Extracting prog: 3m29.796841541s Minimizing prog: 30m57.051290998s Simplifying prog options: 0s Extracting C: 54.214623991s Simplifying C: 9m0.747504643s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat-ioctl$UFFDIO_REGISTER-open-setxattr$system_posix_acl detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) open(0x0, 0x60840, 0x0) setxattr$system_posix_acl(&(0x7f0000000080)='./tracefs/events/mygroup/myevent/enable\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', 0x0, 0x0, 0x2) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 9, 6, 7, 2, 7, 5, 3, 15, 6, 16, 19, 4, 7, 2, 5, 6, 3, 5, 5, 15, 20, 5, 4, 3, 16, 6, 9, 10, 3] detailed listing: executing program 4: io_uring_enter(0xffffffffffffffff, 0x32, 0x558a, 0x98a82480aebc2932, &(0x7f0000000580)={[0x5]}, 0x8) r0 = dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f00000003c0)=0xffffffffffffff71) ioctl$int_in(r4, 0x5452, &(0x7f0000000440)=0x10001) write(r2, 0x0, 0x0) sendto$unix(r0, 0x0, 0x0, 0x200000c0, 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000390000/0x1000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) executing program 4: inotify_init1(0x800) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x0, 0x0}, 0x6) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000300)=r0, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r1, 0x20, &(0x7f00000007c0)={&(0x7f0000000800)=""/243, 0xfffffffffffffdb4, 0x0, 0x0}}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1d, 0x4, 0x3, 0x0, 0x1, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x58}, 0x10) r3 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) io_uring_enter(r3, 0x12a, 0xffdfffdc, 0x17, 0x0, 0x0) executing program 2: r0 = socket(0x1, 0x5, 0x0) close(r0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x1, 0x80, 0x2}]}) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0xe000200c}) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x20100, 0x0) pipe2$9p(0x0, 0x84800) syz_emit_ethernet(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x20000400) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r1, 0x4068aea3, &(0x7f0000000000)={0xdf, 0x0, 0x148000}) executing program 1: open(&(0x7f00000000c0)='./file1\x00', 0x14d142, 0x82) mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x800, 0x103) executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) mq_unlink(&(0x7f0000000280)='bat\x13\x1b\r\xcbs\xecave_5\x00') executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) pipe(&(0x7f0000000380)) io_setup(0x3ff, &(0x7f0000001440)=0x0) io_submit(r1, 0x1, &(0x7f0000001480)=[&(0x7f0000001500)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000001540)='m', 0x1}]) write(r0, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = semget$private(0x0, 0x6, 0x0) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000001500)=""/4096) executing program 0: r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000007, 0x204031, 0xffffffffffffffff, 0x94c1e000) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_mount_image$erofs(&(0x7f0000001680), &(0x7f0000001740)='./file0\x00', 0x81, &(0x7f0000001780)=ANY=[@ANYRES8=0x0], 0x1, 0x1d9, &(0x7f00000017c0)="$eJzslb+O00AQxr+14wQjTqGF5pCIdEeB/wUQV1CcKClAAoHoLuJ8kcEhKHGRpApPQU0JFNQRTd4DCqCiIHQUCAmjXa/jTXASGRIpEvMr1p93JrOzk90xCIL4b/n86fvHt3s1k+szqKGyk8x/0TMfTfEfVX9eeh/cfvfC+fZhNL51MBeuXHT9EoDx4aud9D2O493Xir0mn/egpdrAUWZ/AAZL6iNouC+1D4aHUj9WdJv7W9ZJEPrWo3Z4zIXDB5cPHh/q8/lNnjMcZ/nFTLF3+4MnjTD0OzPCkNYc02Jxk6edzGhgSuTl9aticqjhhpKf+n+J2pyabkXgQoMrdR0Md6W+jkpam6Qkyv7Pl9IwgL5y/1ss0uRzTGy4iUXPVVf4GNiCsqxPBBuIbGadZcakF71jxYS86MNCv2LiaH01eapLDtu/iPTybWDLb0xgPQGz/hm/ZNhT+lNJ6R921Hpmd/uDy0Gr0fSb/lPPq19zrjjOVc8+CRgcW7SjJf3PFP3ptBLfWOBbZmX0GlHUcZNx+u71Kog6Xk7H/WGI/qdh/2KSNcv5yIljcpZd4I99HfgVJyxMmiAIgiAIgiAIgiAIgiAI4q/YBUM8z8EfU94d4f07AAD//wMLWAY=") getxattr(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001680), 0x318, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f00000016c0)={0x90000005}) epoll_pwait(r1, &(0x7f0000001700), 0x0, 0xfffeffff, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001340)=@bpf_ext={0x1c, 0x0, 0x0, &(0x7f0000001100)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001200)={0x6, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x12603, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffff7}, 0x94) executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40042, 0x1) close(r0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(r1, &(0x7f0000000180)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r1, &(0x7f00000021c0)={0x90, 