Extracting prog: 5m39.843308795s
Minimizing prog: 1h2m52.22141378s
Simplifying prog options: 0s
Extracting C: 2m17.374451466s
Simplifying C: 12m10.500023043s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-socketpair$auto-close_range$auto-open-openat$auto_dvb_frontend_fops_dvb_frontend-ioctl$auto
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
open(0x0, 0x22240, 0x55)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
ioctl$auto(0x3, 0x40106f52, 0xffffffffffffffff)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 28, 29, 30, 30, 30, 28, 30, 28, 30, 30, 30, 30, 27, 30, 30, 29, 29, 19, 29, 9, 30, 29, 26]
detailed listing:
executing program 0:
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
statmount$auto(0x0, 0x0, 0x1fe, 0x81)
timer_create$auto(0x0, &(0x7f0000000000)={@sival_int=0x9bb7, @inferred, 0x4, @_tid=0x1}, 0x0)
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0xf7374674b920089e)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
mlockall$auto(0x7)
migrate_pages$auto(0x0, 0x3, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2)
socket(0x1d, 0x2, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x1d, 0x2, 0x6)
r1 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r2=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r2, 0xfd}, 0x6a)
r3 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r4=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r4, 0xfd}, 0x6a)
bpf$auto(0x0, &(0x7f0000000100)=@task_fd_query={0x9, 0x21e9, 0xfffffff2, 0x2, 0x9, 0xb, 0x2e, 0x8000, 0x3}, 0x6f4)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bpf$auto(0x2, &(0x7f00000001c0)=@raw_tracepoint={0x5, 0xffff, 0x0, 0x3}, 0xf)
bpf$auto(0x40002, &(0x7f00000001c0)=@raw_tracepoint={0x5, 0xffff, 0x0, 0x101}, 0x2)
r5 = socket(0x2, 0x1, 0x106)
connect$auto(r5, &(0x7f0000000040)=@in={0x2, 0x20, @remote}, 0x5)
setsockopt$auto(r5, 0x6, 0xd, &(0x7f0000000280)='lp\x00h\x85M\xdf\xdc\x83\x8a\xa7\xe4]U(\x01\t=\x1e\x00\x00', 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
r6 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x20540, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
ioctl$auto(r6, 0x402c542d, 0x38)
executing program 1:
mmap$auto(0x0, 0x20009, 0x0, 0x410, 0x401, 0x8004)
syz_clone(0x40100100, 0x0, 0x0, 0x0, 0x0, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_btrfs_ctl_fops_super(0xffffffffffffff9c, &(0x7f0000000140), 0x80800, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cpu.stat.local\x00', 0x200400, 0x0)
write$auto(r0, 0x0, 0x800f)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000bc0), 0xffffffffffffffff)
signalfd$auto(0xffffffff, 0x0, 0x8)
r1 = openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/trace_clock\x00', 0x101001, 0x0)
write$auto_trace_clock_fops_trace(r1, 0x0, 0x0)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socket(0xa, 0x2, 0x0)
unshare$auto(0x40000080)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x56b)
openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/buffer_size_kb\x00', 0x0, 0x0)
prlimit64$auto(0x0, 0x7, &(0x7f0000000cc0)={0xfff, 0xf1c6}, 0x0)
poll$auto(&(0x7f0000000080)={0xffffffffffffffff, 0x0, 0xffff}, 0x3fa, 0x1c)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x101800, 0x100)
ppoll$auto(&(0x7f0000000180)={r2, 0x4, 0x8}, 0x6, 0x0, 0x0, 0x8)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/pci0000:00/0000:00:01.1/ata1/link1/dev1.1/ata_device/dev1.1/power/control\x00', 0x6c1, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}}, 0x40000)
bpf$auto(0x12, &(0x7f0000000040)=@link_detach, 0x26)
open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/dummy_hcd.2/usb3/authorized\x00', 0x81, 0x0)
write$auto(r3, &(0x7f0000000080)='0\x81=\"\xad\xff\x8d\xf9P\x18\xa4\xb0\xb4\xd9\x82=\xe1P\x05\x00\xfb&\xe8\xbf\x901\a2\xa2X`\a\xf1y\xb3\"=', 0xd4d0)
executing program 1:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0)
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/adsp1\x00', 0x2042, 0x0)
ioctl$auto_SNDCTL_DSP_SETDUPLEX(r1, 0x5016, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000226bd7000fedbdf250300000052c4030000020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001"], 0x58}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
close_range$auto(0x2, 0x8, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4004850)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf1, 0xb0, @raw=0xfffff038}})
ioctl$auto__ctl_fops_dm_ioctl(0xffffffffffffffff, 0x6, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x3fd, 0x8000)
r3 = openat$auto_proc_page_owner_operations_page_owner(0xffffffffffffff9c, &(0x7f0000000040), 0x2482, 0x0)
pread64$auto(r3, 0x0, 0x20000000001, 0x7fff)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f00000003c0), r2)
sendmsg$auto_SMC_NETLINK_DISABLE_SEID(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="030026bd7000080000e704cf01524fba000f0000002b9cfd0c7c16dffc330339a20cb0c85646aa9598bd749dc9173b970c0a58"], 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x810)
mq_open$auto(&(0x7f0000000280)='\\*)A\x00', 0x7e, 0x9, 0x0)
io_uring_setup$auto(0x59, &(0x7f0000000080)={0x9, 0xd, 0x2, 0x6, 0x7, 0x8, 0xffffffffffffffff, [], {0x6, 0x6, 0xf, 0x29f, 0x100, 0x7f, 0x101, 0x6, 0x2}, {0x100, 0x1, 0x52, 0x5, 0x1, 0x40, 0x40, 0x8, 0x100000000}})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
socket(0xa, 0x3, 0xff)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
executing program 1:
io_uring_setup$auto(0x59, 0x0)
mmap$auto(0x0, 0xa00006, 0x2, 0x13, 0x602, 0x300000000000)
prctl$auto_PR_SET_MM_ARG_START(0x4, 0x8, 0xffffffffffffffff, 0xd, 0x6)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff)
madvise$auto(0x0, 0xffffffffffff0005, 0x19)
mlock$auto(0x102, 0x80006)
mlockall$auto(0x800000000000005)
madvise$auto(0x0, 0x200007, 0x19)
mlockall$auto(0x7)
syz_clone3(&(0x7f00000004c0)={0x2000000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x806, 0x0)
pipe$auto(0x0)
ioctl$auto_IOCTL_VMCI_VERSION(0xffffffffffffffff, 0x79f, 0x4)
migrate_pages$auto(0x0, 0x3, &(0x7f0000000100)=0x5, 0x0)
mq_open$auto(0x0, 0x400056a, 0xd, 0x0)
setitimer$auto(0x2, &(0x7f0000000040)={{}, {0x0, 0x8}}, 0x0)
unshare$auto(0x40000080)
mmap$auto(0x21, 0x40008, 0xdb, 0x9b72, 0x7, 0x28000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, &(0x7f0000000200), 0x80000, 0x0)
ioctl$auto_dma_heap_fops_dma_heap(r0, 0xffffffffffdffe00, &(0x7f0000000140)=';')
mmap$auto(0x0, 0x4, 0xffd, 0x8000000008012, 0x3, 0x0)
setitimer$auto(0x7fffffff, &(0x7f0000000000)={{0x1ba4, 0x6}, {0x10000, 0x8000000000000001}}, 0x0)
ioperm$auto(0x7, 0x6, 0x2)
getpid()
close_range$auto(0x2, 0xa, 0x0)
