Extracting prog: 26m51.543108457s Minimizing prog: 57m12.364679378s Simplifying prog options: 0s Extracting C: 51.752130436s Simplifying C: 25m57.141909714s extracting reproducer from 64 programs testing a last program of every proc single: executing 17 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-prlimit64-sched_setscheduler-landlock_create_ruleset-landlock_restrict_self-getpid-openat$cgroup_ro-write$cgroup_int-read$FUSE-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat-pwrite64-lseek detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv4_newrule={0x1c, 0x1e, 0x1, 0x70bd2a, 0x25dfdbff, {0x2, 0x0, 0x14, 0x0, 0xc, 0x0, 0x0, 0x4}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = landlock_create_ruleset(&(0x7f0000000100)={0x3000, 0x1, 0x2}, 0x18, 0x3) landlock_restrict_self(r1, 0x1) r2 = getpid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000100)=0x8, 0x12) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r6, &(0x7f0000000140)='2', 0x1, 0x8000c61) lseek(r6, 0x1, 0x4) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_QBUF-ioctl$vim2m_VIDIOC_STREAMOFF-openat$iommufd-poll-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x40, 0x9, {0x0, 0x2710}, {0x2, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000080)=0x2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) poll(&(0x7f0000000040)=[{r1, 0x184}, {r2, 0x8}, {r1}], 0x3, 0x8) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="13000000190001002dbd7000fcdbdf251d"], 0x44}, 0x1, 0x0, 0x0, 0x11}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-openat$sequencer-syz_open_dev$sndmidi-writev-openat$dsp1-ioctl$SNDCTL_DSP_SETFRAGMENT-write$dsp detailed listing: executing program 0: ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000000)=0x74000000) write$dsp(r1, &(0x7f0000002000)='`', 0x88030) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket-sendmsg$IPVS_CMD_SET_INFO-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x70bd2b, 0x10000, {0x0, 0x0, 0x0, r2, {0xc}, {0x0, 0x4}, {0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) (fail_nth: 5) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket-sendmsg$IPVS_CMD_SET_INFO-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x70bd2b, 0x10000, {0x0, 0x0, 0x0, r2, {0xc}, {0x0, 0x4}, {0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) (fail_nth: 5) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$nl_generic-syz_open_dev$video-prctl$PR_SCHED_CORE-openat$procfs-syz_usb_connect$hid-syz_usb_control_io$hid-openat$sequencer-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-prlimit64-sched_setscheduler-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-connect$rxrpc-syz_io_uring_setup-openat$sequencer-syz_open_dev$sndmidi-writev-mprotect-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56e, 0x11c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000280)={0x40, 0x3, 0x7, {0x1, 0x8, "3d7da32915"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video(0x0, 0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r2 = syz_usb_connect$hid(0x4, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x18d1, 0x5057, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xe, 0x40, 0x8, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x2, 0x7e, {0x9, 0x21, 0x2, 0x0, 0x1, {0x22, 0xcff}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x6, 0x4a, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0xb, 0xf7, 0x7}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x19, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c250000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={0x0, r3}, 0x18) connect$rxrpc(r1, &(0x7f0000000080)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x9, @empty, 0x9}}, 0x24) r5 = syz_io_uring_setup(0x460, &(0x7f0000000280)={0x0, 0x40000020, 0x10, 0x2, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x32, 0x0, @fd=r4, 0x0, 0x0, 0xffff, 0x0, 0x0, {0x0, 0x0, r4}}) io_uring_enter(r5, 0x47bc, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$nl_generic-syz_open_dev$video-prctl$PR_SCHED_CORE-openat$procfs-syz_usb_connect$hid-syz_usb_control_io$hid-openat$sequencer-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-prlimit64-sched_setscheduler-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-connect$rxrpc-syz_io_uring_setup-openat$sequencer-syz_open_dev$sndmidi-writev-mprotect-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56e, 