0x0, r2, {0x20000000000007, 0x4, 0x9, 0xe, 0x8001, 0x7, {0x1, 0x0, 0x1, 0x7, 0xe, 0x4, 0x4008000, 0x9, 0x7fd, 0x6000, 0x5, r3, r4, 0x0, 0x1001}}}, 0x90) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x10000, &(0x7f0000002380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f00000002c0)={&(0x7f0000000380)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000400)="dc", 0x1}], 0x1}, 0x48043) r3 = dup(r1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000440)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000480)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0xad}}, 0x7, 0x1, 0x457, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000540)=0x3, 0x4) pipe2$9p(0x0, 0x0) write$9p(0xffffffffffffffff, &(0x7f00000005c0)="2d76b41cfadba8c9e82b39a58fade4a1e1c7ef34f18f9ee7ea705a387831c57c3f007c87ff6a6d56a0412772be538a3a9da7d06107b64274af1202839475620c45529c8e1e684c2118de638371951ba4ff979185630a5fad24e8eac0e002159a4516f523cc596c18dea7d58a7fc7d7c536f144c2a3cd4b3c32712d9df8e06635edabc3756f4574734399c629e21514de00ca9cb5db71b1fd95c571fc14e0935bce3b828d3e9544db3e5d6dd7711292bade41db1468879a5ae363c0e350a18c2c1846c9dab94e0c296ad7ba7ddabb3090d84b7e1de1075d427e6da02193277000e89a90b611024684514dfe42ba05afb12275bd2157f049f1e59c6e3e04bdf2af1558978fd730ff32ebc982e3cb15f90d5cc35615b22eb49384b70a36e914a8639cefcf00da4188df83be0f5f20b765610a77efdb569852c0196fca2237eeed0bfac86e58d0ec211962bf22ee18dbbb0f33c591cba0e72e68de6eca4c96f29868bd2080c96f28b8e68c9a62efae50d8bdc9df9cfbf3350f4274da573ed3653f989ffddbb59f3f8c72a6b3bc7f705872d0309445e14781e888d8d1a5fb5de79c5ea573c3b0bdf4de2e4263635aab6732e3339450fceb7698309cc629ec4bff6fde7a01f182dca433a256e101d01ba88a6ff1e14d9dcaf7d8a6bce08534142561578702ded5cc1bae4bbc0d17d783729c78c1851e701cf55ae55cbe40cec2a6e60fc8db862dbebef6b8d224762518e8b2ad8c1f97bd13057d9103c55a806d5c747b4e4c68d39469a9cdc8b6d92ebd0ebc51a32371af555bfa64463122ed3055b244ca4c8ad98b9c8903fc70a3827c622bb1222e8ec47331797d592c7f0837e695e885e8e18ba748b1169318135af97b937a2fad5472590d10a356e7d2da2073cd17bd45669c65618baf849b4d15925da0dc40705ee26ce2b33b85a93651f4d264b723cc23644a94a200673b551690788c9cf637f926ba1da102172c23445cc10278fa28b81c55578e77d87151a8b423c5a5d0bfc3945028e16514837ffab181dd771ab456bde23e6b1c40830967492904622123b7ba477e1843102e0a2bb816cd6ab344135c0660d09842ca96b2e15561c551a4efefb55818da1b9208c6c7a414caf455f9510b1f2ee869bd43353b9dec4dc6cc6a49dbf1ab273a69d76c552d0ea4eb33d983b19ce04cb14473dcf2e006d5b9886de2cad58e6fa06aafa7406f12400ab9bd65f472636446dc104a1e31f4f2abdcfe94ba5cdb35ce9d4efd6ea2de3069ffae2fb4e1ed93616546f39285d4d78ead20bd35b721a51f4ebe84037f699ba4afc82ece8dfb15faa8974e2cb0e2987db498c34b78fc806e3287ec0928e14abc7701684f73032d9c791cd195357ecb579724ac51659a02512faf240ef3bc65a2ac7462d4dc9b8718d103ef5223520e0c60969e3ecac743eee57e664fe687aad5e5d474ae25ac5aa77489b592eafa00ff", 0x411) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x100000000, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) writev(r2, &(0x7f0000000a00)=[{&(0x7f0000000a80)="cd89b0b00d", 0x5}], 0x1) write$binfmt_script(r3, &(0x7f0000000f80)={'#! ', './file0', [], 0xa, "5775ebb77549afc496bc5cc558c52be63e203db628daa190b16cc7216b9bfb1b0bd22d03f5e1cd7a3da150be3434e1d6c83af706cea87fffe560d236a8c26a760289f80eaa398ae77b0d26197822dd25b01733bd602efae482eced2ed31ee6ce67c841c25dfefcd739990462ff3626423e0e3ba7a4d4a86469f8cf3ac3d81d4f63be7d17a6caf4a8b071298bc35fdea671ea0025460ccfed3040fe1945a0d089bba38204ca6631e158a7717cf420623fad22082e3ae1b8e38748772095513a3f5028fb76790ef01caab610421c1ae48ffd68b5aefd4f399b8d28edddd9dde0d8afa1fd2df0d8c6ebbcf9493daea96589ee90969516953c83d70124dc91b26e3287986fdc096eda61a819b88e28facf71a064600e69747ab08f0379afde05c2b558f6058e2ef5c3a36ab3171bd99960ebb980380b7f76f8fce6987cf5eafb1384cefd64e1d214b14cff8f9ae739db32fb1e54d01856a3b277c3f02aeebe7f58f0708f4487afe3674a0a412461a9de083979f9c380a9336893f77c19f740aed24764a0165a52fa2d8152bb55f49fe1c1a52977f9244fdf648ef55acdbaab7827a33e5c66592b97b2b4ccf4d642d75a23a0bf43cb9dd6d4156cc58636f4d68d0370d827d0c6a0b0a3fb818e36d6716a49ec3bac8da32f9a8bd74c499768a4c62822d018ef9f7982ddf15e655670f9cec0162460e4b9a83a5f1cfd99dcb5dfe680039d9b9ee28132545ce12ff1f32c6ecf9181688260da9d4d610567eacf0c399e85c974fc752333c7d0ac1ba8e0213f07884fc77b0ba82aa058e596f04b7d44b409cd4a1fab3b3c0d4217493196f62e2cf9e4d9834e7f966ca42b76100ef5f6fa89700a0b4661056849331fb583b3e9659711ae466c61507319b7d1638ffca5f9130ca7fdb86276ada534473b4d2