Extracting prog: 2m30.708763107s
Minimizing prog: 52m25.047711225s
Simplifying prog options: 0s
Extracting C: 29.769906731s
Simplifying C: 10m58.785429547s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_tty_fops_tty_io-openat$auto_snd_ctl_f_ops_control-socket$nl_generic-close_range$auto-sendmsg$auto_SMC_NETLINK_GET_DEV_SMCD-openat$auto_ftrace_system_enable_fops_trace_events
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC0\x00', 0x40000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_SMC_NETLINK_GET_DEV_SMCD(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000004340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000", @ANYRES16=0x0, @ANYRESDEC], 0x14}, 0x1, 0x0, 0x0, 0x4c011}, 0x810)
openat$auto_ftrace_system_enable_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/tracing/events/vmalloc/enable\x00', 0x1, 0x0)

program crashed: BUG: Bad rss-counter state
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_tty_fops_tty_io-openat$auto_snd_ctl_f_ops_control-socket$nl_generic-close_range$auto-sendmsg$auto_SMC_NETLINK_GET_DEV_SMCD
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC0\x00', 0x40000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)
sendmsg$auto_SMC_NETLINK_GET_DEV_SMCD(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000004340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000", @ANYRES16=0x0, @ANYRESDEC], 0x14}, 0x1, 0x0, 0x0, 0x4c011}, 0x810)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_tty_fops_tty_io-openat$auto_snd_ctl_f_ops_control-socket$nl_generic-close_range$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC0\x00', 0x40000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
close_range$auto(0x2, 0x8, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_tty_fops_tty_io-openat$auto_snd_ctl_f_ops_control-socket$nl_generic
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC0\x00', 0x40000, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_tty_fops_tty_io-openat$auto_snd_ctl_f_ops_control
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)
openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC0\x00', 0x40000, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto-openat$auto_tty_fops_tty_io
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)
openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto-sendmmsg$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)
sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto-sendmmsg$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)
sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto-recvmmsg$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})
recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto-select$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)
select$auto(0x6, &(0x7f0000000000)={[0x5, 0x4, 0x4, 0xa, 0xccf9, 0x9, 0xffffffffffffffff, 0x3, 0xb, 0x1, 0x100000000000000, 0x3, 0xfffffffffffffe8f, 0x3, 0x40000000000005, 0xfffffffffffffff5]}, &(0x7f0000000100)={[0x8, 0x200000000005, 0x7, 0x7, 0x8, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x9, 0x3, 0xfffffffffffff954, 0xfffffffffffffffc, 0xfff]}, 0x0, &(0x7f0000000080)={0x1ff, 0x401})

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH-sendfile$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)
sendfile$auto(0x1, 0x3, 0x0, 0x6)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto-fsconfig$auto_FSCONFIG_SET_PATH
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
fsconfig$auto_FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x0, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal-prctl$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto-openat$auto_kernfs_file_fops_kernfs_internal
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)
openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x60204, 0x0)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto-sendmmsg$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)
sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})

program did not crash
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-openat$auto_proc_pid_maps_operations_internal-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program did not crash
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-socket-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
socket(0x2, 0x3, 0x100)
ioctl$auto_PROCMAP_QUERY(0xffffffffffffffff, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program did not crash
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-close_range$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
close_range$auto(0x2, 0x8, 0x0)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-connect$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program did not crash
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-socket-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
socket(0x2, 0x2, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-read$auto_kernfs_file_fops_kernfs_internal-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000002140)=""/4106, 0xfffffffffffffd1b)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-socketpair$auto-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-utimensat$auto-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
utimensat$auto(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)={0x4000000006, 0x40}, 0x38)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r1 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r1, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-prctl$auto-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x2, 0x400008, 0xdf, 0x9b72, 0x2, 0x10000000008000)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_seq_oss_f_ops_seq_oss-mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4082, 0x0)
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, 0x0, 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program did not crash
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, 0x0)
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program did not crash
extracting C reproducer
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
simplifying C reproducer
testing compiled C program (duration=45.009152427s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program did not crash
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program did not crash
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
testing compiled C program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
program crashed: BUG: Bad rss-counter state
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
validation run: crashed=true
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: BUG: Bad rss-counter state
validation run: crashed=true
testing program (duration=45.009152427s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-openat$auto_proc_pid_maps_operations_internal-ioctl$auto_PROCMAP_QUERY-clone$auto
detailed listing:
executing program 0:
mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000)
r0 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/maps\x00', 0x40302, 0x0)
ioctl$auto_PROCMAP_QUERY(r0, 0xc0686611, &(0x7f0000000080)={0x101, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x800, 0x101, 0x5, 0x207f93, 0xfffffffe, 0x7ffffffd, 0x3, 0x7, 0x5})
clone$auto(0x2000020003b4a, 0x6, 0x0, 0x0, 0x103)

