Extracting prog: 6m53.37418114s
Minimizing prog: 1h17m51.38119887s
Simplifying prog options: 0s
Extracting C: 1m3.976985307s
Simplifying C: 11m1.067296151s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto-ioctl$auto_KVM_CHECK_EXTENSION
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r2 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r2, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r2, 0x5501, 0x0)
r3 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r3, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r3)
unshare$auto(0x40000080)
r4 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r4, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r6 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r6, 0xaf01, 0x0)
read$auto(r5, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)
ioctl$auto_KVM_CHECK_EXTENSION(r1, 0xae03, 0xea)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 12, 10, 7, 30, 7, 5, 22, 30, 5, 30, 11, 17, 18, 8, 25, 30, 30, 6, 12, 13, 27, 30, 28]
detailed listing:
executing program 1:
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x10, 0x2, 0x14)
close_range$auto(0x2, 0xa, 0x0)
r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0)
r1 = ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$auto(0x3, 0xae60, 0x10000000000402)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$auto(r1, 0x4008ae6a, r2)
executing program 3:
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
io_uring_setup$auto(0x6, 0x0)
r0 = socket(0x2, 0x5, 0x0)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x80002, 0x73)
socket(0x2, 0x1, 0x84)
setsockopt$auto(0x3, 0x10000000084, 0x81, 0x0, 0x8)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a)
sendmmsg$auto(r0, &(0x7f0000000080)={{&(0x7f0000000040), 0x1c, &(0x7f00000000c0)={0x0, 0x1a004}, 0x7, 0x0, 0x0, 0xb}, 0xfff}, 0x5, 0x8)
setsockopt$auto(0x3, 0x84, 0x17, 0x0, 0x27)
setsockopt$auto(0x3, 0x10000000084, 0x18, 0x0, 0x8)
executing program 3:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4ea2, @remote}, 0x6a)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7, 0x20020000)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd)
ioctl$auto_SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
sendmsg$auto_NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x40000)
write$auto(0x3, 0x0, 0xfffffdef)
connect$auto(0x3, 0x0, 0x55)
executing program 2:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x2, 0x88)
setsockopt$auto(r0, 0x88, 0xa, &(0x7f0000000000)='\xba\xba\xd3\xc8[&P\x9c\xe7AJz\'\x91\xce=B}v+7n\xa2r0\x92\xc3\x0eE\x96\xf63\xec\xe0\xb2\f\xa86v\xeb\xf1\xcb\xd4\xa9\v\xe1\xcc\x18', 0x80000e)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0)
select$auto(0x7, 0x0, &(0x7f0000000080)={[0x8, 0xc0b, 0x3, 0x16, 0x1001, 0xffffffffffffffff, 0xf, 0x9, 0xb, 0x1, 0x7ff, 0x2e3, 0x5, 0x0, 0x1, 0x7fffffff]}, 0x0, 0x0)
executing program 1:
r0 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000003140), 0xffffffffffffffff)
sendmsg$auto_ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000003200)={0x0, 0x0, &(0x7f00000031c0)={&(0x7f00000011c0)=ANY=[@ANYRESHEX=r0, @ANYBLOB="000bdef06fdddd8d98aba467514127d3f412557e80f1eb993a886ef5cf5c0fd222f076eb55d53f12ec0100553f8d569f6b9598fae51ee3f0966f06866d2b27dbb380f64d80f9ae9f84717ed9fb497206dffdef0cc0b2310d45e3361d43dc3871cfdb7405678883bb0de31aea0b13e7bff43325b874511790e55f480edd7eaec6a153a2ff56c044322d4692f958439c90b8122393bee7bced39d8ad74e962007c18b2836f5b819d2a462571081cdab6d5798b507fff3de7541b39086c1d82ac821f0f2e8e2554f52dffe40df48a8a455d527febdc26d357a0b45cf55b93e42385f21b06991a3988990b381f85de8d523f72cd882342517b609dbb72a6836f22a9dce1a91aacda43b6d6b7d900f6074b8c48611d40a299e306e8b44fab73b006861e95ed7619c1cde9c60d9e1dd4f6df66ff7b141ca894da115925370970ee8a5e0174388c2c0b7594c8e7ee26f01c2fe7793d3a1637dc300c7b0b4b777cdb460515ec0fd9ba64871b5bb1a2f7f059b877ef68a3a578efbc2e706a25c2ff8d112cd08d7a338fc0c96b05dd18df733e7846dd0def547290dd50d695f32a9d7b1be96207b16236e150b5b21065221eaefd79c4b935f9bc363eef68e0ca3c28d8fec26ccca7a4269a"], 0x14}}, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
unshare$auto(0x40000080)
r1 = open(&(0x7f0000000800)='./file0\x00', 0xe4201, 0x17c)
fcntl$auto(r1, 0x400, 0x1)
unshare$auto(0x40000080)
mmap$auto(0x0, 0x202000f, 0x2000000000000000, 0x80000000000eb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x40009, 0x7, 0x9b72, 0x7, 0x28000)
socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0)
prctl$auto_PR_SET_MDWE(0x41, 0x5, 0x0, 0x4, 0x1)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
read$auto_proc_environ_operations_base(0xffffffffffffffff, &(0x7f0000000240)=""/80, 0x50)
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
r2 = mq_open$auto(0x0, 0x5, 0x3, 0x0)
sendto$auto(0x3, 0x0, 0x2000f, 0x0, 0x0, 0x1c)
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0)
