79d6475e6ac68159923977200feba975e290d768d7255416a06c8f161fa39f7a04c4651d420f1d96703cb3773bd2a2a0c37b1603151c4cc47f0699900849509534f8ec5131cfee5d96d598e28d571328ca037a34ba31aa5e6d51fe2604f8316545f129f0ae8e0856888d3315ed22f6246852df12d67e3a64e7891df946b81495189341e9401406037cfb31490fcff4fc0406f2f70e2cabcd0fb8adeec4be909526dfa252a5aee0435df3a07e0897b86eaff8dd190f466b2a81e8a37ffb577bfb5feddefb292809c1d925c2f9cf27380dc78e74d74ceb1d31ebe84bbd2e6ce48dded3c55203966896ad1458d3d3095b9bacf250416ee27aa73a5c5d6ec6b2c9c323759ffe97df44481f796f4762e3245c0a88fd129dbafde688f2c57445665c623025a76748a9931a7f67c53faa4a155c9ba5caa38986462e48db7c580749bd372955244c9d4a17631f24b9b64036de9e97147b7056dcb54652fca36a037d0c3f754a303c594d8e04f706fe75e8f19607e6cc94ac60d83b4fc620a00b52605323391f3e005dcdb9be443b59d89760b605f32c07bef27a326863e07d770e7bb2853354f6404a83d099559e5a25849bd16c6381354ec45df14e3e16099a0cc299256118be93e47c025b01a2fe899c81411c8f6b74808562ecb2f91b8688b1617b93516b29162bf71db6e2dbee1ba98fba3cf6e7f56d90fbf017d2d81d2411515d73272bc167a55770deacb3d79dcfa1cb9c27e27585b521d3900e4fb280c1ba1f9e956bd1326bf162255f66b0189ae648a402e48cc61fdd20fd3a09070c88167730bf80b34cecfcb37a4046552d167f1993990e55e43ee58372455864de62d636d836477fca1ca355bce2eed04ca30751ad642e61862d1e29886b9acc5be9d6ab7e6eab7c89a7ebde051116ae5f12432caa8228c4dddb5221f7f5fafeef8d397ee0c7d94dfcd2fade21947c98bd89b071f4e24dfb43b46f1db5f1276d8d71e3cccca479cb612be6bd02e6f188403b85022ed0e9d42f9c4531a11659bfd144b4a49b6659be2a548658a66d7faa44622742d7c42d7f90caa2ca3a24d10c993a9b1c814f4e0b735615cbd9c00d6bf444d0ae1071f2b74023d2e53b9d2b79f6ddaeadcef3bcc5d13971b7f9c7e72d1a431e1d79234e1dab13ee758f741777d836905c7873de0192ecda15d3a224331fc2222f6793edd69da51befe4f772ec696e4e4e5deba877b52b91d8b7de4fd151e1009134cebf4a353e6219b21f131487b3fba0f4b7e39626c5c7583ed5073086ff735ce19cb786e8d1bf359b4c3a7bc29bbf9d441d914d7e842b88f0868d0f6a6fd41624271ad5e166d677ea5109b6c8e9d2fdfff9e944e9c9ad50b3cde7e3f229e2bbf81c6aaa7b7c8e5700362000b6509942bbed25253e0833a5f7a71975b780472ed6f3da3a2ba162f20b3b90d4a084acbb137129bbd9b65f3e9ba6886241d80ee90dcf7d64050d52e8550f21262a88395ca06b83a5b5d9c05426582c86fe7753019a71ecc84c59fae3239d195246306f153b301629fbc6bd6e3fbc6aff7d35d79c5c8046b61ec70e2b7356c9400477778990364091be2b74bdab711f5561ff137021fdf9e82a35fd5bf85673bbb2944cf1f36a2e25fa4dd948525621f7a14dc3c8d1e1f1ec9d334dddcf7f9487f3d3ec60106becfddc15ece3850215aa3231a543264263757c6417adde58eb6b624096ac5c7b96e4e294cc935ad9315669d03b80522e5b7f6207e325cc5e9a33cdd8d5512aa388e452674a936826d47f23097d33c4e4a1f2f0802a2b9be2a608f2f0ff27f6b041d70d268f848687d45e6e510691ad516c7d7038d4153fb30415e425a4cb9d879aee8ffbca65df46876151af9a583d9a3fb331fb1b616a8007fddba31bee77e420172cd2a2a140a3376db47d7336d958bfa6f4ae80f78310c9043a184258dbaa9bba0c2482d7eb70c2bd94d52587fb92fd80c58110b05ad6eb1623009cd263deb3cb219bfde713ef738dfed0b1c6254177d939e8c358cc69ddfa3e31aa4c3cbfe384d96749217ff3b2b45a15f34403fe327aa2f805d1eaf7ee7f187070032eceba18a11e4ccf7c2e3a4d5c72d1db7b0bb5dc2354ae7eb27dedb91a5571203835b482353950220ad39f21334135c6fdd22a71c6119ce5dfa292a71ad296b141663210872c192aa228e21068d717235f1186234de39e69e5904ead38314ef69b86a656371d9987d327a7064fc6e1acd7f822165b1e42da9bff573db1eaf2563552bf6dbb6591031883f5cf7e22d1f2e2522e5bb88fc4bdece187d7f2612886a7f314895d43dd2c9e1b731aec39014028590ea0c76f1cd7d71c96ed45ce31d5e38f38a36a95d54708875dd99d8612275450a700251c7f21742d31b9be6de5fcf63b7b639ff746f31537694b3005ddf6cc8375f25bd782bc784943b72bd19f938a449fe0a617b5b1430a4d506e3bf0a1f118b6e45e9e6a3515efd9ecd1a964c5459921b01a0cacf0d4e4659f06ee2e53123a2241b583072f91af6b82f51fa14622ead00697b2f511e7f54cc4e8b015bd03b4ebae849ec9f7738d945450ff8363aee60678b80a86e93326f6a87d73b1a114f6f6186e2a4365d66d5b74df15280c4060ec847da5a1baf1706e7a373f2ec73ad755bffdd5813