Extracting prog: 9m12.540183055s
Minimizing prog: 2h22m14.294179544s
Simplifying prog options: 20m12.25808298s
Extracting C: 5m46.744609248s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-sendmsg$inet-futex-sendmsg-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r3, r4, <r5=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r1, 0x3b8c, &(0x7f0000000100)={0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r6, 0x540a, 0x0)
ioctl$TCFLSH(r6, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001)
futex(0x0, 0x80, 0x2, 0x0, 0x0, 0x1)
sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000780)="a9", 0xfffffdef}], 0x1}, 0x0)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-sendmsg$inet-futex-sendmsg-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r3, r4, <r5=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r1, 0x3b8c, &(0x7f0000000100)={0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r6, 0x540a, 0x0)
ioctl$TCFLSH(r6, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001)
futex(0x0, 0x80, 0x2, 0x0, 0x0, 0x1)
sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000780)="a9", 0xfffffdef}], 0x1}, 0x0)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-sendmsg$inet-futex-sendmsg-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r3, r4, <r5=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r1, 0x3b8c, &(0x7f0000000100)={0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r6, 0x540a, 0x0)
ioctl$TCFLSH(r6, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001)
futex(0x0, 0x80, 0x2, 0x0, 0x0, 0x1)
sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000780)="a9", 0xfffffdef}], 0x1}, 0x0)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
single: successfully extracted reproducer
found reproducer with 17 syscalls
minimizing guilty program
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-sendmsg$inet-futex-sendmsg
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r3, r4, <r5=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r1, 0x3b8c, &(0x7f0000000100)={0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r6, 0x540a, 0x0)
ioctl$TCFLSH(r6, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001)
futex(0x0, 0x80, 0x2, 0x0, 0x0, 0x1)
sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000780)="a9", 0xfffffdef}], 0x1}, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-sendmsg$inet-futex-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r3, r4, <r5=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r1, 0x3b8c, &(0x7f0000000100)={0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r6, 0x540a, 0x0)
ioctl$TCFLSH(r6, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001)
futex(0x0, 0x80, 0x2, 0x0, 0x0, 0x1)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-sendmsg$inet-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r4=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r3, r4, <r5=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r1, 0x3b8c, &(0x7f0000000100)={0x30, r5, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r6, 0x540a, 0x0)
ioctl$TCFLSH(r6, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-syz_usb_connect-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r5, 0x540a, 0x0)
ioctl$TCFLSH(r5, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r5, 0x540a, 0x0)
ioctl$TCFLSH(r5, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r5, 0x540a, 0x0)
ioctl$TCFLSH(r5, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r5, 0x540a, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCFLSH(r5, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TCXONC(r5, 0x540a, 0x0)
ioctl$TCFLSH(r5, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, <r4=>0x0, 0x0, 0xdead, 0x0, 0x0})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0)
ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_ALLOC$TEST-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x28, 0x3, r2, r3, 0x0, 0x0, 0xdead, 0x0, 0x0})
r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r4, 0x540a, 0x0)
ioctl$TCFLSH(r4, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r4, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1})
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r2, 0x540a, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r2, 0x540a, 0x0)
ioctl$TCFLSH(r2, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r2, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
socket$kcm(0x2, 0x200000000000001, 0x106)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(0xffffffffffffffff, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r0, 0x540a, 0x0)
ioctl$TCFLSH(r0, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48})
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, 0x0)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=9m1.569902979s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
validation run: crashed=true
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
validation run: crashed=true
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=9m1.569902979s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS-ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP-openat$ptmx-ioctl$TIOCSETD-ioctl$TCXONC-ioctl$TCFLSH-ioctl$TIOCVHANGUP