setsockopt$auto(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x14)
unshare$auto(0x40000080)
executing program 2:
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x3, 0x16, 0x940, 0x1ffe0, 0x3, 0x6, 0x2, 0x9, 0x5, 0x2, 0x7, 0xb0, 0x9, 0x5, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x1fe, 0x81)
timer_create$auto(0x0, &(0x7f0000000000)={@sival_int=0x9bb7, @inferred, 0x4, @_tid=0x1}, 0x0)
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00'], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0xf7374674b920089e)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
mlockall$auto(0x7)
migrate_pages$auto(0x0, 0x3, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2)
socket(0x1d, 0x2, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x1d, 0x2, 0x6)
r1 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r2=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r2, 0xfd}, 0x6a)
r3 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r4=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r4, 0xfd}, 0x6a)
bpf$auto(0x0, &(0x7f0000000100)=@task_fd_query={0x9, 0x21e9, 0xfffffff2, 0x2, 0x9, 0xb, 0x2e, 0x8000, 0x3}, 0x6f4)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bpf$auto(0x2, &(0x7f00000001c0)=@raw_tracepoint={0x5, 0xffff, 0x0, 0x3}, 0xf)
bpf$auto(0x40002, &(0x7f00000001c0)=@raw_tracepoint={0x5, 0xffff, 0x0, 0x101}, 0x2)
r5 = socket(0x2, 0x1, 0x106)
connect$auto(r5, &(0x7f0000000040)=@in={0x2, 0x20, @remote}, 0x5)
setsockopt$auto(r5, 0x6, 0xd, &(0x7f0000000280)='lp\x00h\x85M\xdf\xdc\x83\x8a\xa7\xe4]U(\x01\t=\x1e\x00\x00', 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
r6 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x20540, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
ioctl$auto(r6, 0x402c542d, 0x38)
executing program 3:
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000)
remap_file_pages$auto(0x6a27, 0x1003, 0xebb, 0x3, 0x4)
mmap$auto(0x0, 0x7e, 0x2, 0x9b72, 0x2, 0x7fff)
close_range$auto(0x2, 0x8, 0x0)
r0 = io_uring_setup$auto(0x6, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x40001, 0x0)
ioctl$auto_TIOCVHANGUP2(r0, 0x5437, 0x0)
sched_rr_get_interval$auto(0x0, 0x0)
getrandom$auto(0x0, 0xe, 0x7)
madvise$auto(0x81, 0x3, 0x9)
madvise$auto(0x0, 0x2003f0, 0x13)
mincore$auto(0x0, 0x10000, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
poll$auto(&(0x7f0000003640)={<r2=>r1, 0x7, 0x6}, 0x8000004, 0xffffc)
mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r3 = io_uring_setup$auto(0x6, 0x0)
openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/block/loop15/hctx0/cpu0/read_rq_list\x00', 0x101480, 0x0)
lseek$auto(0x3, 0x7fffffffffffffff, 0x0)
socket(0x2, 0x5, 0x0)
bind$auto(0xffffffffffffffff, &(0x7f0000000100)=@can={0x1d, <r4=>0x0}, 0x6a)
sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{&(0x7f0000000000)="d42aab0d5bea7cad64edad3f70e611d7c09e06dd142b968fbdcf09", 0x7, &(0x7f00000000c0)={0x0, 0x19ffb}, 0x201, 0x0, 0x0, 0xb}, 0x9fa5}, 0x7, 0x5)
setsockopt$auto(0x3, 0x1, 0xf, 0x0, 0x8)
listen$auto(0x3, 0x83)
setsockopt$auto(0x3, 0x1, 0x31, 0x0, 0x9)
syz_genetlink_get_family_id$auto_netdev(&(0x7f0000003900), r1)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
timerfd_create$auto(0x8, 0x0)
syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000080), r5)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000240)=ANY=[@ANYBLOB="18e89765f5bf377fba12ddca1d0a53f6d8f0dc2bae5d47ea0e903fc018442c0ce6d62ccd0099daa64e6f2abaa1c2de54da9aca66453e7b151178328cce9732e76020fb80ab922765db10b1c6a08ee3b5f9107453467ce8ecec", @ANYRESOCT=r3, @ANYRESDEC=r4], 0x54}, 0x1, 0x0, 0x0, 0x4008050}, 0x4000800)
executing program 3:
mmap$auto(0x0, 0x20009, 0x0, 0x410, 0x401, 0x8004)
syz_clone(0x40100100, 0x0, 0x0, 0x0, 0x0, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_btrfs_ctl_fops_super(0xffffffffffffff9c, &(0x7f0000000140), 0x80800, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cpu.stat.local\x00', 0x200400, 0x0)
write$auto(r0, 0x0, 0x800f)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000bc0), 0xffffffffffffffff)
signalfd$auto(0xffffffff, 0x0, 0x8)
r1 = openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/trace_clock\x00', 0x101001, 0x0)
write$auto_trace_clock_fops_trace(r1, 0x0, 0x0)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socket(0xa, 0x2, 0x0)
unshare$auto(0x40000080)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x56b)
openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/buffer_size_kb\x00', 0x0, 0x0)
prlimit64$auto(0x0, 0x7, &(0x7f0000000cc0)={0xfff, 0xf1c6}, 0x0)
poll$auto(&(0x7f0000000080)={0xffffffffffffffff, 0x0, 0xffff}, 0x3fa, 0x1c)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x101800, 0x100)
ppoll$auto(&(0x7f0000000180)={r2, 0x4, 0x8}, 0x6, 0x0, 0x0, 0x8)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/pci0000:00/0000:00:01.1/ata1/link1/dev1.1/ata_device/dev1.1/power/control\x00', 0x6c1, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}}, 0x40000)
bpf$auto(0x12, &(0x7f0000000040)=@link_detach, 0x26)
open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/dummy_hcd.2/usb3/authorized\x00', 0x81, 0x0)
write$auto(r3, &(0x7f0000000080)='0\x81=\"\xad\xff\x8d\xf9P\x18\xa4\xb0\xb4\xd9\x82=\xe1P\x05\x00\xfb&\xe8\xbf\x901\a2\xa2X`\a\xf1y\xb3\"=', 0xd4d0)
executing program 2:
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000340)='/dev/v4l-subdev2\x00', 0x80000, 0x0)
r0 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x2000, 0x0)
r1 = getpgid(0x0)
pidfd_open$auto(r1, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f00000001c0)={{@inferred, 0x1, 0x6, 0x80000001, "a2b8e85fc56865ba529faa000000000000000000000018f4ffffdeffff0000000000c7692a240000008000", @raw=0x6}, 0x6, 0x5, 0x7, @inferred=r1, @reserved="fb99d320be0de941ac3f58d7aae0c84cbe332d618e0342771e3ac6e9a9df07cf9b1c017c611ac455c01804d0d3c89bee7005c5affd5ab811fd53443e6cf63a902991b44e48364e8de3f344584996c31f9ae16c6c4f064c38f590125ed26400", "a4699d30a05edbe0d28473c399a7dc920b153e9b1675451d7de94b4123f970bedd3460c667373fcc59b584d81592f4ab606c276852295e00af49090000008034"})
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0)
mmap$auto(0x0, 0x20009, 0x7fffffff, 0xeb1, 0x401, 0x8000)
io_uring_setup$auto(0x9, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0xf7}, 0x7)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x742, 0x0)
open(0x0, 0xa61c2, 0x84)
ioctl$auto(r0, 0x8, r0)
openat$auto_cachefiles_daemon_fops_internal(0xffffffffffffff9c, &(0x7f0000000180), 0x220000, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket(0xa, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000015c0)={'wg1\x00', <r5=>0x0})