cf5ce8cf8b07d4ac8b324293b7248145b35b13fe638f902c5e8147084c221591cefa221573080f49ed7b3479e9c81c4ec2e5e8df89ce0266f6023327aae85f74fc70085398ca9749a1b8467d3d2d7bdcfc4bb9af62721a4cf55a5d2600210eeda03de3b9353725eb991583d7226debf7e3d4b06d89c41599b3687d56571c6c810882e1060510b0e6480b4e3d8705c858e24897dd8bd936f9a16bd626b98dd55696aa2dea3c0a12a6b12f5befba90ea487134453b5a8e863b5446565730e9d84e019d664654568c3448bbddd8cccc15e4615addae0d732dafe6f54b229cd5689396720d0010dfea3f9e6d9793b51be5c4e39659e8eb604ec15ee7ae2a2961a8b815d9417795cdde0702d6cf7dcdc16f02365d7eee5dfc7a0a9ea3957672f00a209fb845e782777ef9e5c9e7aa7926bb93c3486a8612e222ddc9709d9a2acef6c60db859c4fd39f365bb22f90edd04f891fd3ccdff35c5eac56ec49d02063a7859aa14c938d575fb85cc26a3f3fb3ef4d8ce576e927dc54c27702aff904e133a6869ac4384ca6ce273d1a7f3b4ffb570dd097e607ade6733262b527c508e4ff7e09bb56432c36a38065c582210252efc06aa0d3fe0ea99e97e6ee88f80ad33bcb2cd0570b8f97488bfe09d4560b9ab44ec7ea5726d291460ab46d32922c1b37067425ff9abc8a4bf810879114dc266a575e1ddcbfd6ef2c51b624091b3ebe68ededfd94f883ae674b1f00be817a559b3c6376aa68f039628ae425191b7c7ba60e73b0fa3c4fe5533b4f8fe0b21f61a5f9e520e22cdbebd929048552b6d8d1d5c18fa9900b7786462e7e4d738e57485e9a6dd14a0fd37f0256613317df8ec3518c7eee50c59070a7276f8b0575426887f2cb5be122cc766a25a07132ef01611d0c2d3f16de29a8c0f39a3a5a3e9596b61fd4e518bcc52cdd2d87605ce9d9c5f2a6d4e11d2f94575b0d5de72d0b97d0a2cf32b5465c6a4ddb62d61b97f2331341c9d448ec775180f858394f2c0b2ee982b9f867d73f97d0e0e3b275ef49c7c262c4d6f5fac787edafaa8b79410b1288a0b52afd93c8584ff9d61eddfa0cada98bd3c200fc708078098764bbe304c44d62eff132415a917c022c9f7466318017da7b4649eb0fae58fcb716a1f295d84dd9ec14218beb0372c041aaa4421a8f75eaef5115f0f32aca8fd30fde0e9e08972e23faf5381eb18c626c0ce920261461c3dfe7f1e8b35ca16f7283de3af4bba5c384e256cd369568214101a8e27c94531a81fe4fba595a4455f8724eebea716d1a4940b3d787fc4bd6ad8aa403fceb74f316fb5a816890646338efb6f13aba195f127aa1b1107bf303b1f997c74d6f4f664d708f58c3b3ca063825405ad7a61260debf4b220443b6537f5ae94820ec62901944cc9023e655f82e0e31a13f351ed0336cbcfda8ae0b20025fb33e49f011f6aa708140cffefbd06f9b90fefc6f9d79f67495ff0b1a2f1ff075eda3fdd800088fc0583dc0e1e9f7f02673da61cc4466a2559d70cd90e453b11449442eb11f444e1203bc38754f7ad0d93bb91e40f9cd490d2dd5d7e2571c460718f94d4c61751c119fedbbbd28d7716ccb6aaa8bafae3756926ae8fccf3c5397a", 0xff8}, {&(0x7f0000000540)="43735ec9", 0x4}, {&(0x7f0000000080)="58c22ba236", 0x5}, {&(0x7f00000000c0)="9f7371161a7b253e2f0376003c347c6a", 0x10}], 0x4, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x400c4}], 0x1, 0x804)
recvmsg(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000002c00)=""/4088, 0xff8}, {&(0x7f0000000440)=""/39, 0x27}], 0x2, 0x0, 0x54}, 0x20002140)
socket(0x400000000010, 0x3, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bind$inet6-connect$inet6-fcntl$dupfd-ioctl$XFS_IOC_START_COMMIT-socket$nl_generic-sendmmsg$inet-socket-syz_clone-openat$procfs-syz_genetlink_get_family_id$ethtool-socket$inet6_mptcp-ptrace-ptrace$pokeuser-timer_create-fcntl$lock-mprotect-timer_settime-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpid-syz_pidfd_open-prctl$PR_SET_IO_FLUSHER-read-setsockopt$sock_int-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$devlink
detailed listing:
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0xc, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c)
r1 = fcntl$dupfd(r0, 0x406, r0)
ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x60c5895)
socket(0x10, 0x803, 0x0)
r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000680)='/proc/asound/seq/timer\x00', 0x0, 0x0)
syz_genetlink_get_family_id$ethtool(0x0, r3)
socket$inet6_mptcp(0xa, 0x1, 0x106)
ptrace(0x10, r2)
ptrace$pokeuser(0x6, r2, 0x358, 0xfffffffffffffff9)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=<r4=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x0, 0x0})