sendmsg$auto_NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000005}, 0x8000800)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
r3 = openat$auto_ftrace_system_enable_fops_trace_events(0xffffffffffffff9c, &(0x7f0000001580)='/sys/kernel/debug/tracing/events/vmalloc/enable\x00', 0x204, 0x0)
read$auto(r3, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00'})
connect$auto(0xffffffffffffffff, &(0x7f00000000c0)=@in={0x2, 0x4e24, @multicast1}, 0x55)
socket(0x11, 0x3, 0x2)
mmap$auto(0x0, 0x9, 0xa861, 0x8000000008012, 0x1000000004, 0x0)
openat$auto_adf_hb_cfg_fops_adf_heartbeat_dbgfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy5/netdev:wlan1/rc_rateidx_mask_2ghz\x00', 0x200200, 0x0)
syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff)
executing program 3:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/netdevsim2/new_port\x00', 0x183841, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
r0 = open(&(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', 0x101840, 0x33903f3ada88772b)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x0)
getcwd$auto(0x0, 0xffffffffffffffff)
read$auto(r0, 0x0, 0x1)
write$auto(0x3, 0x0, 0x5c8)
executing program 2:
openat$auto_generic(0xffffffffffffff9c, &(0x7f0000000000)='/proc/kpagecount\x00', 0x0, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
sendmsg$auto_MAC802154_HWSIM_CMD_NEW_EDGE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x400c091)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x1000}, 0x100000007)
readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x1000}, 0x100000007)
executing program 3:
r0 = openat$auto_snapshot_fops_user(0xffffffffffffff9c, 0x0, 0x180b01, 0x0)
mmap$auto(0x0, 0x400008, 0x3, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x1, 0x0)
ioctl$auto(r1, 0x5408, r1)
write$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000240)="1c520b214b197e", 0x7)
unshare$auto(0x40000080)
socket(0xa, 0x1, 0x84)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0xd4, 0x8000)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
r2 = socket(0xa, 0x1, 0x84)
getsockopt$auto(r2, 0x0, 0x34, 0x0, 0x0)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0)
openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sg0\x00', 0x8081, 0x0)
close_range$auto(0x2, 0x8, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
fadvise64$auto_POSIX_FADV_SEQUENTIAL(r0, 0x40, 0x3, 0x2)
r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/net/igmp\x00', 0x100, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x40102, 0x0)
pread64$auto(r3, 0x0, 0x40000000f42c, 0x585)
mmap$auto(0x0, 0x20004, 0x1ff, 0xeb1, 0x8000000000000024, 0x8000)
executing program 1:
mprotect$auto(0x6b14, 0x4, 0xffffffffffff5451)
r0 = openat$auto_snapshot_fops_user(0xffffffffffffff9c, &(0x7f0000000000), 0x180b01, 0x0)
mmap$auto(0x0, 0x400007, 0xdf, 0x9b74, r0, 0x8000)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
bind$auto(0xffffffffffffffff, 0x0, 0x0)
mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2)
write$auto(0x3, 0x0, 0xfffffdef)
mmap$auto(0x7, 0x1000, 0x6, 0xffffffffffffffff, 0x7, 0x28001)
ioctl$auto_MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, 0x0)
ioctl$auto_MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, &(0x7f0000000100)={0x0, 0x2000004, 0x7})
openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bus/usb/010/001\x00', 0x20000, 0x0)
open(0x0, 0x161342, 0x100)
rseq$auto(0x0, 0x7ffd, 0xfffffff4, 0x8)
msync$auto(0x1ffff000, 0x180000000000000, 0x400000004)
r1 = socket(0x23, 0x2, 0x0)
getsockname$auto(r1, &(0x7f00000001c0), &(0x7f0000000040)=0xcf)
open(0x0, 0xeca200, 0x6b)
write$auto(0x3, 0x0, 0x100082)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x20342, 0x0)
mmap$auto(0x0, 0x853, 0x2000000000000002, 0xeb1, 0xffffffffffffffff, 0x8000)
write$auto(0x3, 0x0, 0xfdef)
r2 = open(0x0, 0x161342, 0x100)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, r2, 0x8000)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
mmap$auto(0x4, 0x1, 0x9, 0x9b72, 0x2, 0x8000)
bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0x1, 0xb5, 0x8, 0x5, 0x5, 0xffffffffffffffff, 0xa, "2af051b26b658a20d8dc6b36c83ce63f", 0x0, 0xffffffffffffffff, 0x5, 0x7, 0x7, 0x6}, 0x11)
sysfs$auto(0xfffffff4, 0x100, 0xcb5f)
mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000)
sysfs$auto(0x2, 0x27, 0x0)
fsopen$auto(0x0, 0x1)
executing program 2:
mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/block/nullb0/integrity/read_verify\x00', 0x102, 0x0)
r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/neigh/veth1_to_team/delay_first_probe_time\x00', 0x40b00, 0x0)
read$auto(r1, 0x0, 0x3)
write$auto(r0, 0x0, 0xfdec)
executing program 2:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0)
r0 = openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f00000011c0), 0xa2741, 0x0)