r6 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000540)='/dev/tty45\x00', 0x201, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000)
socket(0xa, 0x3, 0x3a)
setsockopt$auto(0x400000000000003, 0x29, 0xd1, 0x0, 0x4)
ioctl$auto_TIOCSTI2(r6, 0x5412, &(0x7f0000000840))
bpf$auto(0x0, &(0x7f0000001500)=@bpf_attr_5={@target_ifindex=r5, r3, 0x9, 0x1, <r7=>r2, @relative_id=0x2, 0x2}, 0x12)
bpf$auto(0x8000000, &(0x7f0000000000)=@query={@target_fd=r7, 0x5, 0x8000a93, 0x93, 0x10001, @count=0x1, 0x0, 0x2, 0x3, 0xbc13, 0xfffffffffffffff7}, 0x0)
request_key$auto_KEY_SPEC_REQUESTOR_KEYRING(&(0x7f0000000040)='c\x00', &(0x7f0000000080)='Kn\x9f\x15\xaf\xfcyF\xe5\b\xdc\xff_l\x17\xd1\xf1\xde\xfc\x0e\xf2\x18\xc0o\xb8\xdbU\xb7', 0x0, 0xfffffffffffffff8)
r8 = socket(0x26, 0x3, 0x9)
r9 = openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
poll$auto(&(0x7f0000000000)={r9, 0x0, 0x3ff}, 0x2, 0x6)
sendmmsg$auto(r8, &(0x7f00000001c0)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000100)={&(0x7f0000000200), 0x11}, 0x5, &(0x7f0000000180), 0x5, 0xe}, 0x5}, 0x2, 0x100)
executing program 2:
mmap$auto(0x0, 0x20009, 0x0, 0x410, 0x401, 0x8004)
syz_clone(0x40100100, 0x0, 0x0, 0x0, 0x0, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_btrfs_ctl_fops_super(0xffffffffffffff9c, &(0x7f0000000140), 0x80800, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cpu.stat.local\x00', 0x200400, 0x0)
write$auto(r0, 0x0, 0x800f)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000bc0), 0xffffffffffffffff)
signalfd$auto(0xffffffff, 0x0, 0x8)
r1 = openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/trace_clock\x00', 0x101001, 0x0)
write$auto_trace_clock_fops_trace(r1, 0x0, 0x0)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socket(0xa, 0x2, 0x0)
unshare$auto(0x40000080)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x56b)
openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/buffer_size_kb\x00', 0x0, 0x0)
prlimit64$auto(0x0, 0x7, &(0x7f0000000cc0)={0xfff, 0xf1c6}, 0x0)
poll$auto(&(0x7f0000000080)={0xffffffffffffffff, 0x0, 0xffff}, 0x3fa, 0x1c)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x101800, 0x100)
ppoll$auto(&(0x7f0000000180)={r2, 0x4, 0x8}, 0x6, 0x0, 0x0, 0x8)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/pci0000:00/0000:00:01.1/ata1/link1/dev1.1/ata_device/dev1.1/power/control\x00', 0x6c1, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}}, 0x40000)
bpf$auto(0x12, &(0x7f0000000040)=@link_detach, 0x26)
open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/dummy_hcd.2/usb3/authorized\x00', 0x81, 0x0)
write$auto(r3, &(0x7f0000000080)='0\x81=\"\xad\xff\x8d\xf9P\x18\xa4\xb0\xb4\xd9\x82=\xe1P\x05\x00\xfb&\xe8\xbf\x901\a2\xa2X`\a\xf1y\xb3\"=', 0xd4d0)
executing program 3:
openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/security/tomoyo/manager\x00', 0x40040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0x14, 0xfffffffffffffffa, 0x6)
openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, 0x0, 0xa2741, 0x0)
r0 = prctl$auto(0x3e, 0x0, 0x0, 0xfffffffffffffffe, 0x4)
mmap$auto(0x3, 0x200000000005, 0xdf, 0xeb5, 0x401, 0x8001)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
recvmmsg$auto(0xffffffffffffffff, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
socket(0x2, 0x1, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/nbd2/queue/io_timeout\x00', 0x129882, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(0x3, 0x40246f4c, 0x38)
unshare$auto(0x40000080)
ioctl$auto_RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x3, {0x8005, 0x3, 0x2, 0x7, 0x2, 0x73, 0xfffffffd, 0x10003, 0x3}})
sendmsg$auto_NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x2404c800)
kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x800c000, 0x4800c000, 0x800c000}, 0x4)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r2 = timerfd_create$auto(0x9, 0x0)
timerfd_settime$auto(r2, 0x0, 0x0, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/pcmC0D0p\x00', 0xa00, 0x0)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x8, 0x7)
open(0x0, 0x161342, 0x100)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
open(0x0, 0xeee00, 0x31)
msgrcv$auto(0x71, &(0x7f0000000040)={0x4, 0x5}, 0x0, 0x7fffffffffffffff, 0x5)
executing program 0:
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000340)='/dev/v4l-subdev2\x00', 0x80000, 0x0)
r0 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC1\x00', 0x2000, 0x0)
r1 = getpgid(0x0)
pidfd_open$auto(r1, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f00000001c0)={{@inferred, 0x1, 0x6, 0x80000001, "a2b8e85fc56865ba529faa000000000000000000000018f4ffffdeffff0000000000c7692a240000008000", @raw=0x6}, 0x6, 0x5, 0x7, @inferred=r1, @reserved="fb99d320be0de941ac3f58d7aae0c84cbe332d618e0342771e3ac6e9a9df07cf9b1c017c611ac455c01804d0d3c89bee7005c5affd5ab811fd53443e6cf63a902991b44e48364e8de3f344584996c31f9ae16c6c4f064c38f590125ed26400", "a4699d30a05edbe0d28473c399a7dc920b153e9b1675451d7de94b4123f970bedd3460c667373fcc59b584d81592f4ab606c276852295e00af49090000008034"})
openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0)
mmap$auto(0x0, 0x20009, 0x7fffffff, 0xeb1, 0x401, 0x8000)
io_uring_setup$auto(0x9, 0x0)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0xf7}, 0x7)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x742, 0x0)
open(0x0, 0xa61c2, 0x84)
ioctl$auto(r0, 0x8, r0)
openat$auto_cachefiles_daemon_fops_internal(0xffffffffffffff9c, &(0x7f0000000180), 0x220000, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket(0xa, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000015c0)={'wg1\x00', <r5=>0x0})
r6 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000540)='/dev/tty45\x00', 0x201, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000)
socket(0xa, 0x3, 0x3a)
setsockopt$auto(0x400000000000003, 0x29, 0xd1, 0x0, 0x4)
ioctl$auto_TIOCSTI2(r6, 0x5412, &(0x7f0000000840)="13915fb9")
bpf$auto(0x0, &(0x7f0000001500)=@bpf_attr_5={@target_ifindex=r5, r3, 0x9, 0x1, <r7=>r2, @relative_id=0x2, 0x2}, 0x12)
bpf$auto(0x8000000, &(0x7f0000000000)=@query={@target_fd=r7, 0x5, 0x8000a93, 0x93, 0x10001, @count=0x1, 0x0, 0x2, 0x3, 0xbc13, 0xfffffffffffffff7}, 0x0)
request_key$auto_KEY_SPEC_REQUESTOR_KEYRING(&(0x7f0000000040)='c\x00', &(0x7f0000000080)='Kn\x9f\x15\xaf\xfcyF\xe5\b\xdc\xff_l\x17\xd1\xf1\xde\xfc\x0e\xf2\x18\xc0o\xb8\xdbU\xb7', 0x0, 0xfffffffffffffff8)
r8 = socket(0x26, 0x3, 0x9)
r9 = openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
poll$auto(&(0x7f0000000000)={r9, 0x0, 0x3ff}, 0x2, 0x6)