c21859a825ba6e502d2f912e224f1fdb70a57c42e2185a45edac6e09c1c7446dc889dd8ba711ac687257b35a1b923a960be298b680106299cd3ac4e06cae9352bfdd0427e13ce759b48140df351c8f9ae8fb9acabb9c3346e23433c4875d45ac7836d990cd13d35ac48700e315d7e9b11ca587cb9a764af1fda1bb8c36f15d1d642252e26a5c9d9c33a16dca4584f864467ad20b97ddffc6fcbbaf71716aa07e9f0c99bee7e22fac55dcf54f99af981bd0217b72a4cf46ce46f165d512fd49ff4e3cea29a63e0354177bfe5433b25c3496461b39153b68cbc5af714bde4043909c4679aedd01875badbb6f74cadcf9488769ebe8e173c746225f3decccfed3d295d90b29444b27c2e5a72943eb03d254940a65398e63d78f9b41ef8a17c0c2bd8e9057619ff39dc47105189d0c70a32c535790e68fff9c9a9ef708576c51bcc8868f8a2842b82af5c0466a3cb1fc229e3fd4434e2956d206fc8ca66c8494567db7034e223a4dd1313d3b2399616307fd3ef27acf6732a69cc5f"}, 0x411) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, 0x0, 0x0) listen(r0, 0xfff) ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f0000000200)=""/231) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000880), 0x318, 0x0) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000008c0)) stat(&(0x7f0000000300)='./file0\x00', 0x0) statx(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0x6000, 0x7ff, &(0x7f0000000400)) socket$netlink(0x10, 0x3, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./file2\x00', 0x942, 0x0) pwrite64(r1, 0x0, 0x0, 0x9000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff, 0x6, 0x0, @void}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000680)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000006c0)='syz_tun\x00', 0x10) sendto$inet(r2, 0x0, 0x38, 0x20000800, &(0x7f0000000700)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000740)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000780)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x44, 0x4000, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x10}, {"2c20966cf0c74b3830b97205d3980c0bdd092162f26b000000000000"}}}}}}, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r2, 0x4068aea3, &(0x7f0000000300)) executing program 4: r0 = socket(0x1, 0x5, 0x0) close(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000640)='./dev/tap42\x00', 0x2, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000500)={0xe000200c}) executing program 0: r0 = socket$inet6(0xa, 0x3, 0x102) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) executing program 3: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x3) syz_clone(0x2004011, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) executing program 2: bpf$TOKEN_CREATE(0x24, &(0x7f0000001880), 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000019c0)={0x6, 0x5, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) mbind(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000040)=0xc, 0x6, 0x2) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, 0x0) executing program 1: syz_mount_image$vfat(&(0x7f0000000640), &(0x7f00000000c0)='./file1\x00', 0x2048cc, &(0x7f0000000340)=ANY=[@ANYBLOB="756e695f786c6174653d312c696f636861727365743d757466382c0097b75cbdde02821d0f77397fc18b433d0c59e692b381c145c5922679338b5ff21c0653a98440a5725268a242c026e564f988d3c178704feaf8a412df818275708882ea9a4048c6e458a1f05b83f2e69b965b1df203b21de2b0ee375647f886a5310889982079aa7b1fb4eefe7f768eec58b19cf50faaf129503175f4262df740183df51d3641ff78b86127c1db8ef165bfa3bd20797fde6ff91a0e45d3d7c1c6d1ce0a72be8c1fdb00000000000015000000", @ANYRES16=0x0, @ANYRESDEC=0x0, @ANYRES8, @ANYRES32], 0x1, 0x354, &(0x7f0000000680)="$eJzs3bFvG1UcB/BfTUja0tQZEBJIiCdYYLGS8A/UQq2EiAQKDSoMSFfigOWrHfmsIleIdkNs/B0VIxsSQmLOws7GloWNDhVGthM3thwBg3Mp/Xyk3Hu556/unc9n/ZbzO7z13Z3WXlHby3pRuZbiUkRUHkWsRSWOXThqK6P+cpz0IN6q3vrt1Q8//uS9+tbW9e2UbtRvvr2ZUrr62k9ffvX96z/3Xvjoh6s/rsTB2qeHf2z+fvDSwcuHf938olmkZpHanV7K0u1Op5fdzhtpt1m0ail9kDeyopGa7aLRnRrfyzv7+/2UtXdXL+93G0WRsnY/tRr91OukXrefss+zZjvVarW0ejnmWJm38/9h7vn+g52H29tZfQGT4Qx9O7vj0vS/3W49uzD3w7/zcKETAwDOpdn6vxIXR/tLqv+PS5T/Xv9f+Ff1P1PU/8+CYf2/fHT/TlP/AwAAAAAAAAAAAADA0+DRYFAdDAbV43b2r+z5sViu/7PtxIN7FyPyb+7u3N0Zt+Px+l40I49GrEc1HkcMJmL0pOCNd7eur6eRtVi9c3+cH7bPTec3ohpr0/nhdpjfSCkN7qc0nX9+9IsWk/xmVOPF+fnN8fFn8svx5hsn8rWoxq+fRSfy2I1h9kn+642U3nl/aya/MnrdxNJwc62MSwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAGailibnr99dqp42P85P19dejGo/nr8+/Pnd9/qV4ZanccwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAY0X/XivL80b37DsP4pShwZGyJnb2nYiFHeKXK3Ha+6zT//N8TGPcuXJ0T56P+ZT8xQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAleLLod9kzAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoExF/14ry/NGd4Gdss8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgafJ3AAAA//9quCNn") munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys\x00', 