0x11c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000280)={0x40, 0x3, 0x7, {0x1, 0x8, "3d7da32915"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$video(0x0, 0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r2 = syz_usb_connect$hid(0x4, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x18d1, 0x5057, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xe, 0x40, 0x8, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x2, 0x7e, {0x9, 0x21, 0x2, 0x0, 0x1, {0x22, 0xcff}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x6, 0x4a, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0xb, 0xf7, 0x7}}]}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x19, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c250000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={0x0, r3}, 0x18) connect$rxrpc(r1, &(0x7f0000000080)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x9, @empty, 0x9}}, 0x24) r5 = syz_io_uring_setup(0x460, &(0x7f0000000280)={0x0, 0x40000020, 0x10, 0x2, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x32, 0x0, @fd=r4, 0x0, 0x0, 0xffff, 0x0, 0x0, {0x0, 0x0, r4}}) io_uring_enter(r5, 0x47bc, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_CREATE_DUMB-prlimit64-sched_setscheduler-getpid-setxattr$trusted_overlay_upper-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$vim2m-bpf$PROG_LOAD-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$nl_generic-sendmsg$L2TP_CMD_SESSION_DELETE detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() setxattr$trusted_overlay_upper(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), &(0x7f0000000540)={0x0, 0xfb, 0xcd, 0x7, 0x81, "25f3c476be55ad1833f058658b0edf66", "87c30c7549836073cde4ad10c4a5b5c7236365407993ec3f81b0bfb925b0e20177e374a8b75bd74b87660204dfd85a88bae8277e2456aae04bfbdf66e03eb540c1ad8150b9922446f90625eb0405c0d5a7cf270828379d7491bc280992c41892486ca1dab2f6963a6cc20a0bdeba9befe00bb3670881363b4d97be39c0946778a554c646aaf132e6dfa8c030023a174270bec3a55d475f22d9199ed9b8b936efd83ceabc88dfdd945b4ec3fc51597047eae5d61d42918229"}, 0xcd, 0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1b, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x34, 0x0, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_CREATE_DUMB-prlimit64-sched_setscheduler-getpid-setxattr$trusted_overlay_upper-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$vim2m-bpf$PROG_LOAD-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$nl_generic-sendmsg$L2TP_CMD_SESSION_DELETE detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() setxattr$trusted_overlay_upper(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), &(0x7f0000000540)={0x0, 0xfb, 0xcd, 0x7, 0x81, "25f3c476be55ad1833f058658b0edf66", "87c30c7549836073cde4ad10c4a5b5c7236365407993ec3f81b0bfb925b0e20177e374a8b75bd74b87660204dfd85a88bae8277e2456aae04bfbdf66e03eb540c1ad8150b9922446f90625eb0405c0d5a7cf270828379d7491bc280992c41892486ca1dab2f6963a6cc20a0bdeba9befe00bb3670881363b4d97be39c0946778a554c646aaf132e6dfa8c030023a174270bec3a55d475f22d9199ed9b8b936efd83ceabc88dfdd945b4ec3fc51597047eae5d61d42918229"}, 0xcd, 0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1b, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x34, 0x0, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_CREATE_DUMB-prlimit64-sched_setscheduler-getpid-setxattr$trusted_overlay_upper-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$vim2m-bpf$PROG_LOAD-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_genetlink_get_family_id$l2tp-socket$nl_generic-sendmsg$L2TP_CMD_SESSION_DELETE detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() setxattr$trusted_overlay_upper(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), &(0x7f0000000540)={0x0, 0xfb, 0xcd, 0x7, 0x81, "25f3c476be55ad1833f058658b0edf66", "87c30c7549836073cde4ad10c4a5b5c7236365407993ec3f81b0bfb925b0e20177e374a8b75bd74b87660204dfd85a88bae8277e2456aae04bfbdf66e03eb540c1ad8150b9922446f90625eb0405c0d5a7cf270828379d7491bc280992c41892486ca1dab2f6963a6cc20a0bdeba9befe00bb3670881363b4d97be39c0946778a554c646aaf132e6dfa8c030023a174270bec3a55d475f22d9199ed9b8b936efd83ceabc88dfdd945b4ec3fc51597047eae5d61d42918229"}, 0xcd, 