r5 = getpid()
syz_pidfd_open(r5, 0x0)
prctl$PR_SET_IO_FLUSHER(0x43, 0x0)
read(r0, &(0x7f0000000040)=""/42, 0x2a)
setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000380)=0x10, 0x1c)
sendmsg$NFT_BATCH(r1, 0x0, 0x800e805)
syz_genetlink_get_family_id$devlink(&(0x7f00000012c0), r1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$hid-timer_create-fcntl$lock-mprotect-timer_settime-mmap-bpf$PROG_LOAD-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00031d0000000003"], 0x0, 0x0}, 0x0)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="8500000008000000d5000000200004809500000000000000"], &(0x7f0000000240)='GPL\x00', 0x1, 0x367, &(0x7f0000000280)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff60, 0x0, 0xffffffffffffffff, 0x5e}, 0x22)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000205"], 0x0, 0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat-mmap-fallocate-write$binfmt_script-syz_usb_control_io$uac1-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$printer
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0)
fallocate(r1, 0x1, 0x8, 0x7661)
write$binfmt_script(r1, &(0x7f0000001040)={'#! ', './file0'}, 0xb)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_sctp-setsockopt$IP_VS_SO_SET_ADD-setsockopt$inet_tcp_TCP_QUEUE_SEQ-symlink-sendmsg$key-io_submit-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_G_FMT-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS-socket$kcm-socket$nl_netfilter-sendmsg$NFULNL_MSG_CONFIG-socket$kcm-setsockopt$EBT_SO_SET_ENTRIES-syz_open_dev$radio-fcntl$getownex-syz_open_procfs-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-sendmsg$can_raw-ioctl$VIDIOC_S_CTRL-socket$netlink-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendmsg$sock-sendmsg$sock
detailed listing:
executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0)
setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000100)=0x375, 0x4)
symlink(0x0, &(0x7f00000000c0)='./file0\x00')
sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x270, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0203"], 0x10}}, 0x20040010)
io_submit(0x0, 0x1, &(0x7f0000000200)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x4, 0xffffffffffffffff, 0x0}])
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2)
ioctl$vim2m_VIDIOC_G_FMT(r1, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x2, 0x0, 0xffffffff}, 0x7, 0x0, &(0x7f0000000040), 0x5, 0x0}})
r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2)
ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xe8c, 0x870, 0x1, 0x1, 0xd59f80, 0x19f2, 0x3f, 0x20019ef, 0x3, 0x7, 0x2800, 0x9, 0x43e, 0xd1, 0xc, 0x30, {0x8, 0xffffffff}, 0xd0, 0x9}})
r3 = socket$kcm(0xa, 0x2, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x1, 0x4, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x100}, @NFULA_CFG_CMD={0x5, 0x1, 0x3}, @NFULA_CFG_MODE={0xa, 0x2, {0x24000, 0x2}}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x11}, 0x4840)
r5 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0x3ffff, 0x0, 0x90, [0x200000000100, 0x200000000130, 0x200000000160, 0x200000000100, 0x200000000100, 0x200000000100], 0x0, 0x0, 0x0}, 0x108)
r6 = syz_open_dev$radio(&(0x7f0000000000), 0x2, 0x2)
fcntl$getownex(r3, 0x10, &(0x7f0000000180)={0x0, <r7=>0x0})
r8 = syz_open_procfs(r7, &(0x7f0000000280)='fd/4\x00')
r9 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000240)={0x80000011})
sendmsg$can_raw(r8, &(0x7f0000000380)={&(0x7f0000000140), 0x10, &(0x7f0000000340)={&(0x7f00000002c0)=@canfd={{0x0, 0x0, 0x0, 0x1}, 0x33, 0x0, 0x0, 0x0, "0657e4ac730bbc4a7bb3bcbcfc7c9015ae5cc160aea5377343c5a934e7cbd914233e930cbfc0b6ba601d6a76259fc003a82fd362b9416db72aad4f6570b3ad8c"}, 0x48}, 0x1, 0x0, 0x0, 0x40001}, 0x80)