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, 0x0)
ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf)
ioctl$TCXONC(r1, 0x540a, 0x0)
ioctl$TCFLSH(r1, 0x400455c8, 0x4)
ioctl$TIOCVHANGUP(r1, 0x5437, 0x0)

program crashed: KASAN: slab-use-after-free Read in hci_uart_write_work
validation run: crashed=true
reproducing took 3h24m56.208674104s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in hci_uart_write_work+0x2ca/0x550 drivers/bluetooth/hci_ldisc.c:165
Read of size 8 at addr ffff88801f2bc218 by task kworker/0:4/5462

CPU: 0 UID: 0 PID: 5462 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events hci_uart_write_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 hci_uart_write_work+0x2ca/0x550 drivers/bluetooth/hci_ldisc.c:165
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 46:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 unpoison_slab_object mm/kasan/common.c:342 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:368
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4962 [inline]
 slab_alloc_node mm/slub.c:5272 [inline]
 kmem_cache_alloc_node_noprof+0x433/0x710 mm/slub.c:5324
 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:660
 alloc_skb include/linux/skbuff.h:1383 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
 hci_cmd_sync_alloc+0x3d/0x380 net/bluetooth/hci_sync.c:58
 hci_cmd_sync_add net/bluetooth/hci_sync.c:99 [inline]
 __hci_cmd_sync_sk+0x1a7/0xbc0 net/bluetooth/hci_sync.c:168
 __hci_cmd_sync_status_sk net/bluetooth/hci_sync.c:263 [inline]
 __hci_cmd_sync_status net/bluetooth/hci_sync.c:287 [inline]
 hci_read_local_features_sync net/bluetooth/hci_sync.c:3703 [inline]
 hci_init_stage_sync net/bluetooth/hci_sync.c:3618 [inline]
 hci_init1_sync net/bluetooth/hci_sync.c:3750 [inline]
 hci_init_sync net/bluetooth/hci_sync.c:4862 [inline]
 hci_dev_init_sync net/bluetooth/hci_sync.c:5054 [inline]
 hci_dev_open_sync+0x14be/0x2b60 net/bluetooth/hci_sync.c:5132
 hci_dev_do_open net/bluetooth/hci_core.c:430 [inline]
 hci_power_on+0x1b4/0x680 net/bluetooth/hci_core.c:959
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 8113:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2530 [inline]
 slab_free mm/slub.c:6619 [inline]
 kmem_cache_free+0x19b/0x690 mm/slub.c:6729
 kfree_skb_reason include/linux/skbuff.h:1322 [inline]
 kfree_skb include/linux/skbuff.h:1331 [inline]
 hci_uart_flush+0x9d/0x1b0 drivers/bluetooth/hci_ldisc.c:235
 hci_uart_close drivers/bluetooth/hci_ldisc.c:268 [inline]
 hci_uart_tty_close+0x99/0x290 drivers/bluetooth/hci_ldisc.c:545
 tty_ldisc_kill+0xa3/0x1a0 drivers/tty/tty_ldisc.c:613
 tty_ldisc_hangup+0x3a2/0x4b0 drivers/tty/tty_ldisc.c:729
 __tty_hangup+0x40c/0x680 drivers/tty/tty_io.c:621
 tty_vhangup drivers/tty/tty_io.c:691 [inline]
 tty_ioctl+0x757/0xde0 drivers/tty/tty_io.c:2732
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88801f2bc140
 which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 216 bytes inside of
 freed 240-byte region [ffff88801f2bc140, ffff88801f2bc230)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f2bc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff8880304cfc80 ffffea0000008b40 dead000000000004
raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5480, tgid 5480 (syz-executor), ts 215388691880, free_ts 213579489844
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850
 prep_new_page mm/page_alloc.c:1858 [inline]
 get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3884
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5183
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:3046 [inline]
 allocate_slab+0x96/0x3a0 mm/slub.c:3219
 new_slab mm/slub.c:3273 [inline]
 ___slab_alloc+0xe94/0x18a0 mm/slub.c:4643
 __slab_alloc+0x65/0x100 mm/slub.c:4762
 __slab_alloc_node mm/slub.c:4838 [inline]
 slab_alloc_node mm/slub.c:5260 [inline]
 kmem_cache_alloc_node_noprof+0x4c5/0x710 mm/slub.c:5324
 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:660
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 rtmsg_ifinfo_build_skb+0x84/0x260 net/core/rtnetlink.c:4400
 rtmsg_ifinfo_event net/core/rtnetlink.c:4442 [inline]
 rtmsg_ifinfo+0x8c/0x1a0 net/core/rtnetlink.c:4451
 register_netdevice+0x1712/0x1ae0 net/core/dev.c:11346
 register_netdev+0x40/0x60 net/core/dev.c:11410
 ip6_tnl_init_net+0x259/0x3b0 net/ipv6/ip6_tunnel.c:2307
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
 setup_net+0xfe/0x320 net/core/net_namespace.c:445
page last free pid 5404 tgid 5404 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2906
 vfree+0x25a/0x400 mm/vmalloc.c:3440
 kcov_put kernel/kcov.c:439 [inline]
 kcov_close+0x28/0x50 kernel/kcov.c:535
 __fput+0x44c/0xa70 fs/file_table.c:468
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x6b5/0x2300 kernel/exit.c:966
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1107
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0xa0/0x790 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x72/0x130 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88801f2bc100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
 ffff88801f2bc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801f2bc200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