0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1b, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x34, r5, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_CREATE_DUMB-prlimit64-sched_setscheduler-getpid-setxattr$trusted_overlay_upper-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$vim2m-bpf$PROG_LOAD-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_genetlink_get_family_id$l2tp-socket$nl_generic-sendmsg$L2TP_CMD_SESSION_DELETE detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() setxattr$trusted_overlay_upper(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), &(0x7f0000000540)={0x0, 0xfb, 0xcd, 0x7, 0x81, "25f3c476be55ad1833f058658b0edf66", "87c30c7549836073cde4ad10c4a5b5c7236365407993ec3f81b0bfb925b0e20177e374a8b75bd74b87660204dfd85a88bae8277e2456aae04bfbdf66e03eb540c1ad8150b9922446f90625eb0405c0d5a7cf270828379d7491bc280992c41892486ca1dab2f6963a6cc20a0bdeba9befe00bb3670881363b4d97be39c0946778a554c646aaf132e6dfa8c030023a174270bec3a55d475f22d9199ed9b8b936efd83ceabc88dfdd945b4ec3fc51597047eae5d61d42918229"}, 0xcd, 0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1b, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x34, r5, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-openat$incfs-write$RDMA_USER_CM_CMD_CREATE_ID-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$pppl2tp-connect$inet6-socket$inet6_udp-prlimit64-sched_setaffinity-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-sendmsg$tipc-connect$pppl2tp-connect$inet6-socket$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a4f8ff000000001f03000000000000e5000200000000002604fdffff02000014010000033800001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x8, &(0x7f0000001040)={0xfffffffe}, 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x2, 0x1000000}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0x1a10c1, 0x9c37611dc13d0d83) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x2}}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, 0x0}, 0x20) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @mcast1, 0x400}, 0x1c) r2 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2, 0x0, 0x4}}, 0x2e) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e24, 0x1, @mcast2, 0x9}, 0x1c) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000640)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x5, {0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xffff}}}, 0x3a) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-openat$incfs-write$RDMA_USER_CM_CMD_CREATE_ID-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$pppl2tp-connect$inet6-socket$inet6_udp-prlimit64-sched_setaffinity-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-sendmsg$tipc-connect$pppl2tp-connect$inet6-socket$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a4f8ff000000001f03000000000000e5000200000000002604fdffff02000014010000033800001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x8, &(0x7f0000001040)={0xfffffffe}, 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x2, 0x1000000}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0x1a10c1, 0x9c37611dc13d0d83) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x2}}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{}, 0x0, 0x0}, 0x20) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @mcast1, 0x400}, 0x1c) r2 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2, 0x0, 0x4}}, 0x2e) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e24, 0x1, @mcast2, 0x9}, 0x1c) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000640)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x5, {0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0xffff}}}, 0x3a) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD_XDP-bpf$MAP_CREATE-bpf$LINK_GET_NEXT_ID-bpf$PROG_LOAD-openat$cgroup_pressure-bpf$PROG_LOAD-close-socketpair$unix-bpf$PROG_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM_TAIL_CALL-recvmsg$unix-sendmsg$inet-sendmsg$inet-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000800)=ANY=[@ANYRES32=r5, @ANYRES32=r3, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x12) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000080)=[{0x0}], 0x1}, 