0x1ff) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) executing program 0: setresgid(0x0, 0xee00, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000d40)='system.posix_acl_access\x00', &(0x7f000000b640)={{}, {0x1, 0x4}, [], {0x4, 0x1}, [{0x8, 0x1}, {0x8, 0x3}], {0x10, 0x3}, {0x20, 0x2}}, 0x34, 0x1) setreuid(0xffffffffffffffff, 0xee01) mkdirat(0xffffffffffffff9c, &(0x7f0000000dc0)='./mnt\x00', 0x1ff) executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000200)={&(0x7f0000000240)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000b00)="dc", 0x1}], 0x1}, 0x48043) r3 = dup(r1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000500)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000540)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0xad}}, 0x7, 0x1, 0x457, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$9p(r5, &(0x7f0000000640)='-', 0x1) splice(r4, 0x0, r1, 0x0, 0x100000000, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) writev(r2, &(0x7f0000000680)=[{&(0x7f00000006c0)="cd89", 0x2}], 0x1) write$binfmt_script(r3, &(0x7f0000000700)={'#! ', './file0', [], 0xa, "5775ebb77549afc496bc5cc558c52be63e203db628daa190b16cc7216b9bfb1b0bd22d03f5e1cd7a3da150be3434e1d6c83af706cea87fffe560d236a8c26a760289f80eaa398ae77b0d26197822dd25b01733bd602efae482eced2ed31ee6ce67c841c25dfefcd739990462ff3626423e0e3ba7a4d4a86469f8cf3ac3d81d4f63be7d17a6caf4a8b071298bc35fdea671ea0025460ccfed3040fe1945a0d089bba38204ca6631e158a7717cf420623fad22082e3ae1b8e38748772095513a3f5028fb76790ef01caab610421c1ae48ffd68b5aefd4f399b8d28edddd9dde0d8afa1fd2df0d8c6ebbcf9493daea96589ee90969516953c83d70124dc91b26e3287986fdc096eda61a819b88e28facf71a064600e69747ab08f0379afde05c2b558f6058e2ef5c3a36ab3171bd99960ebb980380b7f76f8fce6987cf5eafb1384cefd64e1d214b14cff8f9ae739db32fb1e54d01856a3b277c3f02aeebe7f58f0708f4487afe3674a0a412461a9de083979f9c380a9336893f77c19f740aed24764a0165a52fa2d8152bb55f49fe1c1a52977f9244fdf648ef55acdbaab7827a33e5c66592b97b2b4ccf4d642d75a23a0bf43cb9dd6d4156cc58636f4d68d0370d827d0c6a0b0a3fb818e36d6716a49ec3bac8da32f9a8bd74c499768a4c62822d018ef9f7982ddf15e655670f9cec0162460e4b9a83a5f1cfd99dcb5dfe680039d9b9ee28132545ce12ff1f32c6ecf9181688260da9d4d610567eacf0c399e85c974fc752333c7d0ac1ba8e0213f07884fc77b0ba82aa058e596f04b7d44b409cd4a1fab3b3c0d4217493196f62e2cf9e4d9834e7f966ca42b76100ef5f6fa89700a0b4661056849331fb583b3e9659711ae466c61507319b7d1638ffca5f9130ca7fdb86276ada534473b4d2c21859a825ba6e502d2f912e224f1fdb70a57c42e2185a45edac6e09c1c7446dc889dd8ba711ac687257b35a1b923a960be298b680106299cd3ac4e06cae9352bfdd0427e13ce759b48140df351c8f9ae8fb9acabb9c3346e23433c4875d45ac7836d990cd13d35ac48700e315d7e9b11ca587cb9a764af1fda1bb8c36f15d1d642252e26a5c9d9c33a16dca4584f864467ad20b97ddffc6fcbbaf71716aa07e9f0c99bee7e22fac55dcf54f99af981bd0217b72a4cf46ce46f165d512fd49ff4e3cea29a63e0354177bfe5433b25c3496461b39153b68cbc5af714bde4043909c4679aedd01875badbb6f74cadcf9488769ebe8e173c746225f3decccfed3d295d90b29444b27c2e5a72943eb03d254940a65398e63d78f9"}, 0x3b0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 0: connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @loopback, 0x106}, 0x1c) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb}, 0x1c}}, 0x800) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @mcast1}, 0x1c, 0x0}}], 0x1, 0xc040) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000500)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000fe9000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f000029a000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) io_uring_setup(0x1c79, &(0x7f0000000600)={0x0, 0xc8a1, 0xc000, 0xc, 0xc1}) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000007f0000007f000000050000000c0000000700000000000001090000002c0005020100000000000008030000000a0000000000000202000000030000000500000f"], &(0x7f0000000800)=""/212, 0x9d, 0xd4, 0x0, 0x2}, 0x28) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x100, 0x5, 0x6, 0x4002, 0x9, 0x5, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41801}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 4: syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x404, &(0x7f00000001c0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYRES64, @ANYRESOCT, @ANYRES8], 0x3, 