program crashed: KASAN: slab-use-after-free Read in mas_walk
validation run: crashed=true
reproducing took 1h12m20.396683254s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in ma_dead_node lib/maple_tree.c:572 [inline]
BUG: KASAN: slab-use-after-free in mte_dead_node lib/maple_tree.c:587 [inline]
BUG: KASAN: slab-use-after-free in mas_start lib/maple_tree.c:1207 [inline]
BUG: KASAN: slab-use-after-free in mas_state_walk lib/maple_tree.c:3291 [inline]
BUG: KASAN: slab-use-after-free in mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
Read of size 8 at addr ffff888078907400 by task syz.0.18/6008

CPU: 0 UID: 0 PID: 6008 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x156/0x4c9 mm/kasan/report.c:482
 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
 ma_dead_node lib/maple_tree.c:572 [inline]
 mte_dead_node lib/maple_tree.c:587 [inline]
 mas_start lib/maple_tree.c:1207 [inline]
 mas_state_walk lib/maple_tree.c:3291 [inline]
 mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
 lock_vma_under_rcu+0x101/0x5a0 mm/mmap_lock.c:253
 do_user_addr_fault+0x41f/0x12f0 arch/x86/mm/fault.c:1325
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x342000
Code: Unable to access opcode bytes at 0x341fd6.
RSP: 002b:000000000000000e EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007ff2e4816090 RCX: 00007ff2e459bf79
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0002000020003b4a
RBP: 00007ff2e46327e0 R08: 0000000000000103 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff2e4816128 R14: 00007ff2e4816090 R15: 00007ffc4f622688
 </TASK>

