Extracting prog: 7m57.440031242s Minimizing prog: 46m19.154393121s Simplifying prog options: 0s Extracting C: 1m43.194968117s Simplifying C: 21m28.301344492s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$can_bcm-socket$netlink-mbind-prlimit64-sched_setscheduler-getpid-syz_init_net_socket$nl_generic-sendmsg$NFC_CMD_GET_TARGET-syz_genetlink_get_family_id$nfc-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_NEW_INTERFACE-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$BPF_RAW_TRACEPOINT_OPEN-capset-socket-mremap-mbind-openat$adsp1-socket-sendmsg$nl_route-setsockopt$inet_opts-setsockopt$SO_TIMESTAMPING-sendmmsg$inet6-recvmmsg detailed listing: executing program 0: sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x40000000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r1) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\t\x00', @ANYRES16=r2, @ANYBLOB="010060000000000000001e0000000a0004"], 0x28}, 0x1, 0x0, 0x0, 0x8d0}, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) capset(0x0, 0x0) socket(0x9, 0x2, 0xff) mremap(&(0x7f0000c41000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00004c3000/0x3000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES16], 0x40}, 0x1, 0x0, 0x0, 0x44881}, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000380)='\a', 0x1) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x12141, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x4000}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x5}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-openat$ptmx-ppoll-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-write$binfmt_aout-ioctl$TCSETS-syz_open_pts-dup3-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x129c81, 0x0) ppoll(&(0x7f0000000140)=[{r2}], 0x1, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000840)=ANY=[@ANYRESHEX=r0, @ANYRES64=r2, @ANYRESHEX=r1, @ANYBLOB="7d19942d0a1c9457a094f5615ad77d0ae517b12c0f9b059388b2ea96d1950c7eaa68fd9edbb6e612a2e0cde204cddfa76fbe20802c149db262be49ba6e456da7b08e0cd51214f914c5f1f871d1fdbfd6f0c89077ff45a532b123d996ddd8b8e2baf116eb25d74ea01f770d211f03963b5eb16761e7fd", @ANYRES64, @ANYRESDEC=r0], &(0x7f0000000e00)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r3}, 0x10) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000200)={0x0, 0x0, 0x6, 0x8, 0x1, "42341f9b1000007e4f00"}) r4 = syz_open_pts(r2, 0x0) dup3(r4, r2, 0x0) splice(r2, 0x0, r1, 0x0, 0x7ffff000, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-read$FUSE-setgid-prctl$PR_SET_SECUREBITS-openat-mmap$IORING_OFF_SQ_RING-mbind-fsetxattr$system_posix_acl-socket-openat$fb0-setsockopt$MRT6_ADD_MIF detailed listing: executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/protocols\x00') read$FUSE(r0, &(0x7f00000006c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) setgid(r1) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000b, 0x59033, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="020000000100010000000000040001000000000008000200", @ANYRES32=0x0, @ANYBLOB="10000200000000e71f00000078fcd3c1"], 0x2c, 0x2) r3 = socket(0x11, 0x3, 0x3a) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x4a0480, 0x0) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xd1, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile-syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-readv detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_procs(r10, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r11, &(0x7f00000001c0), 0x12) readv(r9, &(0x7f0000000300)=[{&(0x7f0000000580)=""/153, 0x99}], 0x1) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init single: successfully extracted reproducer found reproducer with 28 syscalls minimizing guilty program testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile-syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_procs(r10, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r11, &(0x7f00000001c0), 0x12) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile-syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r10, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile-syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_root detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile-syz_usb_connect-mkdirat$cgroup_root detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile-syz_usb_connect detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0xb5, 0x40, 0x33, 0x40, 0x1a86, 0x7522, 0x3536, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe4, 0xd6, 0x24}}]}}]}}, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs-sendfile detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) r9 = openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x2) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = dup(r4) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f00000003c0)={0x1, r5}) openat$cgroup_procs(r3, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND-ioctl$VHOST_NET_SET_BACKEND detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = dup(r3) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r5, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000000b00)) r7 = dup(r6) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f0000000000)={0x1, r7}) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f00000003c0)={0x1, r4}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup-ioctl$VHOST_NET_SET_BACKEND detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000b00)) r6 = dup(r5) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000000)={0x1, r6}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000b00)) dup(r5) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet-ioctl$VHOST_SET_MEM_TABLE detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000b00)) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR-socket$packet detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) socket$packet(0x11, 0x3, 0x300) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_VRING_ADDR detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000740)=""/51, 0x0}) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet-ioctl$int_in detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup-openat$vnet detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) openat$vnet(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet-dup detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) dup(r3) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$packet detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$packet(0x11, 