ioctl$VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f00000000c0)={0xf0f041})
r10 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'bridge0\x00', <r11=>0x0})
sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r11, @ANYBLOB="40005200060010"], 0x24}, 0x1, 0x0, 0x0, 0x4004810}, 0x0)
sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@sco={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[@timestamping={{0x14, 0x1, 0x25, 0x5}}], 0x18}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_ERR-close_range-syz_open_procfs-read$FUSE-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
r2 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0)
r4 = eventfd(0xc)
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4})
close_range(r2, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='uid_map\x00')
read$FUSE(r5, &(0x7f0000000400)={0x2020}, 0x2020)
syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000200)={0x2c, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000240)={0x44, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: slab-use-after-free Read in v4l2_open
single: successfully extracted reproducer
found reproducer with 22 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_ERR-close_range-syz_open_procfs-read$FUSE-syz_usb_control_io$rtl8150
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
r2 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0)
r4 = eventfd(0xc)
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4})
close_range(r2, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='uid_map\x00')
read$FUSE(r5, &(0x7f0000000400)={0x2020}, 0x2020)
syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000200)={0x2c, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_ERR-close_range-syz_open_procfs-read$FUSE
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
r2 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0)
r4 = eventfd(0xc)
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4})
close_range(r2, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='uid_map\x00')
read$FUSE(r5, &(0x7f0000000400)={0x2020}, 0x2020)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_ERR-close_range-syz_open_procfs
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
r2 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0)
r4 = eventfd(0xc)
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4})
close_range(r2, 0xffffffffffffffff, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='uid_map\x00')

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_ERR-close_range
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
r2 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0)
r4 = eventfd(0xc)
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4})
close_range(r2, 0xffffffffffffffff, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd-ioctl$VHOST_SET_VRING_ERR
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0)
r3 = eventfd(0xc)
ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r3})

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE-eventfd
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0)
eventfd(0xc)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock-ioctl$VHOST_SET_VRING_BASE
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup-openat$vhost_vsock
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-io_uring_setup
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d})

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0})

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer-syz_usb_control_io$printer
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON-syz_usb_control_io$printer
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))
syz_usb_control_io$printer(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv-ioctl$vim2m_VIDIOC_STREAMON