0x4080) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD_XDP-bpf$MAP_CREATE-bpf$LINK_GET_NEXT_ID-bpf$PROG_LOAD-openat$cgroup_pressure-bpf$PROG_LOAD-close-socketpair$unix-bpf$PROG_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM_TAIL_CALL-recvmsg$unix-sendmsg$inet-sendmsg$inet-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000800)=ANY=[@ANYRES32=r5, @ANYRES32=r3, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x12) sendmsg$inet(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000080)=[{0x0}], 0x1}, 0x4080) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-umount2-close_range-read$FUSE-read$eventfd-ioctl$VIDIOC_STREAMON-setsockopt$inet6_tcp_int detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) close_range(r4, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000007c0)={0x2020}, 0x2020) read$eventfd(0xffffffffffffffff, &(0x7f0000002bc0), 0x8) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x8, &(0x7f0000000000)=0x8, 0x4) program crashed: KASAN: slab-use-after-free Write in binder_add_device single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-umount2-close_range-read$FUSE-read$eventfd-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) close_range(r4, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000007c0)={0x2020}, 0x2020) read$eventfd(0xffffffffffffffff, &(0x7f0000002bc0), 0x8) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-umount2-close_range-read$FUSE-read$eventfd detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) close_range(r4, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000007c0)={0x2020}, 0x2020) read$eventfd(0xffffffffffffffff, &(0x7f0000002bc0), 0x8) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-umount2-close_range-read$FUSE-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) close_range(r4, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000007c0)={0x2020}, 0x2020) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-umount2-close_range-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binderfs_evict_inode testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-setns-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-openat$binderfs-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) syz_pidfd_open(r5, 0x0) r6 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r7 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r6) r9 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r7, r8, r9}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-keyctl$dh_compute-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) r10 = add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000011c0)={r8, r9, r10}, 0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001300)={'sha1-avx\x00'}}) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-add_key$user-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) add_key$user(&(0x7f0000000180), &(0x7f00000010c0)={'syz', 0x3}, &(0x7f0000001100)="ae30d8455a5e46cd8f84c0bae62a95ea8c96f5adf17e7cd2c3c1e18782418cff1e9b7337266405afe00441e08eb8d25df02a9b6d6b403af0be4d0cb5f38ed4ebf952cd5dfb408580ebf14ec67c9218eab93d76e1378f24792c2630c93364c39c516012407ae90ccfcf6747ae89dd1b6ac784d0f2e5b387e2000000005e130319b94e61724104a80c80e59c469038053500"/157, 0x9d, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-add_key$user-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) add_key$user(&(0x7f0000000100), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000004b80)="8f129a622e6230ee26e092c9f46b6e7b08730a31d78b77a831d1ddd5b07c9b5ec02095f97c57f3132bf37fb75e621b1f8ac180cc4d60fc03ab1239466f32711bd6b700eacd5430ed84c8115fe12dfa1961249f630c9a7e9443be1b19a608e8c9546409690d363ea4901d234603ba535b2f41ced38903bdbad73b1259c015a970ae51e0338531499ce3eb8b7431e504271a278611e2250feaf6d702f5dbdf386bfae6df6b2cc4f5cb989a3d4d100e4a550902530af246e397ea9be2f1a2ab6998d3135ed4857b0230918e40aca66ddafb6da75c326abaaf0555f0ed4425ca88674e79a49f1d474ae37e2d88640b8d7f8f1e6b43379077dc2e906930fc6c913a0b810a6677459d312f0b95ab604bf62988560269da87e02de5acf1f7fc559ce365cfae9888d4744e5ff580db5b87e95b0604058a7e40f2556f1acfee9a55f69b27ad12afb424efc404daaa954f26325c1e4a5cd637cf60694e7444cd1a6324edfa380e3380a90d147bc0d160aa32ef42291f086aa890d1004559edc959c078dcf779ef2c8637f1b52649e3db2897472fe821c2cf3a757a7fad03a03ae4174d084a16a39096795658fbee4037769353449dfff7b5e7e910a371035f330975eb46c9e39f73d4203e215934fb9c9f24d52c3c2fd1c6f5cc504bb267ba7e351c033fde8327fbd84b640936dcaca7facae9264e0fd8e33a4c3a8b0f5a0728a4138f1db9bf5826b468a266ed1e9f2b3acd