0x2ea, &(0x7f0000000780)="$eJzs3c9rE3kYx/FnmzRJU9pkYVnYhd19WC96CW38AzRIC2JAqY2oB2FqJxoyJmUmVCJicxFPgn9H8ehNUP+BXsSLd29FELz0II5kZpImbTqNNT+qfb+gzXfmmU+/3yST8kwh6fb1Z/fKRSdTNGoykVCZEGnIjki6OQr8FtxOeOOYdGrImenP7/+5euPmpVw+v7CkuhhfPptV1dn/Xt1/+Pz/N7Xpay9mX8ZlK31r+1P2w1Zs66/tr8t3S46WHK1Ua2roSrVaM1YsU1dLTjmjesUyDcfUUsUx7a560aqurdXVqKzOJNds03HUqNS1bNa1VtWaXVfjjlGqaCaT0ZmknGxR7/vT0IehsBkNK7uRA0uTR14Xhmiq107bzjV6FwubI1gTAAA4ZsL7f7/XP6j/3+0Ou/r/XHj//+fh/b9IZ/+fCCYJ7/+j9P/9aHRtFTaXlozc2BaDkbDtnJEMXr/d6P8BAAAAAAAAAAAAAAAAAAAAAPgZ7LhuynXdVPM22OVtx0Uk4b8F3Nse8zIxJDtua+SfB62v9vMfbO+JnRv9SjEMHW/cS4hYT9YL6wX/1q/nit5pYMqcpOSLdz4E/PHixfzCnHrS8traCPIb64WIxP18qT1Zulf+39/n/bx25ycl2cpbYkpWUvJH7/mzPfMxOX2qI5+RlLy9LVWxZNU7r3fzj+ZVL1zO+/nmor38lHccAAAAAAC/goy27bt+9+reAQnZX/fz7evruebl9EbY3wf2XJ9H5e/QD58EAAAAAACD4tQflA3LMu0jDOIi8gPxwQ9cV2T8y4jICCeN9XvweRE5Jk/TKAYJEfH36FHiH9vxvlLuoa8U24kG/4FjAHew+WOG/hiO+zcTAAAAgEHbbfq/I/Tu8RBXBAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAydPf54FF2sfvK7UKIfGO6SKjvn8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAcfItAAD//0jECI0=") mkdirat(0xffffffffffffff9c, &(0x7f0000000a80)='./file1\x00', 0x0) mount$bind(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000480)='./file0/../file0/file0\x00') chdir(&(0x7f00000004c0)='./file0/../file0/file0\x00') executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x80, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_INIT(r0, 0x0, 0x0) executing program 1: syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000180)='./file1\x00', 0x1218088, &(0x7f0000000b00)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c757466383d312c696f636861727365743d61736369692c73686f72746e616d653d77696e39352c73686f77657865632c6e66732c636865636b3d7374726963742c756e695f786c6174653d302c757466383d312c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c726f6469722c726f6469722c64656275672c757466383d302c726f6469722c71756965742c6572726f72733d72656d6f756e742d726f2c009c8a8fc4f74784ad79ec08fb556262ebc972ef94821f3565ef5f75f11e30ef1f72a065c510b17cae356940538b7b2c5d72f4627c25306b2479725add28f511a68f5f6f47f9facdd0cc574286d00ab52d6b9374b6a58eac694336ebe971f41860d01084c1a0fa6b51d80fa9f9d2c1a2e7a5284f93296217ef8f28e0a36e573296a0bfb38b94191f4b82873563f3759b5e193ecfab6ed7892542364757e47d656ad6a0fbb6e8bf138bddae620a3602991821d4844f628e6bdd8b62cca73744332f0185a54b52a0352a82c794995bbb97c82fcde79d14fb20e5127150de", @ANYRESDEC], 0x4a, 0x2df, &(0x7f0000000f80)="$eJzs3b+LHFUcAPDv7O3NTrTYLaxEyIAprIKXTmz2kATEqwxbRAs9TAJyuwg5OIiKaypbGwsL/wJBsPG/SON/INgKdkYIjMzszO3s3uZ+RPckd59Pc9977/ud997sY2+3mHcfvzbZu5vH/Udf/hZZlkRnGMN4ksQgOtH4OhYMvw0A4EX2pCjiz2KmakhOV1emZeudGgCwJkf+/q/UnYc/n8u0AIA1un3ng/e2d3Zuvp9FFrcm3xyMym/25c9Z//b9+DTGcS/ejH48jag+J9Rf/Mv4VlEU025eGsS1yfRgVFZOPnpcX3/7j4iqfiv6MTgsqz5tVPXv7tzcqsrzXqt+Ws7jpXr8YVl/I/rxymHxQv2NWX3ero9RGm+83pr/9ejHr5/EZzGOu9Uk5vVfbeX5O8V3f33xYTm9sj6ZHox6Vd5csXGerwsAAAAAAAAAAAAAAAAAAAAAABfb9bw5fCe/GtcmZVN9/s7G07TOqVMG86qyfxYdHhfcOh+oNC3ih9mRgpsL483P9+nGq932wYIAAAAAAAAAAAAAAAAAAABwee0//Hxvdzy+9+A/CZKIK82V/74d8bzXGbZarsbxyb16vN3xuFOHCzmP03ZLbDQ5ScSx04huxELL8y/npOBKtjTnJvjxp3KBZ7lg1mp5a/UCN5fWdSS40/u3e6PZA3u7yeqxetG0ZPVd/T6NmOekccqx0md1FdF+vU5acrqyq3/mtacvV8H0mTlFsmKLtoK3f5/11y1JLO26tLqrK0ffrINW+dLeOOEm1OXZrPzoe0VSndbRW8O7EAAAAAAAAAAAAAAAAAAAENXTvM3Tv+Vvvyx2Pjq2tFN4FBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAC2L/YfP//88QTOviUySn8WD/f14iAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAl8A/AQAA//+0t0sX") fchownat(0xffffffffffffff9c, &(0x7f0000000d40)='./file0\x00', 0x0, 0xee01, 0x1000) openat(0xffffffffffffff9c, &(0x7f00000027c0)='./file0\x00', 0x20443, 0x0) executing program 4: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f00000002c0)={&(0x7f0000000380)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000400)="dc", 0x1}], 0x1}, 0x48043) r3 = dup(r1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000440)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000480)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0xad}}, 0x7, 0x1, 0x457, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000540)=0x3, 0x4) pipe2$9p(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$9p(r5, 0x0, 0x0) splice(r4, 0x0, r1, 0x0, 0x100000000, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) writev(r2, &(0x7f0000000a00)=[{&(0x7f0000000a80)="cd89b0b00d", 0x5}], 0x1) write$binfmt_script(r3, &(0x7f0000000f80)={'#! ', './file0', [], 