write$auto_snd_seq_f_ops_seq_clientmgr(r0, &(0x7f0000000100)="632d7efe595046ab5c98199adf260600de16baef6176e6021e1dcedc5b00e8fdd880fee6fb9ca2ac324280530000000000000000e0ffffff10", 0x39)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
write$auto(0x3, 0x0, 0x8)
write$auto(0x1, 0x0, 0x80000000)
openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x6, 0x8, 0x5)
r1 = socket(0x2b, 0x1, 0x1)
r2 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000080), 0x80080, 0x0)
ioctl$auto_PPPIOCSMRU(r2, 0xc004743e, 0x0)
mmap$auto(0x0, 0x2, 0x9, 0xeb1, 0xfffffffffffffffa, 0x4)
sendmsg$auto_NFC_CMD_DEP_LINK_DOWN(r1, 0x0, 0x20000001)
sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000000)
mmap$auto(0x0, 0x4, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000)
r3 = socket(0x1d, 0x2, 0x6)
r4 = socket(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r5=>0x0})
bind$auto(r3, &(0x7f0000000040)=@can={0x1d, r5, 0xfd}, 0x6a)
sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x6c}, 0x1, 0x0, 0x0, 0x40084}, 0x40)
io_uring_setup$auto(0x6, 0x0)
close_range$auto(0x2, 0x8, 0x0)
write$auto(r2, &(0x7f00000000c0)='}]{\\*\x00', 0x2)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'gretap0\x00'})
sendmsg$auto_NL80211_CMD_GET_MPP(0xffffffffffffffff, 0x0, 0x10)
syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
munmap$auto(0xfffffffffffffffe, 0x9d6)
executing program 0:
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/net/bond0/queues/tx-9/xps_rxqs\x00', 0x1a1842, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = io_uring_setup$auto(0x6, 0x0)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/ram9/diskseq\x00', 0x20000, 0x0)
read$auto(r2, 0x0, 0x20)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x3}, 0x3)
ioctl$auto_USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0)
pwritev$auto(0x3, &(0x7f0000001000)={0x0, 0x8}, 0x5, 0x3, 0x9)
executing program 0:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x15, 0x5, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$auto_ovs_vport(0xfffffffffffffffe, 0xffffffffffffffff)
syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff)
mmap$auto(0x80000001, 0x580f, 0x112f4a03, 0x8000000008011, 0x3, 0x3)
openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xe0002, 0x0)
shmctl$auto_SHM_LOCK(0x1, 0xb, 0x0)
sendmsg$auto_ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, 0x0, 0x4000080)
close_range$auto(0x2, 0xa, 0x0)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x8002, 0x0)
r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0)
read$auto(r1, 0x0, 0xb4d3)
write$auto(r0, 0x0, 0x7ff)
write$auto(0x3, 0x0, 0xffd8)
syz_genetlink_get_family_id$auto_ioam6(0x0, r0)
executing program 3:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0x2, 0x1, 0x0)
io_uring_setup$auto(0x1, 0x0)
socketpair$auto(0x1, 0x0, 0xfffffffc, 0x0)
r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0xc7f16bff2a10ba01, 0x0)
ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0)
close_range$auto(0x2, 0x8, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
close_range$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fb0\x00', 0x800, 0x0)
io_uring_setup$auto(0xd364, &(0x7f0000000000)={0x400, 0x10002, 0x7f, 0x7, 0x6, 0x5, r1, [], {0x2, 0x4, 0x6, 0x2, 0x400, 0x4, 0x7, 0x5, 0x80000000}, {0x7, 0xd, 0x6e68, 0x8, 0x6b, 0x9, 0x0, 0xfffffffa, 0xb1}})
socket(0x10, 0x80002, 0x0)
close_range$auto(0x2, 0x8000, 0x0)
io_uring_setup$auto(0x6, 0x0)
timerfd_create$auto(0x9, 0x0)
preadv2$auto(0x3, &(0x7f0000001000)={0x0, 0x9}, 0x5, 0xffffffffffffffff, 0x7, 0x2e)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0)
executing program 1:
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
r0 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x20342, 0x0)
ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, 0x0)
write$auto(0x3, 0x0, 0x100082)
ioctl$auto_SNDCTL_DSP_SYNC(r0, 0x5001, 0xfffffffffffffffc)
sendmmsg$auto(0x3, 0x0, 0x3, 0x0)
executing program 0:
mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0)
mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000)
write$auto(0x3, 0x0, 0x7fffffff)
write$auto(0x1, 0x0, 0x80000000)
openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x6, 0x8, 0x5)
openat$auto_nsim_dev_max_vfs_fops_dev(0xffffffffffffff9c, &(0x7f00000089c0)='/sys/kernel/debug/netdevsim/netdevsim1/max_vfs\x00', 0x101000, 0x0)
mmap$auto(0x0, 0xfffffffffffffffd, 0xdf, 0x10, 0x2, 0x8000)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket(0x3, 0x80000, 0x6)
r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
mmap$auto(0x6, 0x400008, 0xe2, 0x9b72, r0, 0x8000)
close_range$auto(0x2, 0xa, 0x0)
r3 = socket(0xa, 0x3, 0x101)
socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