sendmmsg$auto(r8, &(0x7f00000001c0)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000100)={&(0x7f0000000200), 0x11}, 0x5, 0x0, 0x5, 0xe}, 0x5}, 0x2, 0x100)
executing program 1:
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull\x00', 0x201, 0x0)
statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x3, 0x16, 0x940, 0x1ffe0, 0x3, 0x6, 0x2, 0x9, 0x5, 0x2, 0x7, 0xb0, 0x9, 0x5, 0x3, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x1fe, 0x81)
timer_create$auto(0x0, &(0x7f0000000000)={@sival_int=0x9bb7, @inferred, 0x4, @_tid=0x1}, 0x0)
r0 = socket(0x10, 0x2, 0x0)
sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0xf7374674b920089e)
mmap$auto(0x0, 0xa00006, 0x2, 0x40eb1, 0x602, 0x300000000000)
mlockall$auto(0x7)
migrate_pages$auto(0x0, 0x3, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2)
socket(0x1d, 0x2, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x1d, 0x2, 0x6)
r1 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r2=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r2, 0xfd}, 0x6a)
r3 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r4=>0x0})
bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r4, 0xfd}, 0x6a)
bpf$auto(0x0, &(0x7f0000000100)=@task_fd_query={0x9, 0x21e9, 0xfffffff2, 0x2, 0x9, 0xb, 0x2e, 0x8000, 0x3}, 0x6f4)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
bpf$auto(0x2, 0x0, 0xf)
bpf$auto(0x40002, &(0x7f00000001c0)=@raw_tracepoint={0x5, 0xffff, 0x0, 0x101}, 0x2)
r5 = socket(0x2, 0x1, 0x106)
connect$auto(r5, &(0x7f0000000040)=@in={0x2, 0x20, @remote}, 0x5)
setsockopt$auto(r5, 0x6, 0xd, &(0x7f0000000280)='lp\x00h\x85M\xdf\xdc\x83\x8a\xa7\xe4]U(\x01\t=\x1e\x00\x00', 0x6)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008)
r6 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x20540, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
ioctl$auto(r6, 0x402c542d, 0x38)
executing program 2:
openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/security/tomoyo/manager\x00', 0x40040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0x14, 0xfffffffffffffffa, 0x6)
openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, 0x0, 0xa2741, 0x0)
r0 = prctl$auto(0x3e, 0x0, 0x0, 0xfffffffffffffffe, 0x4)
mmap$auto(0x3, 0x200000000005, 0xdf, 0xeb5, 0x401, 0x8001)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
recvmmsg$auto(0xffffffffffffffff, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
socket(0x2, 0x1, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/nbd2/queue/io_timeout\x00', 0x129882, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(0x3, 0x40246f4c, 0x38)
unshare$auto(0x40000080)
ioctl$auto_RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x3, {0x8005, 0x3, 0x2, 0x7, 0x2, 0x73, 0xfffffffd, 0x10003, 0x3}})
sendmsg$auto_NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x2404c800)
kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x800c000, 0x4800c000, 0x800c000}, 0x4)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r2 = timerfd_create$auto(0x9, 0x0)
timerfd_settime$auto(r2, 0x0, 0x0, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/pcmC0D0p\x00', 0xa00, 0x0)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x8, 0x7)
open(0x0, 0x161342, 0x100)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
open(0x0, 0xeee00, 0x31)
msgrcv$auto(0x71, &(0x7f0000000040)={0x4, 0x5}, 0x0, 0x7fffffffffffffff, 0x5)
executing program 0:
socket(0x15, 0x5, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/fs/cifs/LinuxExtensionsEnabled\x00', 0x842, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/virtual/block/nbd2/mq/0/cpu_list\x00', 0xa0440, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000080)=""/64, 0x40)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
adjtimex$auto(&(0x7f00000004c0)={0xf332b6c, 0x0, 0x0, 0xfffffffffffffffd, 0x4ea, 0x1, 0x6, 0x0, 0x1, 0x0, 0x8, {0x100000000, 0x10000}, 0x5, 0x6, 0xfffffffffffffffd, 0x6, 0x0, 0x80000004, 0x81, 0xffffffffffff628e, 0xa747, 0xdeb1, 0x804})
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000500)='/dev/video0\x00', 0x0, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9)
socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x9, 0x80000001, 0x7, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffd]}, 0x0)
timerfd_create$auto(0x100, 0x150b)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'})
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x2, 0x100)
close_range$auto(0x2, 0x8, 0x0)
ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0)
openat$auto_proc_gid_map_operations_base(0xffffffffffffff9c, 0x0, 0x0, 0x0)
socket(0x9, 0x1, 0x4)
mprotect$auto(0x5, 0x8000000000000004, 0x5)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
msync$auto(0x0, 0x2000000005, 0x6)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
madvise$auto(0x1, 0xfc00, 0xa)
syz_clone(0x40040000, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0)
pkey_free$auto(0x7ff)
executing program 1:
openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/security/tomoyo/manager\x00', 0x40040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
r0 = openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, 0x0, 0xa2741, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
syz_genetlink_get_family_id$auto_hsr(&(0x7f0000000100), r2)
sendmsg$auto_HSR_C_GET_NODE_STATUS(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES8=r0, @ANYBLOB="00012cbd7000fbdbdf2503000000060006000080ee000827540e00040000fcffff08000300c06ca1510f629d37c35136dd32b2ead5b9b7875488f9259d550adbca625a4b4998a0ec5e13438af59fde7a3e84aa61b2f0b081ca4ade6f8b0339d7d8ed188a4fc1a2a9d6058e5adf3cd0d0dbda795e3a7d28631ad4b62cf5fa9f2d444793dfddfe1c1d08571e7bc6a9dd691e1b2c30650a72202182247d4bbecea6ed91920b0024c2cf5530ddf092fdabc7336a2d84359ca052214cfa9278d8c895c9eadb42e87855e3b9d86f81af95782aba2c8df9637dcb8e25164a358cbaf9bbd707c793943af651ade02cb8911eee3cfbd414daa11c7f3edda988c3f9f45fb613811ef2fef4a7570a40260d91a0db7292de164ebe90510b6c94607c"], 0x2c}, 0x1, 0x0, 0x0, 0x4008811}, 0x48c4)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
r3 = openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/pcmC1D1p\x00', 0xa00, 0x0)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x8, 0x7)
open(0x0, 0x161342, 0x100)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
open(0x0, 0xecc00, 0x40)
msgrcv$auto(0x71, &(0x7f0000000040)={0x4, 0x5}, 0x0, 0x7fffffffffffffff, 0x5)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
gettid()
r4 = socket(0xf, 0xa, 0x5)
r5 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), r4)