5c6875aca5651785fdc52a7b8db08ce4ee8419a7ce2b161af9d9e3e1ae1497dcabee222bfa29b14faf72d5afd8c4559b3cd6a42c0c8c2f2c6982b90ab95cbd94e4e7648c0d1198ed97425a99fa333c1ec54342fed2d916316bf6d3f0ef39a8ea8961be4e398255d5bdef4d412495fb7971e140055d7ebd90161e9181402b6c9a1c33345e284730626178788bd98dc53cf37c9b3fbf7d60e89864ba9228821584190e46974bd55bada819025e847a59a2c8abe64eb292fd60e3b8949b80fc607adca387d20b30135ec45e8e74d7497449879e77afe779ff3603a4aaee7f575b5d85cbb5b181418131b78fd5a6bc2ee565ee6d1dd3db413fe86f47a68eda3516eb44da707d78b5b2743873a92e8ed84eaf59448f00fa76a070941360c3ebb874ff1bd85fb956c7a047bedc1bbbf40f160b7b1504146bffb5c8c69c1ce91f24a3241ed0aca977774d00e7931d684a137405cfcf45a210c9c5d3c4caf79fcd59d1c54c65491fb4639a01689b4f859f1312b8c1b8140a96f77e02c6b4eca3dd07facb280a691479acddb211f17a196b9b32719fa6b174517eb74a324f13cd8275b5724fa230bf2e84823b932eb4e1c584a05fe0ef4615f8b524d0f275376683727591b1fc2b8f5bc60ebd314462c68bc3268083464c18a40b756d4c8eb74fedb341ed38b424aea19ca0481adecc4235af407c1f55062b2c01ee85d2f173ecf3c479fc087e04972a333c2e28a6be39e11ed216e3f9c15a8d1c27b5d46c7d1f19d4a1324ecd19af3f1bd0d46c31b3849918f4a3d1e2cd2c09a27907013d1237be33ed993377ee5078753591746d97e7d34672b3fd010b144bdd646ba012cdeac4b38921aa35e7cb9fd6f441617457db8e51727893787b64198e477bb07c322c318e363eb2ea6963b909cd2dda8a0988e0b3ac27d8b439967efc66e86b6eaf0efe52ffbe7fb03f9e0c94d85145658b3193c5b7b44529b9622a2557722acdd79e6a2643ef9863a610af4e8ae1c040b65bfb7eece773f101880e185724dcc2c5a3f2f75d42b3b7a5755fd46ed7e6c41a91ddb3f03569d3f3e42c018538add470f5c44a33598b66ec510088af96a2d450f8674d6741a7efcdb62a28941fe6bd423e364299aeba6acccc8ba17bec1463e054698d1d29d0c67c00293f52d379171f33dcf4757a6f86934f6d8bd33196d7e3ce66a498db07514aca92b85da5d91afb711ce932b68d6e7f84c9fe529cdf4a405bc31362e2653a35e1423f478854c138439303518e50f231d12bb9d50557cb38263b4899b253b7ffd5626fd193ca98658f32fb0202daf77328ac84d8cbf7845db10dcbfd4d7b89d6f9217258cf8dc4534f68d2679c1b3c05598a648a03198e486dc6c427bf0e7a5376b17cde04a7ac6d3c072d505196ade49363f64a14f1dd057b35eccb681656dc303e2469fce8642cf6f3161fa026f9929c06922540d89a932268af3d186661b5367a64aa1449d17ce5062458a10bd93ad36adcdf183ed27f297d39e5c5634983cd025cc21cf5078271d7000ec77bcbb3ce08aa7b56ddf4751d9dc9876db2465a54e21c7095cf75b1c0505b10a5220ac3d792dfa0a15a0ce875fecee6864b9854dd90ee0015b04fc90ca0f1b426085d6a5a306545b1af7ee975fd1214b4b90846d15b88a722711e1e3b73a5c1d7436903f65a29e1cd294207784a9701460161de466f1f37d5cd0398a98ff5e5854048749aadaa9302057490f2255c13c911731794aafddc1e7c94f262fc0d40d73c41a68404e8bb90ee11102745d55b2adb9f35c446101d22c82b7383779bd437d6c564da833ee2e8ad2703388acc676506b22b2562bd466a6991fdbd47bf2267e53dff205cbd534377efe12b33910618e2c235365256c45209405b8d41d45dc28829ecef5a9fa4484c017cd1f9e5e6cec150cf5aab0a29c9822ce9843c4c", 0x76b, r7) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-add_key$user-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='\v', 0x1, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-add_key$keyring-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) r6 = syz_pidfd_open(r5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-sendmsg$NFNL_MSG_CTHELPER_GET-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') getpid() sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="c8010000010905000000000000000000020000030e00048008000140000000032c00020014000180080001000000000008000200ac1414bb1400018008000100ac1414aa08000200ac1e0101080005400000000d5c0002000c00028005000100010000002c00018014000300fc00000000000000000000000000000014020400fc0200000000000000000000000000010c000280050001008400000014000180080001000a01010008000200ac1414aa3800020006000340000200002c0001801400030000000000000000000000ffffac14140814000400fe8000000000000000000000000000aa08000340000000077800020006000340000300001400018008000100ac1e010108000200ac1414aa0c000280050001003a0000000c00028005000100110000000c000280050010001100000006000340000300002c00018014000300000000000000deffffff00000000000114000400fe8000000000000000000000000000bb600002000c000280050001008a0000000c000004050001002f0000000600034000000000060003400000000006000340000000000c00028005000100110000001400018008000100ac1414aa08000200e00000010c0002800500010021000000"], 0x1c8}, 0x1, 0x0, 0x0, 0x40001}, 