read$auto_minstrel_ht_stat_fops_rc80211_minstrel_ht_debugfs(r2, &(0x7f0000000440)=""/139, 0x8b)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r0, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2021082}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x19c, 0x0, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@HWSIM_ATTR_USE_CHANCTX={0x4}, @HWSIM_ATTR_CIPHER_SUPPORT={0x96, 0x18, "aff33d2b70176fd46e7f04ea5482be3bb170287df35e836094b63511396d24a0f09a3cc0e3383a01b6ca6036b21c227276b69494a8487745008995b41e8970fe591c27a927a08f9c9e508fd2ce993b319e4b58fa623d713b5ce8449e34c5ef3bd19e005d84af39cc331bbc838cc20928c2b504125be7f53dcaa0d0bf0d3f8d1f44008999394c391e938da859da238e3c39e6"}, @HWSIM_ATTR_SIGNAL={0x8}, @HWSIM_ATTR_PMSR_SUPPORT={0xc8, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_TYPE_CAPA={0xc4, 0x4, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT={0x5, 0x7, 0x7b}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT={0x5}, @NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST={0x5, 0x8, 0x5}, @NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0x8d}, @NL80211_PMSR_FTM_CAPA_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS={0x8, 0x6, 0xffff}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT={0x5, 0x7, 0x10}, @NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0xfffffffc}, @NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST={0x5, 0x8, 0x3}, @NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS={0x8}, @NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0xc}]}]}]}, @HWSIM_ATTR_IFTYPE_SUPPORT={0x8, 0x17, 0x7}, @HWSIM_ATTR_TX_INFO={0x6, 0x7, [{0x8, 0x80}]}, @HWSIM_ATTR_PMSR_SUPPORT={0xc, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_REPORT_AP_TSF={0x4}, @NL80211_PMSR_ATTR_REPORT_AP_TSF={0x4}]}]}, 0x19c}, 0x1, 0x0, 0x0, 0x804}, 0x0)
write$auto(0xffffffffffffffff, &(0x7f0000000000)='9\x00d1L\xff\x15\xba\xa17=(\xc1\xf8\xff\xff\v\xb5^\xa1/[', 0x8)
read$auto(0x3, 0x0, 0xf34)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bond0\x00', <r5=>0x0})
bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_ifindex=r5, r4, 0x4, 0x1ff, r3, @relative_id=0x13, 0xe600}, 0xf)
executing program 3:
unshare$auto(0x40000080)
mmap$auto(0x0, 0x3, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000)
socket(0xa, 0x1, 0x100)
mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000)
r0 = socket(0x15, 0x5, 0x0)
getsockopt$auto(r0, 0x114, 0x2713, 0xfffffffffffffffc, 0x0)
setsockopt$auto(0x400000000000003, 0x29, 0x1b, 0x0, 0x56b)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x20b42, 0x0)
syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap$auto(0x0, 0x400008, 0xde, 0x9b72, 0x0, 0x100000000008000)
r1 = socket(0x2, 0x1, 0x106)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x26}}, 0x54)
shutdown$auto(r1, 0x0)
openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x60742, 0x0)
shutdown$auto(0x200000003, 0x2)
mmap$auto(0x200000000000000, 0x400006, 0xdf, 0x12, 0x2, 0x8001)
madvise$auto(0x0, 0xffffffffffff0002, 0x19)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2)
write$auto(0x3, 0x0, 0x7fffffff)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/pci0000:00/waiting_for_supplier\x00', 0x80800, 0x0)
openat$auto_tracing_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/trace\x00', 0x20600, 0x0)
unshare$auto(0x40000080)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
ioctl$auto(0xffffffffffffffff, 0x64ce, 0xffffffffffffd4b4)
syz_clone(0x40011, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000000200), 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mremap$auto(0x4000, 0xfee0, 0x3fd6, 0x3, 0x18000)
executing program 1:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x26}}, 0x71)
sendmmsg$auto(r0, 0x0, 0x9, 0x20000000)
r1 = io_uring_setup$auto(0x1, 0x0)
socket(0x1f, 0x2, 0x200000)
syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000080), 0xffffffffffffffff)
socket(0x10, 0x2, 0xf)
sendmsg$auto_NL80211_CMD_PEER_MEASUREMENT_START(r1, 0x0, 0xc0d1)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
socketpair$auto(0x1, 0x0, 0xfffffffc, 0x0)
r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0xc7f16bff2a10ba01, 0x0)
ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0)
socketpair$auto(0x4, 0x1, 0x20000, 0x0)
ioctl$auto_TIOCSETD2(0xffffffffffffffff, 0x5423, 0x0)
ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0)
socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0)
setsockopt$auto(r2, 0x1, 0x3e, 0x0, 0x9)
write$auto(0x3, 0x0, 0xfffffdef)
unshare$auto(0x40000080)
sendmmsg$auto(0xffffffffffffffff, 0x0, 0x3b87, 0xa)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
memfd_create$auto(&(0x7f00000000c0)=')-(&\x00', 0x5)
madvise$auto(0x0, 0x7fffffffffffffff, 0xa)
openat$dir(0xffffffffffffff9c, 0x0, 0x200000, 0x6)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/system/node/node1/compact\x00', 0xc2481, 0x0)
writev$auto(r3, &(0x7f0000000080)={&(0x7f0000000040), 0x1000}, 0x3)