0xa, "5775ebb77549afc496bc5cc558c52be63e203db628daa190b16cc7216b9bfb1b0bd22d03f5e1cd7a3da150be3434e1d6c83af706cea87fffe560d236a8c26a760289f80eaa398ae77b0d26197822dd25b01733bd602efae482eced2ed31ee6ce67c841c25dfefcd739990462ff3626423e0e3ba7a4d4a86469f8cf3ac3d81d4f63be7d17a6caf4a8b071298bc35fdea671ea0025460ccfed3040fe1945a0d089bba38204ca6631e158a7717cf420623fad22082e3ae1b8e38748772095513a3f5028fb76790ef01caab610421c1ae48ffd68b5aefd4f399b8d28edddd9dde0d8afa1fd2df0d8c6ebbcf9493daea96589ee90969516953c83d70124dc91b26e3287986fdc096eda61a819b88e28facf71a064600e69747ab08f0379afde05c2b558f6058e2ef5c3a36ab3171bd99960ebb980380b7f76f8fce6987cf5eafb1384cefd64e1d214b14cff8f9ae739db32fb1e54d01856a3b277c3f02aeebe7f58f0708f4487afe3674a0a412461a9de083979f9c380a9336893f77c19f740aed24764a0165a52fa2d8152bb55f49fe1c1a52977f9244fdf648ef55acdbaab7827a33e5c66592b97b2b4ccf4d642d75a23a0bf43cb9dd6d4156cc58636f4d68d0370d827d0c6a0b0a3fb818e36d6716a49ec3bac8da32f9a8bd74c499768a4c62822d018ef9f7982ddf15e655670f9cec0162460e4b9a83a5f1cfd99dcb5dfe680039d9b9ee28132545ce12ff1f32c6ecf9181688260da9d4d610567eacf0c399e85c974fc752333c7d0ac1ba8e0213f07884fc77b0ba82aa058e596f04b7d44b409cd4a1fab3b3c0d4217493196f62e2cf9e4d9834e7f966ca42b76100ef5f6fa89700a0b4661056849331fb583b3e9659711ae466c61507319b7d1638ffca5f9130ca7fdb86276ada534473b4d2c21859a825ba6e502d2f912e224f1fdb70a57c42e2185a45edac6e09c1c7446dc889dd8ba711ac687257b35a1b923a960be298b680106299cd3ac4e06cae9352bfdd0427e13ce759b48140df351c8f9ae8fb9acabb9c3346e23433c4875d45ac7836d990cd13d35ac48700e315d7e9b11ca587cb9a764af1fda1bb8c36f15d1d642252e26a5c9d9c33a16dca4584f864467ad20b97ddffc6fcbbaf71716aa07e9f0c99bee7e22fac55dcf54f99af981bd0217b72a4cf46ce46f165d512fd49ff4e3cea29a63e0354177bfe5433b25c3496461b39153b68cbc5af714bde4043909c4679aedd01875badbb6f74cadcf9488769ebe8e173c746225f3decccfed3d295d90b29444b27c2e5a72943eb03d254940a65398e63d78f9b41ef8a17c0c2bd8e9057619ff39dc47105189d0c70a32c535790e68fff9c9a9ef708576c51bcc8868f8a2842b82af5c0466a3cb1fc229e3fd4434e2956d206fc8ca66c8494567db7034e223a4dd1313d3b2399616307fd3ef27acf6732a69cc5f"}, 0x411) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: getegid() socket(0x10, 0x803, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x4, &(0x7f0000000680)=@framed={{}, [@alu={0x7, 0x1, 0x3, 0x0, 0x7, 0x1}]}, &(0x7f0000000700)='syzkaller\x00'}, 0x94) unshare(0x28000600) r0 = fsopen(&(0x7f0000000000)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) open(0x0, 0x60840, 0x0) setxattr$system_posix_acl(&(0x7f0000000080)='./tracefs/events/mygroup/myevent/enable\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', 0x0, 0x0, 0x2) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000d40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_RVERSION(r1, &(0x7f0000000d80)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000dc0)={0x18, 0x0, 0x0, {0xb6d}}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000e00)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000e40)='./file0\x00', &(0x7f0000000e80), 0x0, &(0x7f0000000ec0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x2000, 0x64) chdir(&(0x7f0000000f00)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.stat\x00', 0x275a, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_TDX_INIT_VM(r1, 0xc008aeba, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat-ioctl$UFFDIO_REGISTER-open-setxattr$system_posix_acl detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) open(0x0, 0x60840, 0x0) setxattr$system_posix_acl(&(0x7f0000000080)='./tracefs/events/mygroup/myevent/enable\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', 0x0, 0x0, 0x2) program crashed: KASAN: use-after-free Read in tracing_open_file_tr single: successfully extracted reproducer found reproducer with 9 syscalls minimizing guilty program testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat-ioctl$UFFDIO_REGISTER-open detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) open(0x0, 0x60840, 0x0) program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat-ioctl$UFFDIO_REGISTER detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) program crashed: KASAN: use-after-free Read in tracing_open_file_tr program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-creat detailed listing: executing program 0: mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, 0x0, 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program did not crash testing program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(0x0, 0xa0) program did not crash extracting C reproducer testing compiled C program (duration=1m38.873111228s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr simplifying C reproducer testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program