Allocated by task 5934:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4953 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
 mt_alloc_one lib/maple_tree.c:174 [inline]
 mas_dup_build lib/maple_tree.c:6299 [inline]
 __mt_dup+0x5a8/0xc20 lib/maple_tree.c:6382
 dup_mmap+0x36d/0x1e20 mm/mmap.c:1744
 dup_mm kernel/fork.c:1530 [inline]
 copy_mm kernel/fork.c:1582 [inline]
 copy_process+0x7371/0x79b0 kernel/fork.c:2223
 kernel_clone+0xfc/0x930 kernel/fork.c:2654
 __do_sys_clone+0xd9/0x120 kernel/fork.c:2795
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6003:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6674 [inline]
 kfree+0x1c7/0x690 mm/slub.c:6886
 mt_destroy_walk+0xc0a/0xfa0 lib/maple_tree.c:5028
 mte_destroy_walk lib/maple_tree.c:5049 [inline]
 mte_destroy_walk lib/maple_tree.c:5040 [inline]
 __mt_destroy+0x2d7/0x390 lib/maple_tree.c:6446
 exit_mmap+0x5d3/0xae0 mm/mmap.c:1312
 __mmput+0x12a/0x410 kernel/fork.c:1174
 mmput+0x67/0x80 kernel/fork.c:1197
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x78a/0x2a30 kernel/exit.c:959
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 __do_sys_exit_group kernel/exit.c:1123 [inline]
 __se_sys_exit_group kernel/exit.c:1121 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888078907400
 which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
 freed 256-byte region [ffff888078907400, ffff888078907500)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78906
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff34c80 ffffea0000cd3680 0000000000000005
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813ff34c80 ffffea0000cd3680 0000000000000005
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffea0001e24181 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5699, tgid 5699 (rm), ts 81546835733, free_ts 81543034225
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
 prep_new_page mm/page_alloc.c:1892 [inline]
 get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3945
 __alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab mm/slub.c:3248 [inline]
 new_slab+0x2c4/0x440 mm/slub.c:3302
 ___slab_alloc+0xdb3/0x1cb0 mm/slub.c:4656
 __kmem_cache_alloc_bulk+0x20f/0x700 mm/slub.c:7439
 refill_sheaf mm/slub.c:2650 [inline]
 __prefill_sheaf_pfmemalloc+0x42/0x90 mm/slub.c:5328
 kmem_cache_prefill_sheaf+0x1b7/0x420 mm/slub.c:5422
 mt_get_sheaf lib/maple_tree.c:189 [inline]
 mas_alloc_nodes+0x2c3/0x390 lib/maple_tree.c:1140
 mas_preallocate+0x39c/0xf10 lib/maple_tree.c:5194
 vma_iter_prealloc mm/vma.h:505 [inline]
 vma_link+0x12c/0x750 mm/vma.c:1823
 insert_vm_struct+0xf4/0x2d0 mm/vma.c:3288
 __install_special_mapping mm/mmap.c:1460 [inline]
 _install_special_mapping+0x187/0x3d0 mm/mmap.c:1496
 map_vdso+0x1b0/0x560 arch/x86/entry/vdso/vma.c:168
 arch_setup_additional_pages+0x41/0x60 arch/x86/entry/vdso/vma.c:238
page last free pid 5699 tgid 5699 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
 __pagetable_free include/linux/mm.h:3197 [inline]
 pagetable_free include/linux/mm.h:3221 [inline]
 pagetable_dtor_free include/linux/mm.h:3325 [inline]
 __pgd_free include/asm-generic/pgalloc.h:303 [inline]
 _pgd_free arch/x86/mm/pgtable.c:319 [inline]
 pgd_free+0x3f4/0x560 arch/x86/mm/pgtable.c:381
 mm_free_pgd kernel/fork.c:585 [inline]
 __mmdrop+0xe5/0x750 kernel/fork.c:727
 mmdrop include/linux/sched/mm.h:55 [inline]
 __mmput+0x379/0x410 kernel/fork.c:1186
 mmput+0x67/0x80 kernel/fork.c:1197
 exec_mmap fs/exec.c:893 [inline]
 begin_new_exec+0x10f0/0x3840 fs/exec.c:1148
 load_elf_binary+0x8f7/0x5110 fs/binfmt_elf.c:1010
 search_binary_handler fs/exec.c:1664 [inline]
 exec_binprm fs/exec.c:1696 [inline]
 bprm_execve fs/exec.c:1748 [inline]
 bprm_execve+0x8fb/0x1620 fs/exec.c:1724
 do_execveat_common.isra.0+0x4a5/0x580 fs/exec.c:1846
 __do_sys_execve fs/exec.c:1930 [inline]
 __se_sys_execve fs/exec.c:1924 [inline]
 __x64_sys_execve+0x93/0xd0 fs/exec.c:1924
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888078907300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888078907380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888078907400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888078907480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888078907500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in ma_dead_node lib/maple_tree.c:572 [inline]
BUG: KASAN: slab-use-after-free in mte_dead_node lib/maple_tree.c:587 [inline]
BUG: KASAN: slab-use-after-free in mas_start lib/maple_tree.c:1207 [inline]
BUG: KASAN: slab-use-after-free in mas_state_walk lib/maple_tree.c:3291 [inline]
BUG: KASAN: slab-use-after-free in mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
Read of size 8 at addr ffff888078907400 by task syz.0.18/6008

CPU: 0 UID: 0 PID: 6008 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x156/0x4c9 mm/kasan/report.c:482
 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595
 ma_dead_node lib/maple_tree.c:572 [inline]
 mte_dead_node lib/maple_tree.c:587 [inline]
 mas_start lib/maple_tree.c:1207 [inline]
 mas_state_walk lib/maple_tree.c:3291 [inline]
 mas_walk+0x8cf/0x9b0 lib/maple_tree.c:4599
 lock_vma_under_rcu+0x101/0x5a0 mm/mmap_lock.c:253
 do_user_addr_fault+0x41f/0x12f0 arch/x86/mm/fault.c:1325
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x342000
Code: Unable to access opcode bytes at 0x341fd6.
RSP: 002b:000000000000000e EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007ff2e4816090 RCX: 00007ff2e459bf79
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0002000020003b4a
RBP: 00007ff2e46327e0 R08: 0000000000000103 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff2e4816128 R14: 00007ff2e4816090 R15: 00007ffc4f622688
 </TASK>