ioctl$auto_RNDADDENTROPY2(r1, 0x40085203, &(0x7f0000000080)=[0x3, 0x4010])
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/v4l-subdev3\x00', 0x16b000, 0x0)
executing program 2:
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
read$auto_proc_pid_cmdline_ops_base(0xffffffffffffffff, 0x0, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mremap$auto(0x4000, 0xfee0, 0x9, 0x3, 0xfffff000)
mmap$auto(0x100000000, 0x8, 0xe2, 0x9b72, r0, 0x8000)
executing program 0:
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0)
openat$auto_ftrace_enable_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/tracing/events/vmalloc/alloc_vmap_area/enable\x00', 0x200000, 0x0)
openat$auto_proc_gid_map_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/gid_map\x00', 0x8000, 0x0)
r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/midi2\x00', 0x2, 0x0)
mmap$auto(0x0, 0x2000a, 0x10000000000df, 0xeb2, 0x401, 0x8000)
openat$auto_snd_pcm_f_ops_pcm1(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snd/pcmC0D0c\x00', 0x0, 0x0)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
r2 = openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x0, 0x0)
read$auto(r2, 0x0, 0x1f40)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x800000879}, 0x4)
write$auto(r0, &(0x7f00000000c0)='/dev/dsp\x00', 0x5)
close_range$auto(0x0, r1, 0x0)
executing program 0:
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000500)='/sys/devices/virtual/block/ram12/queue/read_ahead_kb\x00', 0x80000, 0x0)
read$auto(r0, 0x0, 0x20)
r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0)
writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x3)
mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000)
socket(0xa, 0x801, 0x84)
iopl$auto(0x2)
mknod$auto(&(0x7f0000000180)=':,\x00', 0xcb, 0xfffffffa)
execve$auto(&(0x7f0000000000)=':,\x00', 0x0, 0x0)
mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000)
symlinkat$auto(&(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00')
socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/cec18\x00', 0x900, 0x0)
ioctl$auto_CEC_S_MODE(r1, 0x40046109, &(0x7f0000002c40)=0xd0)
ioctl$auto_CEC_DQEVENT(r1, 0xc0506107, 0x0)
ioctl$auto_CEC_DQEVENT(r1, 0xc0506107, &(0x7f0000000280)={0x4, 0x3, 0xa, @state_change={0xc, 0x6, 0x8}})
r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio1\x00', 0x80502, 0x0)
ioctl$auto_SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000000c0))
prctl$auto_PR_GET_SPECULATION_CTRL(0x34, 0x10, 0xffffffffffffffff, 0x8000, 0x8acb)
write$auto(0xffffffffffffffff, 0x0, 0x7)
r3 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/controlC1\x00', 0x20400, 0x0)
ioctl$auto_SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f00000012c0)={{@raw=0x9, 0x1, 0x6d2e99e8, 0x6, "0582a820061b5c51a65a6dd72b0b15addbdf55cb4b0f2381f2673e3a1ebe21e1bf1b26f0db7b62b67bd764f9"}, 0x0, @bytes=@data_ptr=&(0x7f00000000c0)='\x9e*:-$$\x00', "528d458095d42b72adda0cac2d45bdaacfc82245992af763188ba00ab57d5d73b094925aa928ca41e93023ab4510269ed959a79a7895fd181a33375018fc08050559d8936b8d72087a5689d4338da78b8b8bdcea81f7e333cf1c9da590b3fea1258074885c899d75cd52751f9be959d90fa5c200"})
openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x80102, 0x0)
openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000140), 0x1a3780, 0x0)
r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
r5 = socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
openat$auto_tap_fops_tap(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0x6, 0x1, 0x948b, 0x3, 0x1, 0x3, 0x80000000, 0x5f, 0x80000001, 0x7, 0x6d3f, 0x7, 0x2, 0xfffffffffffffffe]}, 0x0)
write$auto(r4, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9)
select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x201, 0x3, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x1000000003, 0x9, 0x62, 0x8000001f, 0x7, 0x6d3e, 0x9, 0x2, 0x200]}, 0x0)
sendmsg$auto_NL80211_CMD_GET_REG(r5, 0x0, 0x814)
madvise$auto(0x0, 0xffffffffffff0001, 0x15)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$auto_ETHTOOL_MSG_RSS_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="010329bd700002dcdf2524"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40044010)
r7 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$auto_HWSIM_CMD_NEW_RADIO(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="01002bbd7000fddbdf3a04000000050011002e"], 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x4044820)
executing program 1:
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
rseq$auto(0x0, 0x8000, 0x0, 0x6)
mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = socket(0x2b, 0x1, 0x0)
bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @loopback}, 0x6a)
sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x0, 0x0, 0x1f, 0xb}, 0x800009}, 0x3, 0x20000000)
sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000)
write$auto(r0, 0x0, 0xfffffde9)
recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd)
write$auto(0xffffffffffffffff, 0x0, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x2, 0x2)
madvise$auto(0x0, 0xffffffff97fb20a5, 0x10002)
openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000080)='/dev/usbmon2\x00', 0x40080, 0x0)
openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cuse\x00', 0x1c1041, 0x0)
r1 = openat$auto_mISDN_fops_timerdev(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card1\x00', 0x129a00, 0x0)
read$auto_mISDN_fops_timerdev(r1, &(0x7f0000001a00)=""/4097, 0x1001)
ioctl$auto_IMADDTIMER(r1, 0x80044940, 0x0)
prctl$auto_PR_SCHED_CORE_SHARE_FROM(0x8, 0x3, 0x0, 0x0, 0x2)
socket(0x3, 0x3, 0x0)
r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
select$auto(0xe, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0xd, 0x8fd6, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x80000001, 0x7, 0x1, 0x9, 0x1, 0xfffffffffffffffe]}, 0x0)
write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9)
openat$auto_sg_fops_sg(0xffffffffffffff9c, 0x0, 0x40200, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/set_event_notrace_pid\x00', 0x100242, 0x0)
openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000004400)='/dev/dsp1\x00', 0x1, 0x0)
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r2 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r2, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r2, 0x5501, 0x0)
r3 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r3, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r3)
unshare$auto(0x40000080)
r4 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r4, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r6 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r6, 0xaf01, 0x0)
read$auto(r5, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)
ioctl$auto_KVM_CHECK_EXTENSION(r1, 0xae03, 0xea)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto-ioctl$auto_KVM_CHECK_EXTENSION
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r2 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r2, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r2, 0x5501, 0x0)
r3 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r3, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r3)
unshare$auto(0x40000080)
r4 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r4, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r6 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r6, 0xaf01, 0x0)
read$auto(r5, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)
ioctl$auto_KVM_CHECK_EXTENSION(r1, 0xae03, 0xea)

program crashed: KASAN: slab-use-after-free Write in ring_buffer_subbuf_order_set
single: successfully extracted reproducer
found reproducer with 28 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r5 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r5, 0xaf01, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r5 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r5, 0xaf01, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r5 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r5, 0xaf01, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-close_range$auto-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r5 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r5, 0xaf01, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-read$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r5 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r5, 0xaf01, 0x0)
read$auto(r4, 0x0, 0x20)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-ioctl$auto_VHOST_SET_OWNER-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
r4 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
ioctl$auto_VHOST_SET_OWNER(r4, 0xaf01, 0x0)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(0xffffffffffffffff, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto_tracing_buffers_fops_trace-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-msync$auto-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
msync$auto(0x7, 0x4, 0x4)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r3, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: kernel BUG in ___free_pages
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-unshare$auto-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
unshare$auto(0x40000080)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, 0xffffffffffffffff, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r3, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-dup$auto-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
dup$auto(r2)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: KASAN: slab-use-after-free Write in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
r2 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
read$auto_proc_single_file_operations_base(r2, &(0x7f0000000040)=""/228, 0xe4)