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)
ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040))

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m-readv
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
r1 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)=""/179, 0xb3}], 0x1)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm-syz_open_dev$vim2m
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})
syz_open_dev$vim2m(&(0x7f00000000c0), 0x47b, 0x2)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_connect$cdc_ecm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_connect$cdc_ecm(0x5, 0x13a, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x128, 0x1, 0x1, 0x9, 0xa0, 0xf4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x0, "b1"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x100000, 0xa529, 0xfff, 0x80}, [@mdlm_detail={0xec, 0x24, 0x13, 0xdf, "8fcb8f0ca4712676ffb7bdc00c572d2c52c0f5fac1d6a2d5f0602bff7593d284dc17ff123caceea6906644a5ffa3e2d8ec03bd5db8f15528bb0db6b0a071ca1dcbf44b057820ece2ddebba5c6522190d71fbcefe277d78cc80a6cd3ef959db2ecf4d1749c28678b006adc43f34de2f1a02097b2ce5542fbdcac9dabb626f38b40c9050310814122591e467db709b9855de6928fc6bcf6406d3de401f29705803b507a9043e574340330b18b07d8641a64ae952ba494413cc226f32d319c805eddadc52a2b971b1635d51c6d851613f2d00ab502e17f57c8b11d81c2d15d2db0be2a1fd2ad077a9e7"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0xa, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x38, 0x1}}}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0x1, 0x4, 0x0, 0x40, 0x1}, 0x141, &(0x7f00000002c0)=ANY=[@ANYBLOB="050f4101060b1001024000f6290900680a1003020700080979002c1002f8a818641ab6b2112420acaa0c6613391a7106ee9e8d27a34145f7fabb4bed6ce6f998ac84736c5c9e0b10010c6900060809001007100210150700e9100a2a3eeec34be5b4977427f4fdb854ab81e85cee8113614ac60f3afe5f9141e3a50256a052e36ca222787cdb12192f905ba86ea2bb4ba77c60dbd5f54844bed1fb5b1e3711a5ec04ff5a5c41c1ae8bf1bc6d8593782211748086f14bbfe6c7beb33c439fef5acd4c30bfe127198372ab65783baac97e9a580bcfa88de9be788a0864f3628ec3566f5bc2135cac38e02acc8ed9336de054faecb606d05670de6e1edbd14c1bd784df2e65767f0e8b70048ffca25c1cd4585f68b4f8bf29fc40ec026c4f3813ffcc7ef4e340fa16cb6cac9e122ccaf8b48f4e1dc17cf0fb66"], 0x6, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x1801}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x418}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x40, &(0x7f0000000500)=@string={0x40, 0x3, "8bf19ab32545385138d3e23544d3432d1b8f26e7a28cd87283f9faf66b3b1738c5262d6d35420d1728962ebd8254f95ac494d0ff733e552c73595c9107f8"}}, {0x73, &(0x7f0000000540)=@string={0x73, 0x3, "8dcc63c5559b5469b4285d06a56cf12c4338e3ab2fb9632045f11ab4adc24d53a50ff626646fbaa9f84867c227c38207052cec8d3e8b80804953590aa198298fb81f6244af5cebd1c41a6f066696b6e453354ea2045edcde04d071e910520f01e3712b35e4ce2455157fa97e7275e42a66"}}, {0x47, &(0x7f00000005c0)=@string={0x47, 0x3, "d93cb4b4b20cd37bba382b7f2d6df3ca221f320d34c81363c4a478dff0674109a5428f7f15e38a34b031b7dfd3dc2b47069d87f7352696a7ae78bbafd81682864db14ebe7f"}}]})

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in v4l2_open
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0)

program crashed: KASAN: slab-use-after-free Read in v4l2_open
validation run: crashed=true
reproducing took 1h42m28.94489671s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_open+0x395/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444
Read of size 4 at addr ffff888036330860 by task v4l_id/6054

CPU: 1 UID: 0 PID: 6054 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 v4l2_open+0x395/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:947
 vfs_open+0x3b/0x340 fs/open.c:1079