0x20040000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(0xffffffffffffffff, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r6, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_open_procfs-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r5 = syz_pidfd_open(0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r5, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-bpf$BPF_RAW_TRACEPOINT_OPEN-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r5, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binderfs_evict_inode testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-bpf$MAP_CREATE_RINGBUF-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[], 0x48) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r5, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-dup3-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) dup3(r1, r2, 0x0) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r5, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-setsockopt$MRT6_FLUSH-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r2, 0x29, 0xd4, &(0x7f0000000080)=0x2, 0x4) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r4, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-setsockopt$MRT6_ADD_MFC_PROXY-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r4, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-socket-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) socket(0xa, 0x3, 0x3a) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r3, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x849}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r3, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-openat$sequencer2-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r3, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r3, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-openat$sndseq-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r2, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-sendmsg$netlink-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x1e, 0x601, 0x100000, 0x0, "", [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@private1}]}, 0x24}], 0x1, 0x0, 0x0, 0x40801}, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r2, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-setsockopt$netlink_NETLINK_DROP_MEMBERSHIP-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r2, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: socket$netlink(0x10, 0x3, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r1, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r1, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program crashed: KASAN: slab-use-after-free Write in binder_add_device testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setns(r1, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r1, 0x24020000) umount2(0x0, 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000140)=0x9) program did not crash testing program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) setns(r1, 0x24020000) umount2(&(0x7f0000000000)='.\x00', 0x2) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, 0x0) program crashed: KASAN: slab-use-after-free Write in binder_add_device extracting C reproducer testing compiled C program (duration=53.235476392s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device simplifying C reproducer testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program did not crash testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program did not crash testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program did not crash testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binderfs_evict_inode testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program did not crash testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binderfs_evict_inode testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program did not crash testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device testing compiled C program (duration=53.235476392s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getpid-syz_pidfd_open-openat$binderfs-setns-umount2-ioctl$VIDIOC_STREAMON program crashed: KASAN: slab-use-after-free Write in binder_add_device reproducing took 1h50m52.801860519s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1026 [inline] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932 Write of size 8 at addr ffff888031a12408 by task