                            ^
 ffff88801f2bc280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801f2bc300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in hci_uart_write_work+0x2ca/0x550 drivers/bluetooth/hci_ldisc.c:165
Read of size 8 at addr ffff88801f2bc218 by task kworker/0:4/5462

CPU: 0 UID: 0 PID: 5462 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events hci_uart_write_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 hci_uart_write_work+0x2ca/0x550 drivers/bluetooth/hci_ldisc.c:165
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 46:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 unpoison_slab_object mm/kasan/common.c:342 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:368
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4962 [inline]
 slab_alloc_node mm/slub.c:5272 [inline]
 kmem_cache_alloc_node_noprof+0x433/0x710 mm/slub.c:5324
 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:660
 alloc_skb include/linux/skbuff.h:1383 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
 hci_cmd_sync_alloc+0x3d/0x380 net/bluetooth/hci_sync.c:58
 hci_cmd_sync_add net/bluetooth/hci_sync.c:99 [inline]
 __hci_cmd_sync_sk+0x1a7/0xbc0 net/bluetooth/hci_sync.c:168
 __hci_cmd_sync_status_sk net/bluetooth/hci_sync.c:263 [inline]
 __hci_cmd_sync_status net/bluetooth/hci_sync.c:287 [inline]
 hci_read_local_features_sync net/bluetooth/hci_sync.c:3703 [inline]
 hci_init_stage_sync net/bluetooth/hci_sync.c:3618 [inline]
 hci_init1_sync net/bluetooth/hci_sync.c:3750 [inline]
 hci_init_sync net/bluetooth/hci_sync.c:4862 [inline]
 hci_dev_init_sync net/bluetooth/hci_sync.c:5054 [inline]
 hci_dev_open_sync+0x14be/0x2b60 net/bluetooth/hci_sync.c:5132
 hci_dev_do_open net/bluetooth/hci_core.c:430 [inline]
 hci_power_on+0x1b4/0x680 net/bluetooth/hci_core.c:959
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 8113:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2530 [inline]
 slab_free mm/slub.c:6619 [inline]
 kmem_cache_free+0x19b/0x690 mm/slub.c:6729
 kfree_skb_reason include/linux/skbuff.h:1322 [inline]
 kfree_skb include/linux/skbuff.h:1331 [inline]
 hci_uart_flush+0x9d/0x1b0 drivers/bluetooth/hci_ldisc.c:235
 hci_uart_close drivers/bluetooth/hci_ldisc.c:268 [inline]
 hci_uart_tty_close+0x99/0x290 drivers/bluetooth/hci_ldisc.c:545
 tty_ldisc_kill+0xa3/0x1a0 drivers/tty/tty_ldisc.c:613
 tty_ldisc_hangup+0x3a2/0x4b0 drivers/tty/tty_ldisc.c:729
 __tty_hangup+0x40c/0x680 drivers/tty/tty_io.c:621
 tty_vhangup drivers/tty/tty_io.c:691 [inline]
 tty_ioctl+0x757/0xde0 drivers/tty/tty_io.c:2732
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88801f2bc140
 which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 216 bytes inside of
 freed 240-byte region [ffff88801f2bc140, ffff88801f2bc230)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f2bc
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff8880304cfc80 ffffea0000008b40 dead000000000004
raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5480, tgid 5480 (syz-executor), ts 215388691880, free_ts 213579489844
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850
 prep_new_page mm/page_alloc.c:1858 [inline]
 get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3884
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5183
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:3046 [inline]
 allocate_slab+0x96/0x3a0 mm/slub.c:3219
 new_slab mm/slub.c:3273 [inline]
 ___slab_alloc+0xe94/0x18a0 mm/slub.c:4643
 __slab_alloc+0x65/0x100 mm/slub.c:4762
 __slab_alloc_node mm/slub.c:4838 [inline]
 slab_alloc_node mm/slub.c:5260 [inline]
 kmem_cache_alloc_node_noprof+0x4c5/0x710 mm/slub.c:5324
 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:660
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 rtmsg_ifinfo_build_skb+0x84/0x260 net/core/rtnetlink.c:4400
 rtmsg_ifinfo_event net/core/rtnetlink.c:4442 [inline]
 rtmsg_ifinfo+0x8c/0x1a0 net/core/rtnetlink.c:4451
 register_netdevice+0x1712/0x1ae0 net/core/dev.c:11346
 register_netdev+0x40/0x60 net/core/dev.c:11410
 ip6_tnl_init_net+0x259/0x3b0 net/ipv6/ip6_tunnel.c:2307
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
 setup_net+0xfe/0x320 net/core/net_namespace.c:445
page last free pid 5404 tgid 5404 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2906
 vfree+0x25a/0x400 mm/vmalloc.c:3440
 kcov_put kernel/kcov.c:439 [inline]
 kcov_close+0x28/0x50 kernel/kcov.c:535
 __fput+0x44c/0xa70 fs/file_table.c:468
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x6b5/0x2300 kernel/exit.c:966
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1107
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0xa0/0x790 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x72/0x130 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88801f2bc100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
 ffff88801f2bc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801f2bc200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
                            ^
 ffff88801f2bc280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801f2bc300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
==================================================================