 do_open fs/namei.c:4699 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4858
 do_file_open+0x23e/0x4a0 fs/namei.c:4887
 do_sys_openat2+0x113/0x200 fs/open.c:1364
 do_sys_open fs/open.c:1370 [inline]
 __do_sys_openat fs/open.c:1386 [inline]
 __se_sys_openat fs/open.c:1381 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1381
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa8b00a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd86125090 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fa8b0837880 RCX: 00007fa8b00a7407
RDX: 0000000000000000 RSI: 00007ffd86126f1d RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffd861252e0 R14: 00007fa8b099e000 R15: 00005654a695f4d8
 </TASK>

Allocated by task 5766:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 em28xx_v4l2_init+0x10b/0x2eb0 drivers/media/usb/em28xx/em28xx-video.c:2707
 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5766:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x640 mm/slub.c:6565
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2287 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x1685/0x2eb0 drivers/media/usb/em28xx/em28xx-video.c:3078
 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888036330000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 2144 bytes inside of
 freed 8192-byte region [ffff888036330000, ffff888036332000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36330
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe1b280 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe1b280 dead000000000100 dead000000000122
head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5292, tgid 5292 (dhcpcd), ts 39762500906, free_ts 39699175855
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x22d/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x24ba/0x2540 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x339/0x3d0 mm/slub.c:7271
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x392/0x660 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
 tomoyo_init_log+0x112e/0x1fb0 security/tomoyo/audit.c:262
 tomoyo_supervisor+0x353/0x1570 security/tomoyo/common.c:2232
 tomoyo_audit_env_log security/tomoyo/environ.c:37 [inline]
 tomoyo_env_perm+0x151/0x1f0 security/tomoyo/environ.c:64
 tomoyo_environ security/tomoyo/domain.c:673 [inline]
 tomoyo_find_next_domain+0x15cb/0x1aa0 security/tomoyo/domain.c:889
 tomoyo_bprm_check_security+0x11b/0x180 security/tomoyo/tomoyo.c:102
 security_bprm_check+0x85/0x240 security/security.c:820
 search_binary_handler fs/exec.c:1654 [inline]
 exec_binprm fs/exec.c:1696 [inline]
 bprm_execve+0x8a4/0x1510 fs/exec.c:1748
 do_execveat_common+0x50d/0x690 fs/exec.c:1846
 __do_sys_execve fs/exec.c:1930 [inline]
 __se_sys_execve fs/exec.c:1924 [inline]
 __x64_sys_execve+0x97/0xc0 fs/exec.c:1924
page last free pid 5288 tgid 5288 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2943
 __slab_free+0x274/0x2c0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4950
 __alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
 netlink_sendmsg+0x5d4/0xb40 net/netlink/af_netlink.c:1869
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x972/0x9f0 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888036330700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888036330780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888036330800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff888036330880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888036330900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_open+0x395/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444
Read of size 4 at addr ffff888036330860 by task v4l_id/6054

CPU: 1 UID: 0 PID: 6054 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 v4l2_open+0x395/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444