syz-executor301/5823 CPU: 1 UID: 0 PID: 5823 Comm: syz-executor301 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xb4/0x290 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 hlist_add_head include/linux/list.h:1026 [inline] binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932 binderfs_binder_device_create+0x8b7/0xaf0 drivers/android/binderfs.c:210 binderfs_fill_super+0xa0e/0xe90 drivers/android/binderfs.c:730 vfs_get_super fs/super.c:1280 [inline] get_tree_nodev+0xbb/0x150 fs/super.c:1299 vfs_get_tree+0x92/0x2b0 fs/super.c:1759 do_new_mount+0x24a/0xa40 fs/namespace.c:3884 do_mount fs/namespace.c:4224 [inline] __do_sys_mount fs/namespace.c:4435 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4412 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fee80b7e68a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 6e 07 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc2210f728 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fee80bbf038 RCX: 00007fee80b7e68a RDX: 00007fee80bbf1c8 RSI: 00007fee80bbf038 RDI: 00007fee80bbf1c8 RBP: 00007fee80bbf198 R08: 0000000000000000 R09: 0000000000000140 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fee80bc4c9c R13: 00007fee80bbf100 R14: 0000000000000001 R15: 0000000000000001 Allocated by task 5821: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] binderfs_binder_device_create+0x17f/0xaf0 drivers/android/binderfs.c:147 binderfs_fill_super+0xa0e/0xe90 drivers/android/binderfs.c:730 vfs_get_super fs/super.c:1280 [inline] get_tree_nodev+0xbb/0x150 fs/super.c:1299 vfs_get_tree+0x92/0x2b0 fs/super.c:1759 do_new_mount+0x24a/0xa40 fs/namespace.c:3884 do_mount fs/namespace.c:4224 [inline] __do_sys_mount fs/namespace.c:4435 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4412 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5829: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x193/0x440 mm/slub.c:4841 binder_free_proc drivers/android/binder.c:5248 [inline] binder_proc_dec_tmpref+0x228/0x4f0 drivers/android/binder.c:1565 binder_deferred_release drivers/android/binder.c:6292 [inline] binder_deferred_func+0x13a5/0x1520 drivers/android/binder.c:6319 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888031a12400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of freed 512-byte region [ffff888031a12400, ffff888031a12600) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31a10 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801a041c80 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801a041c80 0000000000000000 dead000000000001 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffea0000c68401 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 24974876976, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718 prep_new_page mm/page_alloc.c:1726 [inline] get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3688 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301 alloc_slab_page mm/slub.c:2450 [inline] allocate_slab+0x8a/0x3b0 mm/slub.c:2618 new_slab mm/slub.c:2672 [inline] ___slab_alloc+0xbfc/0x1480 mm/slub.c:3858 __slab_alloc mm/slub.c:3948 [inline] __slab_alloc_node mm/slub.c:4023 [inline] slab_alloc_node mm/slub.c:4184 [inline] __do_kmalloc_node mm/slub.c:4326 [inline] __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 mm/slub.c:4346 __do_krealloc mm/slub.c:4904 [inline] krealloc_noprof+0x122/0x330 mm/slub.c:4957 add_sysfs_param+0xc9/0xa20 kernel/params.c:654 kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:811 param_sysfs_builtin+0x1de/0x290 kernel/params.c:850 param_sysfs_builtin_init+0x32/0x40 kernel/params.c:984 do_one_initcall+0x236/0x820 init/main.c:1257 do_initcall_level+0x137/0x1f0 init/main.c:1319 do_initcalls+0x69/0xd0 init/main.c:1335 kernel_init_freeable+0x3d9/0x570 init/main.c:1567 page_owner free stack trace missing Memory state around the buggy address: ffff888031a12300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888031a12380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888031a12400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888031a12480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888031a12500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in hlist_add_head include/linux/list.h:1026 [inline] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932 Write of size 8 at addr