msgctl$auto(0x8000, 0x6, 0x0)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRESOCT, @ANYRES16=r5, @ANYBLOB="000226bd7000fbdbdf251f0000000500080007000000d1fe2c000000010006000a000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2000c814}, 0x40000)
rt_sigtimedwait$auto(&(0x7f0000000000)={0x86e}, 0x0, 0x0, 0x8)
socket(0x25, 0x2, 0x2)
r6 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000002400)='/sys/devices/virtual/mtd/mtd0/mtdblock0/ro\x00', 0x20000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(r6, &(0x7f0000000040)=""/156, 0x9c)
mmap$auto(0x0, 0x400008, 0xdf, 0x9972, r3, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
sysfs$auto(0x2, 0x10000000000002a, 0x0)
executing program 3:
syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), 0xffffffffffffffff)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
close_range$auto(0x2, 0x8, 0x0)
r0 = openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$auto_dma_heap_fops_dma_heap(r0, 0xffffffffffdffe00, &(0x7f0000000140)=';')
socket$nl_generic(0x10, 0x3, 0x10)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, 0x0, 0x42c883, 0x0)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
select$auto(0x800e, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0x20d, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x800, 0x0, 0x80000001, 0x6, 0x6d42, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7)
msync$auto(0x8001, 0x1c0000000100000, 0x7)
msgrcv$auto(0x71, &(0x7f0000000040)={0x4, 0x7}, 0x0, 0x7fffffffffffffff, 0x5)
socket(0xa, 0x4, 0x6)
msgctl$auto(0x8000, 0x6, &(0x7f0000000180)={{0x442, 0xffffffffffffffff, 0xee01, 0x0, 0x1, 0x6, 0x83}, &(0x7f0000000100)=0xf9, &(0x7f0000000140)=0x2, 0x4, 0xfffffffffffffffe, 0xc869be, 0x1, 0x128, 0x8000, 0x806, 0x3, @inferred, @raw=0x3})
lseek$auto(0xffffffffffffffff, 0x3, 0x42)
r2 = open(0x0, 0xeee00, 0x31)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
write$auto(0x3, 0x0, 0x100082)
lseek$auto(r2, 0x7fffffffffffffff, 0x3)
sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, 0x0, 0x800)
r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0x82000, 0x0)
ioctl$auto_SNDCTL_DSP_CHANNELS(r3, 0xc0045006, 0x0)
r4 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0)
write$auto_snd_pcm_oss_f_reg_pcm_oss(r4, &(0x7f0000000000)="ca", 0x1)
executing program 0:
mmap$auto(0x0, 0x20009, 0x0, 0x410, 0x401, 0x8004)
ioctl$auto_IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, 0x0)
syz_clone(0x40100100, 0x0, 0x0, 0x0, 0x0, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_btrfs_ctl_fops_super(0xffffffffffffff9c, &(0x7f0000000140), 0x80800, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cpu.stat.local\x00', 0x200400, 0x0)
write$auto(r0, 0x0, 0x800f)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000bc0), 0xffffffffffffffff)
signalfd$auto(0xffffffff, 0x0, 0x8)
r1 = openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/trace_clock\x00', 0x101001, 0x0)
write$auto_trace_clock_fops_trace(r1, 0x0, 0x0)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socket(0xa, 0x2, 0x0)
unshare$auto(0x40000080)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x56b)
openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/buffer_size_kb\x00', 0x0, 0x0)
prlimit64$auto(0x0, 0x7, &(0x7f0000000cc0)={0xfff, 0xf1c6}, 0x0)
poll$auto(&(0x7f0000000080)={0xffffffffffffffff, 0x0, 0xffff}, 0x3fa, 0x1c)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x101800, 0x100)
ppoll$auto(&(0x7f0000000180)={r2, 0x4, 0x8}, 0x6, 0x0, 0x0, 0x8)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/pci0000:00/0000:00:01.1/ata1/link1/dev1.1/ata_device/dev1.1/power/control\x00', 0x6c1, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}}, 0x40000)
bpf$auto(0x12, &(0x7f0000000040)=@link_detach, 0x26)
open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/dummy_hcd.2/usb3/authorized\x00', 0x81, 0x0)
write$auto(r3, &(0x7f0000000080)='0\x81=\"\xad\xff\x8d\xf9P\x18\xa4\xb0\xb4\xd9\x82=\xe1P\x05\x00\xfb&\xe8\xbf\x901\a2\xa2X`\a\xf1y\xb3\"=', 0xd4d0)
executing program 2:
mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0)
ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0)
mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000)
r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/adsp1\x00', 0x2042, 0x0)
ioctl$auto_SNDCTL_DSP_SETDUPLEX(r1, 0x5016, 0x0)
sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000226bd7000fedbdf250300000052c4030000020000060007000080000008000200", @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001"], 0x58}, 0x1, 0x0, 0x0, 0x40080}, 0x40090)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800)
close_range$auto(0x2, 0x8, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x10, 0x3, 0x6)
sendmsg$auto_NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4004850)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000040)={0x6, 0x0})
ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf1, 0xb0, @raw=0xfffff038}})
ioctl$auto__ctl_fops_dm_ioctl(0xffffffffffffffff, 0x6, 0x0)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x3fd, 0x8000)
r3 = openat$auto_proc_page_owner_operations_page_owner(0xffffffffffffff9c, &(0x7f0000000040), 0x2482, 0x0)
pread64$auto(r3, 0x0, 0x20000000001, 0x7fff)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f00000003c0), r2)
sendmsg$auto_SMC_NETLINK_DISABLE_SEID(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="030026bd7000080000e704cf01524fba000f0000002b9cfd0c7c"], 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x810)
mq_open$auto(&(0x7f0000000280)='\\*)A\x00', 0x7e, 0x9, 0x0)
io_uring_setup$auto(0x59, &(0x7f0000000080)={0x9, 0xd, 0x2, 0x6, 0x7, 0x8, 0xffffffffffffffff, [], {0x6, 0x6, 0xf, 0x29f, 0x100, 0x7f, 0x101, 0x6, 0x2}, {0x100, 0x1, 0x52, 0x5, 0x1, 0x40, 0x40, 0x8, 0x100000000}})
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000)
socket(0xa, 0x3, 0xff)
clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2)
executing program 0:
socket(0xa, 0x6, 0x0)
mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000)
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/sctp/plpmtud_probe_interval\x00', 0x88082, 0x0)
sendfile$auto(r0, 0x3, 0x0, 0x400000000008)
close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002)
openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, 0x0, 0x80200, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_secret$auto(0x0)
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket(0x2, 0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
memfd_create$auto(0x0, 0xe)
socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x31}}, 0x6a)
sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000)
executing program 0:
mmap$auto(0x0, 0x20009, 0x0, 0x410, 0x401, 0x8004)
ioctl$auto_IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, 0x0)
syz_clone(0x40100100, 0x0, 0x0, 0x0, 0x0, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_btrfs_ctl_fops_super(0xffffffffffffff9c, &(0x7f0000000140), 0x80800, 0x0)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cpu.stat.local\x00', 0x200400, 0x0)
write$auto(r0, 0x0, 0x800f)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000bc0), 0xffffffffffffffff)
signalfd$auto(0xffffffff, 0x0, 0x8)
r1 = openat$auto_trace_clock_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/trace_clock\x00', 0x101001, 0x0)
write$auto_trace_clock_fops_trace(r1, 0x0, 0x0)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socket(0xa, 0x2, 0x0)
unshare$auto(0x40000080)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x56b)
openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/buffer_size_kb\x00', 0x0, 0x0)
prlimit64$auto(0x0, 0x7, &(0x7f0000000cc0)={0xfff, 0xf1c6}, 0x0)
poll$auto(&(0x7f0000000080)={0xffffffffffffffff, 0x0, 0xffff}, 0x3fa, 0x1c)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x101800, 0x100)
ppoll$auto(&(0x7f0000000180)={r2, 0x4, 0x8}, 0x6, 0x0, 0x0, 0x8)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/pci0000:00/0000:00:01.1/ata1/link1/dev1.1/ata_device/dev1.1/power/control\x00', 0x6c1, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}}, 0x40000)
bpf$auto(0x12, &(0x7f0000000040)=@link_detach, 0x26)
open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/dummy_hcd.2/usb3/authorized\x00', 0x81, 0x0)
write$auto(r3, &(0x7f0000000080)='0\x81=\"\xad\xff\x8d\xf9P\x18\xa4\xb0\xb4\xd9\x82=\xe1P\x05\x00\xfb&\xe8\xbf\x901\a2\xa2X`\a\xf1y\xb3\"=', 0xd4d0)
executing program 3:
prctl$auto(0x39, 0xfffffffffffffff2, 0x0, 0x0, 0x0)
ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000100)={"777d18b3b58c533bd55ed1721787c4ff3dd840773f2b8a55eaabccaf2d2c5073", 0x0, 0x4734, 0x1, 0x3, 0x6, <r0=>0x0})
getpgrp(r0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video3\x00', 0x10b000, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r1)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'wlan0\x00', <r3=>0x0})
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, r2, 0xd0d58b333228212f, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r3}, @NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0xffffffff}]}, 0x24}}, 0x4000000)
close_range$auto(0x0, 0x5, 0x0)
executing program 1:
openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/security/tomoyo/manager\x00', 0x40040, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, 0x0, 0xa2741, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/pcmC0D0p\x00', 0xa00, 0x0)
prctl$auto(0x1000000003b, 0x1, 0x4, 0x8, 0x7)
open(0x0, 0x161342, 0x100)
msync$auto(0x1ffff000, 0x1800000ff010000, 0x400000004)
open(0x0, 0xeee00, 0x31)
msgrcv$auto(0x71, &(0x7f0000000040)={0x6, 0x5}, 0x8000000000000001, 0x4, 0x5)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
gettid()
r1 = socket(0xf, 0xa, 0x5)
r2 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), r1)
msgctl$auto(0x8000, 0x6, 0x0)
sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRESOCT, @ANYRES16=r2, @ANYBLOB="000226bd7000fbdbdf251f0000000500080007000000d1fe2c000000010006000a000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2000c814}, 0x40000)
rt_sigtimedwait$auto(&(0x7f0000000000)={0x86e}, 0x0, 0x0, 0x8)
r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x80102, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x10ba00, 0x114)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
write$auto(0x3, 0x0, 0x100082)
mmap$auto(0x9, 0x4020009, 0xdf, 0xeb1, r3, 0xb)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
ioperm$auto(0x2, 0x31c, 0x4)
add_key$auto(0x0, 0x0, 0x0, 0x1, 0x8010)
msgget$auto(0x0, 0x77d9)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
pread64$auto(0xffffffffffffffff, 0x0, 0x3, 0x5)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x4000000)
mmap$auto(0x0, 0xc, 0xdf, 0xeb1, 0xffffffffffffffff, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0)
recvmmsg$auto(r0, &(0x7f0000000280)={{&(0x7f0000000200)="2d30284dac75b85fd636db4df2a17ab5710b95fcaeee1d8b6d00cb860574636dfdafd96e128f4d9b4c68f1c425c7a8cbdb0ee08d449b589530207e5ccb7f650d15049feceb", 0xff, &(0x7f0000000040)={&(0x7f0000000340)="abd3ca1c556f0280f93dd790fc95d898df0f575c7649fac6188d7c24adc22cf0adbf95dc2534178f1107a3094b68553085357db51ce8f47f62c02a88bde66e98f88238f902c32f39ba2424c2fb8c57500c8b60dff1a045830c6060f11342d6b495489d6aa822de3a971c679a7a13a7301bb026974eae9d5bbfeadf", 0x1ff}, 0x7, &(0x7f00000003c0)="8ba54b0d05bdd35749beb7acefbf9958fcf008de98936bdec397c4bdaf20a57eec7b7709e4609d705672eb4a6f1f8893628b5a1b965c45b01f28005f1c1c6d32bd1e1bd8ee3b6122325cf23cafef1e7e97319c51de023b938dee970d9c694b95d70f9378e1d3f3caf099736bbaa002ba8cc3a4770ab2799f5727884707dc8d11b1d879d483040d5e057f1834a2dfaada0c60db3acaf6cfc0758e1d9a278f861b40", 0x71, 0x401}, 0x7ff}, 0x2, 0xfffff6c1, &(0x7f0000000480)={0x8, 0x10})
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS0\x00', 0x1, 0x0)
r1 = io_uring_setup$auto(0x6, 0x0)
io_uring_register$auto(r1, 0x22, &(0x7f0000000000), 0x20000001)
sendmsg$auto_NL80211_CMD_TDLS_CHANNEL_SWITCH(0xffffffffffffffff, 0x0, 0x4000)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
socket(0x11, 0x3, 0x9)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000180)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x80000062, 0x80000001, 0x7, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0)
openat$auto_sg_fops_sg(0xffffffffffffff9c, 0x0, 0x82802, 0x0)
write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x8000001f, 0x7, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0)
select$auto(0x3, 0x0, &(0x7f0000000100)={[0x8, 0xb, 0x0, 0x9, 0xfffffffffffffffc, 0x83, 0x6, 0x2, 0x9, 0x5, 0x4000000000000002, 0xd, 0x3, 0xfffffffffffffffa, 0x7, 0x1000000006]}, 0x0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x5590, 0xffffffff, 0x7ffe, 0xeb1, 0xfffffffffffffffa, 0x8000)
r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001a40), r0)
sendmsg$auto_ETHTOOL_MSG_CABLE_TEST_TDR_ACT(r0, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000002f00)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="fc180000", @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf251b", @ANYRES32=0x0, @ANYBLOB="0c00028008000300", @ANYRES32=0x0, @ANYBLOB], 0x90}, 0x1, 0x0, 0x0, 0x24040000}, 0x4000800)
executing program 3:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
open(0x0, 0x22240, 0x55)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