Allocated by task 5934:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4953 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270
 mt_alloc_one lib/maple_tree.c:174 [inline]
 mas_dup_build lib/maple_tree.c:6299 [inline]
 __mt_dup+0x5a8/0xc20 lib/maple_tree.c:6382
 dup_mmap+0x36d/0x1e20 mm/mmap.c:1744
 dup_mm kernel/fork.c:1530 [inline]
 copy_mm kernel/fork.c:1582 [inline]
 copy_process+0x7371/0x79b0 kernel/fork.c:2223
 kernel_clone+0xfc/0x930 kernel/fork.c:2654
 __do_sys_clone+0xd9/0x120 kernel/fork.c:2795
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6003:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6674 [inline]
 kfree+0x1c7/0x690 mm/slub.c:6886
 mt_destroy_walk+0xc0a/0xfa0 lib/maple_tree.c:5028
 mte_destroy_walk lib/maple_tree.c:5049 [inline]
 mte_destroy_walk lib/maple_tree.c:5040 [inline]
 __mt_destroy+0x2d7/0x390 lib/maple_tree.c:6446
 exit_mmap+0x5d3/0xae0 mm/mmap.c:1312
 __mmput+0x12a/0x410 kernel/fork.c:1174
 mmput+0x67/0x80 kernel/fork.c:1197
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x78a/0x2a30 kernel/exit.c:959
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
 __do_sys_exit_group kernel/exit.c:1123 [inline]
 __se_sys_exit_group kernel/exit.c:1121 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1121
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888078907400
 which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
 freed 256-byte region [ffff888078907400, ffff888078907500)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78906
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff34c80 ffffea0000cd3680 0000000000000005
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813ff34c80 ffffea0000cd3680 0000000000000005
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffea0001e24181 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5699, tgid 5699 (rm), ts 81546835733, free_ts 81543034225
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884
 prep_new_page mm/page_alloc.c:1892 [inline]
 get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3945
 __alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab mm/slub.c:3248 [inline]
 new_slab+0x2c4/0x440 mm/slub.c:3302
 ___slab_alloc+0xdb3/0x1cb0 mm/slub.c:4656
 __kmem_cache_alloc_bulk+0x20f/0x700 mm/slub.c:7439
 refill_sheaf mm/slub.c:2650 [inline]
 __prefill_sheaf_pfmemalloc+0x42/0x90 mm/slub.c:5328
 kmem_cache_prefill_sheaf+0x1b7/0x420 mm/slub.c:5422
 mt_get_sheaf lib/maple_tree.c:189 [inline]
 mas_alloc_nodes+0x2c3/0x390 lib/maple_tree.c:1140
 mas_preallocate+0x39c/0xf10 lib/maple_tree.c:5194
 vma_iter_prealloc mm/vma.h:505 [inline]
 vma_link+0x12c/0x750 mm/vma.c:1823
 insert_vm_struct+0xf4/0x2d0 mm/vma.c:3288
 __install_special_mapping mm/mmap.c:1460 [inline]
 _install_special_mapping+0x187/0x3d0 mm/mmap.c:1496
 map_vdso+0x1b0/0x560 arch/x86/entry/vdso/vma.c:168
 arch_setup_additional_pages+0x41/0x60 arch/x86/entry/vdso/vma.c:238
page last free pid 5699 tgid 5699 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973
 __pagetable_free include/linux/mm.h:3197 [inline]
 pagetable_free include/linux/mm.h:3221 [inline]
 pagetable_dtor_free include/linux/mm.h:3325 [inline]
 __pgd_free include/asm-generic/pgalloc.h:303 [inline]
 _pgd_free arch/x86/mm/pgtable.c:319 [inline]
 pgd_free+0x3f4/0x560 arch/x86/mm/pgtable.c:381
 mm_free_pgd kernel/fork.c:585 [inline]
 __mmdrop+0xe5/0x750 kernel/fork.c:727
 mmdrop include/linux/sched/mm.h:55 [inline]
 __mmput+0x379/0x410 kernel/fork.c:1186
 mmput+0x67/0x80 kernel/fork.c:1197
 exec_mmap fs/exec.c:893 [inline]
 begin_new_exec+0x10f0/0x3840 fs/exec.c:1148
 load_elf_binary+0x8f7/0x5110 fs/binfmt_elf.c:1010
 search_binary_handler fs/exec.c:1664 [inline]
 exec_binprm fs/exec.c:1696 [inline]
 bprm_execve fs/exec.c:1748 [inline]
 bprm_execve+0x8fb/0x1620 fs/exec.c:1724
 do_execveat_common.isra.0+0x4a5/0x580 fs/exec.c:1846
 __do_sys_execve fs/exec.c:1930 [inline]
 __se_sys_execve fs/exec.c:1924 [inline]
 __x64_sys_execve+0x93/0xd0 fs/exec.c:1924
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888078907300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888078907380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888078907400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888078907480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888078907500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================