ffff888031a12408 by task syz-executor301/5823 CPU: 1 UID: 0 PID: 5823 Comm: syz-executor301 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xb4/0x290 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 hlist_add_head include/linux/list.h:1026 [inline] binder_add_device+0x5f/0xa0 drivers/android/binder.c:6932 binderfs_binder_device_create+0x8b7/0xaf0 drivers/android/binderfs.c:210 binderfs_fill_super+0xa0e/0xe90 drivers/android/binderfs.c:730 vfs_get_super fs/super.c:1280 [inline] get_tree_nodev+0xbb/0x150 fs/super.c:1299 vfs_get_tree+0x92/0x2b0 fs/super.c:1759 do_new_mount+0x24a/0xa40 fs/namespace.c:3884 do_mount fs/namespace.c:4224 [inline] __do_sys_mount fs/namespace.c:4435 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4412 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fee80b7e68a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 6e 07 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc2210f728 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fee80bbf038 RCX: 00007fee80b7e68a RDX: 00007fee80bbf1c8 RSI: 00007fee80bbf038 RDI: 00007fee80bbf1c8 RBP: 00007fee80bbf198 R08: 0000000000000000 R09: 0000000000000140 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fee80bc4c9c R13: 00007fee80bbf100 R14: 0000000000000001 R15: 0000000000000001 Allocated by task 5821: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] binderfs_binder_device_create+0x17f/0xaf0 drivers/android/binderfs.c:147 binderfs_fill_super+0xa0e/0xe90 drivers/android/binderfs.c:730 vfs_get_super fs/super.c:1280 [inline] get_tree_nodev+0xbb/0x150 fs/super.c:1299 vfs_get_tree+0x92/0x2b0 fs/super.c:1759 do_new_mount+0x24a/0xa40 fs/namespace.c:3884 do_mount fs/namespace.c:4224 [inline] __do_sys_mount fs/namespace.c:4435 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4412 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5829: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kfree+0x193/0x440 mm/slub.c:4841 binder_free_proc drivers/android/binder.c:5248 [inline] binder_proc_dec_tmpref+0x228/0x4f0 drivers/android/binder.c:1565 binder_deferred_release drivers/android/binder.c:6292 [inline] binder_deferred_func+0x13a5/0x1520 drivers/android/binder.c:6319 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888031a12400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of freed 512-byte region [ffff888031a12400, ffff888031a12600) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31a10 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801a041c80 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801a041c80 0000000000000000 dead000000000001 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffea0000c68401 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 24974876976, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1d8/0x230 mm/page_alloc.c:1718 prep_new_page mm/page_alloc.c:1726 [inline] get_page_from_freelist+0x21ce/0x22b0 mm/page_alloc.c:3688 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:4970 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2301 alloc_slab_page mm/slub.c:2450 [inline] allocate_slab+0x8a/0x3b0 mm/slub.c:2618 new_slab mm/slub.c:2672 [inline] ___slab_alloc+0xbfc/0x1480 mm/slub.c:3858 __slab_alloc mm/slub.c:3948 [inline] __slab_alloc_node mm/slub.c:4023 [inline] slab_alloc_node mm/slub.c:4184 [inline] __do_kmalloc_node mm/slub.c:4326 [inline] __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 mm/slub.c:4346 __do_krealloc mm/slub.c:4904 [inline] krealloc_noprof+0x122/0x330 mm/slub.c:4957 add_sysfs_param+0xc9/0xa20 kernel/params.c:654 kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:811 param_sysfs_builtin+0x1de/0x290 kernel/params.c:850 param_sysfs_builtin_init+0x32/0x40 kernel/params.c:984 do_one_initcall+0x236/0x820 init/main.c:1257 do_initcall_level+0x137/0x1f0 init/main.c:1319 do_initcalls+0x69/0xd0 init/main.c:1335 kernel_init_freeable+0x3d9/0x570 init/main.c:1567 page_owner free stack trace missing Memory state around the buggy address: ffff888031a12300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888031a12380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888031a12400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888031a12480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888031a12500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================