ioctl$auto(0x3, 0x40106f52, 0xffffffffffffffff)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-socketpair$auto-close_range$auto-open-openat$auto_dvb_frontend_fops_dvb_frontend-ioctl$auto
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
open(0x0, 0x22240, 0x55)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
ioctl$auto(0x3, 0x40106f52, 0xffffffffffffffff)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
single: successfully extracted reproducer
found reproducer with 26 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-socketpair$auto-close_range$auto-open-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
open(0x0, 0x22240, 0x55)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-socketpair$auto-close_range$auto-open
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
open(0x0, 0x22240, 0x55)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-socketpair$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-socketpair$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-socketpair$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-socketpair$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-socket-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0xa, 0x2, 0x3a)
close_range$auto(0x2, 0xffffffffffffffff, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-inotify_init1$auto-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
inotify_init1$auto(0x3000000000000)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x2, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-socket$nl_generic-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-openat$auto_console_fops_tty_io-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x102, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-openat$auto_proc_reg_file_ops_compat_inode-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x20000, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
socket(0x2, 0x6, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
socket(0x10, 0x2, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-openat$auto_qrtr_tun_ops_tun-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, 0x0, 0x141a41, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-openat$auto_proc_single_file_operations_base-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqmstat\x00', 0x100382, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x15, 0x5, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-socket$nl_generic-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket$nl_generic-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-inotify_init1$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
inotify_init1$auto(0x3000000000000)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socketpair$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KFENCE: use-after-free in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kernfs_file_fops_kernfs_internal-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
detailed listing:
executing program 0:
mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000)
socket(0x25, 0x1, 0x0)
r0 = io_uring_setup$auto(0x4, 0x0)
close_range$auto(0x2, r0, 0x0)
openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, 0x0, 0x1, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-io_uring_setup$auto-close_range$auto-openat$auto_dvb_frontend_fops_dvb_frontend
program crashed: KASAN: slab-use-after-free Read in dvb_device_open
reproducing took 1h22m59.939222636s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in dvb_device_open+0x36a/0x3b0 drivers/media/dvb-core/dvbdev.c:99
Read of size 8 at addr ffff8881412e5c18 by task syz-executor286/9131

CPU: 0 UID: 0 PID: 9131 Comm: syz-executor286 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 dvb_device_open+0x36a/0x3b0 drivers/media/dvb-core/dvbdev.c:99
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3845 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4004
 do_filp_open+0x20b/0x470 fs/namei.c:4031
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6ae2b5eb69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe062c8c58 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6ae2b5eb69
RDX: 0000000000000001 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0
R10: 0000000000000000 R11: 0000000000000206 R12: 000000000001b145
R13: 00007ffe062c8c6c R14: 00007ffe062c8c80 R15: 00007ffe062c8c70
 </TASK>

Allocated by task 1:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 dvb_register_device+0x1e4/0x2370 drivers/media/dvb-core/dvbdev.c:475
 dvb_register_frontend+0x5a6/0x880 drivers/media/dvb-core/dvb_frontend.c:3051
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline]
 vidtv_bridge_probe+0x459/0xa90 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508
 platform_probe+0xff/0x1f0 drivers/base/platform.c:1404
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:658
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
 __driver_attach+0x283/0x580 drivers/base/dd.c:1216
 bus_for_each_dev+0x13b/0x1d0 drivers/base/bus.c:370
 bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678
 driver_register+0x15c/0x4b0 drivers/base/driver.c:249
 vidtv_bridge_init+0x45/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598
 do_one_initcall+0x120/0x6e0 init/main.c:1257
 do_initcall_level init/main.c:1319 [inline]
 do_initcalls init/main.c:1335 [inline]
 do_basic_setup init/main.c:1354 [inline]
 kernel_init_freeable+0x5c2/0x900 init/main.c:1567
 kernel_init+0x1c/0x2b0 init/main.c:1457
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 9129:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2389 [inline]
 slab_free mm/slub.c:4646 [inline]
 kfree+0x2b6/0x4d0 mm/slub.c:4845
 dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline]
 kref_put include/linux/kref.h:65 [inline]
 dvb_device_put.part.0+0x60/0x90 drivers/media/dvb-core/dvbdev.c:632
 dvb_device_put drivers/media/dvb-core/dvbdev.c:631 [inline]
 dvb_device_open+0x2a4/0x3b0 drivers/media/dvb-core/dvbdev.c:113
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3845 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4004
 do_filp_open+0x20b/0x470 fs/namei.c:4031
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8881412e5c00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 24 bytes inside of
 freed 256-byte region [ffff8881412e5c00, ffff8881412e5d00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1412e4
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801b441b40 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 057ff00000000040 ffff88801b441b40 dead000000000122 0000000000000000