r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r3, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r4, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: kernel BUG in ___free_pages
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-openat$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/personality\x00', 0x2, 0x0)
r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r2, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r3, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-ioctl$auto_UI_DEV_CREATE-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
ioctl$auto_UI_DEV_CREATE(r1, 0x5501, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r2, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r3, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-ioctl$auto_UI_DEV_SETUP-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
ioctl$auto_UI_DEV_SETUP(r1, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x9, 0x80}, "6a034a07c7b8edb8fc3b39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x6})
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r2, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r3, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-openat$auto_uinput_fops_uinput-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x20282, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r1 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r1, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r2, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r1 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r1, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r2, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-ioctl$auto_PAGEMAP_SCAN-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x1, 0x85, 0x7fffffffefff, 0x0, 0x1, 0x6, 0xfffffffffffffffb, 0x0, 0x8, 0x0, 0x9})
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r1 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r1, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r2, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_proc_pagemap_operations_internal-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-ioctl$auto_KVM_CREATE_VM-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-unshare$auto-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
unshare$auto(0x40000080)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/erspan0/queues/tx-0/byte_queue_limits/hold_time\x00', 0x2, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: KASAN: slab-use-after-free Read in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-socket$nl_generic-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close_range$auto-openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
close_range$auto(0x2, 0x8, 0x0)
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f000000fc00), 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, &(0x7f0000000040)=""/228, 0xe4)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000002c0), 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, 0x0, 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, 0x0, 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/tracing/buffer_subbuf_size_kb\x00', 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
detailed listing:
executing program 0:
openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x3, 0x0)
read$auto_proc_single_file_operations_base(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0)
mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r0, 0x0)
mmap$auto(0x0, 0x88b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000)
r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/loop14/queue/dma_alignment\x00', 0x80000, 0x0)
openat$auto_vhost_net_fops_net(0xffffffffffffff9c, 0x0, 0x50b602, 0x0)
read$auto(r1, 0x0, 0x20)
close_range$auto(0x2, 0x8, 0x0)
openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vbi21\x00', 0x149800, 0x0)
openat$auto_buffer_subbuf_size_fops_trace(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write$auto(0x3, 0x0, 0xfdef)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_kvm_chardev_ops_kvm_main-read$auto_proc_single_file_operations_base-openat$auto_tracing_buffers_fops_trace-mmap$auto_tracing_buffers_fops_trace-mmap$auto-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_vhost_net_fops_net-read$auto-close_range$auto-openat$auto_v4l2_fops_v4l2_dev-openat$auto_buffer_subbuf_size_fops_trace-write$auto
program crashed: BUG: corrupted list in ring_buffer_subbuf_order_set
reproducing took 1h36m49.799681348s
repro crashed as (corrupted=false):
 slab kmalloc-1k start ffff88801b488800 pointer offset 576 size 1024