 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
 do_dentry_open+0x785/0x14e0 fs/open.c:947
 vfs_open+0x3b/0x340 fs/open.c:1079
 do_open fs/namei.c:4699 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4858
 do_file_open+0x23e/0x4a0 fs/namei.c:4887
 do_sys_openat2+0x113/0x200 fs/open.c:1364
 do_sys_open fs/open.c:1370 [inline]
 __do_sys_openat fs/open.c:1386 [inline]
 __se_sys_openat fs/open.c:1381 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1381
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa8b00a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd86125090 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fa8b0837880 RCX: 00007fa8b00a7407
RDX: 0000000000000000 RSI: 00007ffd86126f1d RDI: ffffffffffffff9c
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffd861252e0 R14: 00007fa8b099e000 R15: 00005654a695f4d8
 </TASK>

Allocated by task 5766:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 em28xx_v4l2_init+0x10b/0x2eb0 drivers/media/usb/em28xx/em28xx-video.c:2707
 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5766:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x640 mm/slub.c:6565
 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2287 [inline]
 kref_put include/linux/kref.h:65 [inline]
 em28xx_v4l2_init+0x1685/0x2eb0 drivers/media/usb/em28xx/em28xx-video.c:3078
 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888036330000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 2144 bytes inside of
 freed 8192-byte region [ffff888036330000, ffff888036332000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36330
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe1b280 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe1b280 dead000000000100 dead000000000122
head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5292, tgid 5292 (dhcpcd), ts 39762500906, free_ts 39699175855
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x22d/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x24ba/0x2540 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x339/0x3d0 mm/slub.c:7271
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x392/0x660 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
 tomoyo_init_log+0x112e/0x1fb0 security/tomoyo/audit.c:262
 tomoyo_supervisor+0x353/0x1570 security/tomoyo/common.c:2232
 tomoyo_audit_env_log security/tomoyo/environ.c:37 [inline]
 tomoyo_env_perm+0x151/0x1f0 security/tomoyo/environ.c:64
 tomoyo_environ security/tomoyo/domain.c:673 [inline]
 tomoyo_find_next_domain+0x15cb/0x1aa0 security/tomoyo/domain.c:889
 tomoyo_bprm_check_security+0x11b/0x180 security/tomoyo/tomoyo.c:102
 security_bprm_check+0x85/0x240 security/security.c:820
 search_binary_handler fs/exec.c:1654 [inline]
 exec_binprm fs/exec.c:1696 [inline]
 bprm_execve+0x8a4/0x1510 fs/exec.c:1748
 do_execveat_common+0x50d/0x690 fs/exec.c:1846
 __do_sys_execve fs/exec.c:1930 [inline]
 __se_sys_execve fs/exec.c:1924 [inline]
 __x64_sys_execve+0x97/0xc0 fs/exec.c:1924
page last free pid 5288 tgid 5288 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2943
 __slab_free+0x274/0x2c0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4950
 __alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
 netlink_sendmsg+0x5d4/0xb40 net/netlink/af_netlink.c:1869
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x972/0x9f0 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888036330700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888036330780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888036330800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff888036330880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888036330900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================