did not crash testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing compiled C program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat program crashed: KASAN: use-after-free Read in tracing_open_file_tr testing program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program crashed: KASAN: use-after-free Read in tracing_open_file_tr validation run: crashed=true testing program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program crashed: KASAN: use-after-free Read in tracing_open_file_tr validation run: crashed=true testing program (duration=1m38.873111228s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-creat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='e:mygroup/myevent sched.sched_switch', 0x24) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracefs/events/mygroup/myevent/enable\x00', 0x2, 0x1) creat(&(0x7f0000002b00)='./tracefs/dynamic_events\x00', 0xa0) program crashed: KASAN: use-after-free Read in tracing_open_file_tr validation run: crashed=true reproducing took 47m11.738060666s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in tracing_open_file_tr+0x63/0x2f0 kernel/trace/trace.c:4876 Read of size 8 at addr ffff888024892d28 by task syz.2.65/4512 CPU: 1 PID: 4512 Comm: syz.2.65 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 tracing_open_file_tr+0x63/0x2f0 kernel/trace/trace.c:4876 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fe6ff8ee559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe9f6a6498 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fe6ffb75fa0 RCX: 00007fe6ff8ee559 RDX: 0000000000000002 RSI: 0000200000000200 RDI: ffffffffffffff9c RBP: 00007fe6ff985ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe6ffb75fac R14: 00007fe6ffb75fa0 R15: 00007fe6ffb75fa0 Allocated by task 4512: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x92/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238 trace_create_new_event+0x26/0x3d0 kernel/trace/trace_events.c:3013 __trace_add_new_event kernel/trace/trace_events.c:3042 [inline] __add_event_to_tracers kernel/trace/trace_events.c:3766 [inline] trace_add_event_call+0xed/0x1c0 kernel/trace/trace_events.c:3083 trace_probe_register_event_call+0x328/0x3e0 kernel/trace/trace_probe.c:1179 __trace_eprobe_create+0xaaf/0xc80 kernel/trace/trace_eprobe.c:973 trace_probe_create+0xc4/0x130 kernel/trace/trace_probe.c:1287 create_dyn_event+0xa9/0x140 kernel/trace/trace_dynevent.c:152 trace_parse_run_command+0x1a8/0x2c0 kernel/trace/trace.c:10201 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4513: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kmem_cache_free+0x8f/0x210 mm/slub.c:3520 tracing_release_file_tr+0xbd/0x100 kernel/trace/trace.c:4904 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff888024892d00 which belongs to the cache trace_event_file of size 96 The buggy address is located 40 bytes inside of 96-byte region [ffff888024892d00, ffff888024892d60) The buggy address belongs to the page: page:ffffea0000922480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24892 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 0000000000000000 dead000000000122 ffff8880178c5280 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4432, ts 84571852045, free_ts 81986289510 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0xf0/0x280 mm/slub.c:3238 trace_create_new_event+0x26/0x3d0 kernel/trace/trace_events.c:3013 __trace_add_new_event kernel/trace/trace_events.c:3042 [inline] __add_event_to_tracers kernel/trace/trace_events.c:3766 [inline] trace_add_event_call+0xed/0x1c0 kernel/trace/trace_events.c:3083 trace_probe_register_event_call+0x328/0x3e0 kernel/trace/trace_probe.c:1179 __trace_eprobe_create+0xaaf/0xc80 kernel/trace/trace_eprobe.c:973 trace_probe_create+0xc4/0x130 kernel/trace/trace_probe.c:1287 create_dyn_event+0xa9/0x140 kernel/trace/trace_dynevent.c:152 trace_parse_run_command+0x1a8/0x2c0 kernel/trace/trace.c:10201 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396 free_slab mm/slub.c:2020 [inline] discard_slab mm/slub.c:2026 [inline] __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512 put_cpu_partial+0x12d/0x190 mm/slub.c:2592 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] kmem_cache_alloc_node+0x184/0x2c0 mm/slub.c:3261 __alloc_skb+0xf4/0x750 net/core/skbuff.c:415 alloc_skb include/linux/skbuff.h:1162 [inline] mld_newpack+0x12f/0xba0 net/ipv6/mcast.c:1773 add_grhead net/ipv6/mcast.c:1884 [inline] add_grec+0x1364/0x1840 