list_del corruption. prev->next should be ffff88802a7d3180, but was ffff88801b488a40. (prev=ffff88801b488a40)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:62!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5851 Comm: syz-executor420 Not tainted 6.15.0-syzkaller-10820-gcd2e103d57e5 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__list_del_entry_valid_or_report+0x17a/0x200 lib/list_debug.c:62
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 40 33 f5 8b e8 f7 0d be fc 90 <0f> 0b 4c 89 e7 e8 1c aa 21 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000436fb70 EFLAGS: 00010286
RAX: 000000000000006d RBX: ffff88802a7d3180 RCX: ffffffff819a75b9
RDX: 0000000000000000 RSI: ffffffff819af446 RDI: 0000000000000005
RBP: ffff88801b488a40 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffff88802a7d3e00
R13: ffff88802a7d3180 R14: ffff88802a7d3e00 R15: 0000000000000001
FS:  0000555580420380(0000) GS:ffff888124a75000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e1bcb9130 CR3: 0000000075590000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del_init include/linux/list.h:287 [inline]
 ring_buffer_subbuf_order_set+0x92e/0x18f0 kernel/trace/ring_buffer.c:6921
 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:9546
 vfs_write+0x2a0/0x1150 fs/read_write.c:684
 ksys_write+0x12a/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1e1bc3eca9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe8f63c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1e1bc3eca9
RDX: 000000000000fdef RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0
R10: 00000000000000a0 R11: 0000000000000246 R12: 00000000000175b3
R13: 00007fffe8f63c5c R14: 00007fffe8f63c70 R15: 00007fffe8f63c60
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x17a/0x200 lib/list_debug.c:62
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 40 33 f5 8b e8 f7 0d be fc 90 <0f> 0b 4c 89 e7 e8 1c aa 21 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000436fb70 EFLAGS: 00010286
RAX: 000000000000006d RBX: ffff88802a7d3180 RCX: ffffffff819a75b9
RDX: 0000000000000000 RSI: ffffffff819af446 RDI: 0000000000000005
RBP: ffff88801b488a40 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffff88802a7d3e00
R13: ffff88802a7d3180 R14: ffff88802a7d3e00 R15: 0000000000000001
FS:  0000555580420380(0000) GS:ffff888124a75000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e1bcb60d0 CR3: 0000000075590000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
 slab kmalloc-1k start ffff88801b488800 pointer offset 576 size 1024
list_del corruption. prev->next should be ffff88802a7d3180, but was ffff88801b488a40. (prev=ffff88801b488a40)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:62!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5851 Comm: syz-executor420 Not tainted 6.15.0-syzkaller-10820-gcd2e103d57e5 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__list_del_entry_valid_or_report+0x17a/0x200 lib/list_debug.c:62
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 40 33 f5 8b e8 f7 0d be fc 90 <0f> 0b 4c 89 e7 e8 1c aa 21 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000436fb70 EFLAGS: 00010286
RAX: 000000000000006d RBX: ffff88802a7d3180 RCX: ffffffff819a75b9
RDX: 0000000000000000 RSI: ffffffff819af446 RDI: 0000000000000005
RBP: ffff88801b488a40 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffff88802a7d3e00
R13: ffff88802a7d3180 R14: ffff88802a7d3e00 R15: 0000000000000001
FS:  0000555580420380(0000) GS:ffff888124a75000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e1bcb9130 CR3: 0000000075590000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del_init include/linux/list.h:287 [inline]
 ring_buffer_subbuf_order_set+0x92e/0x18f0 kernel/trace/ring_buffer.c:6921
 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:9546
 vfs_write+0x2a0/0x1150 fs/read_write.c:684
 ksys_write+0x12a/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1e1bc3eca9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe8f63c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1e1bc3eca9
RDX: 000000000000fdef RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0
R10: 00000000000000a0 R11: 0000000000000246 R12: 00000000000175b3
R13: 00007fffe8f63c5c R14: 00007fffe8f63c70 R15: 00007fffe8f63c60
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x17a/0x200 lib/list_debug.c:62
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 40 33 f5 8b e8 f7 0d be fc 90 <0f> 0b 4c 89 e7 e8 1c aa 21 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000436fb70 EFLAGS: 00010286
RAX: 000000000000006d RBX: ffff88802a7d3180 RCX: ffffffff819a75b9
RDX: 0000000000000000 RSI: ffffffff819af446 RDI: 0000000000000005
RBP: ffff88801b488a40 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffff88802a7d3e00
R13: ffff88802a7d3180 R14: ffff88802a7d3e00 R15: 0000000000000001
FS:  0000555580420380(0000) GS:ffff888124a75000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e1bcb60d0 CR3: 0000000075590000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400