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 057ff00000000001 ffffea000504b901 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 24564099529, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1717
 prep_new_page mm/page_alloc.c:1725 [inline]
 get_page_from_freelist+0x1193/0x39b0 mm/page_alloc.c:3652
 __alloc_frozen_pages_noprof+0x263/0x23a0 mm/page_alloc.c:4934
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 alloc_slab_page mm/slub.c:2459 [inline]
 allocate_slab mm/slub.c:2623 [inline]
 new_slab+0x23c/0x330 mm/slub.c:2676
 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3862
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3952
 __slab_alloc_node mm/slub.c:4027 [inline]
 slab_alloc_node mm/slub.c:4188 [inline]
 __kmalloc_cache_noprof+0xfb/0x3e0 mm/slub.c:4357
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 bus_add_driver+0x92/0x690 drivers/base/bus.c:662
 driver_register+0x15c/0x4b0 drivers/base/driver.c:249
 usb_register_driver+0x216/0x4d0 drivers/usb/core/driver.c:1078
 do_one_initcall+0x120/0x6e0 init/main.c:1257
 do_initcall_level init/main.c:1319 [inline]
 do_initcalls init/main.c:1335 [inline]
 do_basic_setup init/main.c:1354 [inline]
 kernel_init_freeable+0x5c2/0x900 init/main.c:1567
 kernel_init+0x1c/0x2b0 init/main.c:1457
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881412e5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881412e5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881412e5c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8881412e5c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881412e5d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in dvb_device_open+0x36a/0x3b0 drivers/media/dvb-core/dvbdev.c:99
Read of size 8 at addr ffff8881412e5c18 by task syz-executor286/9131

CPU: 0 UID: 0 PID: 9131 Comm: syz-executor286 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 dvb_device_open+0x36a/0x3b0 drivers/media/dvb-core/dvbdev.c:99
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3845 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4004
 do_filp_open+0x20b/0x470 fs/namei.c:4031
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6ae2b5eb69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe062c8c58 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6ae2b5eb69
RDX: 0000000000000001 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0
R10: 0000000000000000 R11: 0000000000000206 R12: 000000000001b145
R13: 00007ffe062c8c6c R14: 00007ffe062c8c80 R15: 00007ffe062c8c70
 </TASK>

Allocated by task 1:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 dvb_register_device+0x1e4/0x2370 drivers/media/dvb-core/dvbdev.c:475
 dvb_register_frontend+0x5a6/0x880 drivers/media/dvb-core/dvb_frontend.c:3051
 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:436 [inline]
 vidtv_bridge_probe+0x459/0xa90 drivers/media/test-drivers/vidtv/vidtv_bridge.c:508
 platform_probe+0xff/0x1f0 drivers/base/platform.c:1404
 call_driver_probe drivers/base/dd.c:579 [inline]
 really_probe+0x23e/0xa90 drivers/base/dd.c:658
 __driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
 __driver_attach+0x283/0x580 drivers/base/dd.c:1216
 bus_for_each_dev+0x13b/0x1d0 drivers/base/bus.c:370
 bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678
 driver_register+0x15c/0x4b0 drivers/base/driver.c:249
 vidtv_bridge_init+0x45/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:598
 do_one_initcall+0x120/0x6e0 init/main.c:1257
 do_initcall_level init/main.c:1319 [inline]
 do_initcalls init/main.c:1335 [inline]
 do_basic_setup init/main.c:1354 [inline]
 kernel_init_freeable+0x5c2/0x900 init/main.c:1567
 kernel_init+0x1c/0x2b0 init/main.c:1457
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 9129:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2389 [inline]
 slab_free mm/slub.c:4646 [inline]
 kfree+0x2b6/0x4d0 mm/slub.c:4845
 dvb_free_device drivers/media/dvb-core/dvbdev.c:619 [inline]
 kref_put include/linux/kref.h:65 [inline]
 dvb_device_put.part.0+0x60/0x90 drivers/media/dvb-core/dvbdev.c:632
 dvb_device_put drivers/media/dvb-core/dvbdev.c:631 [inline]
 dvb_device_open+0x2a4/0x3b0 drivers/media/dvb-core/dvbdev.c:113
 chrdev_open+0x231/0x6a0 fs/char_dev.c:414
 do_dentry_open+0x741/0x1c10 fs/open.c:956
 vfs_open+0x82/0x3f0 fs/open.c:1086
 do_open fs/namei.c:3845 [inline]
 path_openat+0x1e5e/0x2d40 fs/namei.c:4004
 do_filp_open+0x20b/0x470 fs/namei.c:4031
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1455
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8881412e5c00
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 24 bytes inside of
 freed 256-byte region [ffff8881412e5c00, ffff8881412e5d00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1412e4
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801b441b40 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 057ff00000000040 ffff88801b441b40 dead000000000122 0000000000000000
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 057ff00000000001 ffffea000504b901 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 24564099529, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1717
 prep_new_page mm/page_alloc.c:1725 [inline]
 get_page_from_freelist+0x1193/0x39b0 mm/page_alloc.c:3652
 __alloc_frozen_pages_noprof+0x263/0x23a0 mm/page_alloc.c:4934
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 alloc_slab_page mm/slub.c:2459 [inline]
 allocate_slab mm/slub.c:2623 [inline]
 new_slab+0x23c/0x330 mm/slub.c:2676
 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3862
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3952
 __slab_alloc_node mm/slub.c:4027 [inline]
 slab_alloc_node mm/slub.c:4188 [inline]
 __kmalloc_cache_noprof+0xfb/0x3e0 mm/slub.c:4357
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 bus_add_driver+0x92/0x690 drivers/base/bus.c:662
 driver_register+0x15c/0x4b0 drivers/base/driver.c:249
 usb_register_driver+0x216/0x4d0 drivers/usb/core/driver.c:1078
 do_one_initcall+0x120/0x6e0 init/main.c:1257
 do_initcall_level init/main.c:1319 [inline]
 do_initcalls init/main.c:1335 [inline]
 do_basic_setup init/main.c:1354 [inline]
 kernel_init_freeable+0x5c2/0x900 init/main.c:1567
 kernel_init+0x1c/0x2b0 init/main.c:1457
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881412e5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881412e5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881412e5c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8881412e5c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881412e5d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================