net/ipv6/mcast.c:2023 mld_send_cr net/ipv6/mcast.c:2146 [inline] mld_ifc_work+0x6f2/0xd60 net/ipv6/mcast.c:2688 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 Memory state around the buggy address: ffff888024892c00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888024892c80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888024892d00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888024892d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888024892e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in tracing_open_file_tr+0x63/0x2f0 kernel/trace/trace.c:4876 Read of size 8 at addr ffff888024892d28 by task syz.2.65/4512 CPU: 1 PID: 4512 Comm: syz.2.65 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 tracing_open_file_tr+0x63/0x2f0 kernel/trace/trace.c:4876 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fe6ff8ee559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe9f6a6498 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fe6ffb75fa0 RCX: 00007fe6ff8ee559 RDX: 0000000000000002 RSI: 0000200000000200 RDI: ffffffffffffff9c RBP: 00007fe6ff985ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe6ffb75fac R14: 00007fe6ffb75fa0 R15: 00007fe6ffb75fa0 Allocated by task 4512: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x92/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0x15d/0x280 mm/slub.c:3238 trace_create_new_event+0x26/0x3d0 kernel/trace/trace_events.c:3013 __trace_add_new_event kernel/trace/trace_events.c:3042 [inline] __add_event_to_tracers kernel/trace/trace_events.c:3766 [inline] trace_add_event_call+0xed/0x1c0 kernel/trace/trace_events.c:3083 trace_probe_register_event_call+0x328/0x3e0 kernel/trace/trace_probe.c:1179 __trace_eprobe_create+0xaaf/0xc80 kernel/trace/trace_eprobe.c:973 trace_probe_create+0xc4/0x130 kernel/trace/trace_probe.c:1287 create_dyn_event+0xa9/0x140 kernel/trace/trace_dynevent.c:152 trace_parse_run_command+0x1a8/0x2c0 kernel/trace/trace.c:10201 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4513: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kmem_cache_free+0x8f/0x210 mm/slub.c:3520 tracing_release_file_tr+0xbd/0x100 kernel/trace/trace.c:4904 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff888024892d00 which belongs to the cache trace_event_file of size 96 The buggy address is located 40 bytes inside of 96-byte region [ffff888024892d00, ffff888024892d60) The buggy address belongs to the page: page:ffffea0000922480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24892 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 0000000000000000 dead000000000122 ffff8880178c5280 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4432, ts 84571852045, free_ts 81986289510 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0xf0/0x280 mm/slub.c:3238 trace_create_new_event+0x26/0x3d0 kernel/trace/trace_events.c:3013 __trace_add_new_event kernel/trace/trace_events.c:3042 [inline] __add_event_to_tracers kernel/trace/trace_events.c:3766 [inline] trace_add_event_call+0xed/0x1c0 kernel/trace/trace_events.c:3083 trace_probe_register_event_call+0x328/0x3e0 kernel/trace/trace_probe.c:1179 __trace_eprobe_create+0xaaf/0xc80 kernel/trace/trace_eprobe.c:973 trace_probe_create+0xc4/0x130 kernel/trace/trace_probe.c:1287 create_dyn_event+0xa9/0x140 kernel/trace/trace_dynevent.c:152 trace_parse_run_command+0x1a8/0x2c0 kernel/trace/trace.c:10201 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396 free_slab mm/slub.c:2020 [inline] discard_slab mm/slub.c:2026 [inline] __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512 put_cpu_partial+0x12d/0x190 mm/slub.c:2592 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] kmem_cache_alloc_node+0x184/0x2c0 mm/slub.c:3261 __alloc_skb+0xf4/0x750 net/core/skbuff.c:415 alloc_skb include/linux/skbuff.h:1162 [inline] mld_newpack+0x12f/0xba0 net/ipv6/mcast.c:1773 add_grhead net/ipv6/mcast.c:1884 [inline] add_grec+0x1364/0x1840 net/ipv6/mcast.c:2023 mld_send_cr net/ipv6/mcast.c:2146 [inline] mld_ifc_work+0x6f2/0xd60 net/ipv6/mcast.c:2688 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 Memory state around the buggy address: ffff888024892c00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888024892c80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888024892d00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888024892d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888024892e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================