0x3, 0x300) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid-bpf$BPF_TASK_FD_QUERY detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs-write$cgroup_pid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-syz_usb_control_io$printer detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x20, 0xd, 0xd2, {0xd2, 0x12, "0850ea13134c945b368d6dbd8fa79d47573c7810d988d6c7f514a005b4da7c0bace26fc5503cd50a94a75949ab7520b0363b744ac2876bd76ffc6c03f1a4fddf1bcc1af33901bf31aa9613428409830acdf130b18870b66b4e6b98ba9a5ab958f9aa632dcd54952579adb3bc379ea1b95d507508804798578e8fa16f42663c7af5d9140fc4b08b0cc71e5f71927be1fa43e4d543dae9143481049a4dec72f167822e4023b76cdb3938dce0927b8408ae72c95f32bc696c28b2757e500211854490c6c2c25cc3b369ec3e7fc734472918"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}}, &(0x7f0000000500)={0x34, &(0x7f0000000380)={0x0, 0xa09e77dbfce10af0, 0x13, "6a2d6d45679d7a54ab1b7392d40e15fe33bb6d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000640)={0x20, 0x0, 0xe2, {0xe0, "32f2ff5f2228e63e8f6427a3d4e49786d9e07aca7712f4561b3869a27cf6a63f03e8e29f16bfd0e368a90012ceaf8e59071d8408aa25a039f184cbaf90faa156a38705f7657277f3e63f6a59b84d1356be62147a3d4573369ab8329bbb244cdcbe33ee6f6d26274b6461f3c0ebd40456c7b239ccda4ba00abd9c7a1d5c51370839f5307361a42e474e4a0930206c5d143a8968848f944c540e0a703a1fd0f5778ca1d91f334fa1ebb647b3299077315da033f103c4a673704c0b7e486f62130844ca04061dd06eae0f3bdf95be9ec6a916e21e7b23e00bc50318a1bcc7d0404e"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x10}, &(0x7f00000004c0)={0x20, 0x0, 0x1}}) program did not crash testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program did not crash testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: syz_usb_connect(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program did not crash testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x19, 0x82, 0x30, 0x20, 0x413, 0x6023, 0xece5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x60, 0x2, [{{0x9, 0x4, 0x84, 0x0, 0x1, 0xee, 0x48, 0xb1, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0xb}}]}}]}}]}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init extracting C reproducer testing compiled C program (duration=1m23.199847372s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init simplifying C reproducer testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program did not crash testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program did not crash testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program did not crash testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init testing compiled C program (duration=1m23.199847372s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mkdirat$cgroup_root-openat$cgroup_procs program crashed: KASAN: slab-use-after-free Read in v4l2_fh_init reproducing took 1h17m28.090761111s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 Read of size 8 at addr ffff8880740cc738 by task v4l_id/6067 CPU: 0 UID: 0 PID: 6067 Comm: v4l_id Not tainted 6.13.0-rc1-syzkaller-00036-g5076001689e4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 v4l2_fh_open+0x83/0xc0 drivers/media/v4l2-core/v4l2-fh.c:63 em28xx_v4l2_open+0x250/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2153 v4l2_open+0x222/0x490 drivers/media/v4l2-core/v4l2-dev.c:429 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0xf59/0x1ea0 fs/open.c:945 vfs_open+0x82/0x3f0 fs/open.c:1075 do_open fs/namei.c:3828 [inline] path_openat+0x1e6a/0x2d60 fs/namei.c:3987 do_filp_open+0x20c/0x470 fs/namei.c:4014 do_sys_openat2+0x17a/0x1e0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_openat fs/open.c:1433 [inline] __se_sys_openat fs/open.c:1428 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1428 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc5203929a4 Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffd0bae6de0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007ffd0bae6ff8 RCX: 00007fc5203929a4 RDX: 0000000000000000 RSI: 00007ffd0bae7f1d RDI: 00000000ffffff9c RBP: 00007ffd0bae7f1d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd0bae7010 R14: 000055b67ee29670 R15: 00007fc520555a80 Allocated by task 5854: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] em28xx_v4l2_init+0x114/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2532 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 5854: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x14f/0x4b0 mm/slub.c:4746 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x22a4/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2901 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff8880740cc000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 1848 bytes inside of freed 8192-byte region [ffff8880740cc000, ffff8880740ce000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x740c8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042280 ffffea0000c1c800 0000000000000002 raw: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042280 ffffea0000c1c800 0000000000000002 head: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0001d03201 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5818, tgid 5818 (syz-executor345), ts 66519340816, free_ts 57904281250 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2408 [inline] allocate_slab mm/slub.c:2574 [inline] new_slab+0x2c9/0x410 mm/slub.c:2627 ___slab_alloc+0xdac/0x1870 mm/slub.c:3815 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] __kmalloc_cache_noprof+0xfa/0x410 mm/slub.c:4309 kmalloc_noprof include/linux/slab.h:901 [inline] audit_log_d_path+0xce/0x1e0 kernel/audit.c:2149 dump_common_audit_data security/lsm_audit.c:224 [inline] common_lsm_audit+0x645/0x2250 security/lsm_audit.c:458 slow_avc_audit+0x17d/0x210 security/selinux/avc.c:773 avc_audit security/selinux/include/avc.h:127 [inline] avc_has_perm+0x18d/0x1c0 security/selinux/avc.c:1191 inode_has_perm+0x168/0x1d0 security/selinux/hooks.c:1676 path_has_perm security/selinux/hooks.c:1708 [inline] selinux_mount+0x2f5/0x380 security/selinux/hooks.c:2767 security_sb_mount+0xc8/0x260 security/security.c:1564 path_mount+0x129/0x1f20 fs/namespace.c:3776 page last free pid 5799 tgid 5799 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 __folio_put+0x32a/0x450 mm/swap.c:112 folio_put include/linux/mm.h:1488 [inline] put_page+0x21e/0x280 include/linux/mm.h:1560 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:484 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:565 ksys_read+0x207/0x250 fs/read_write.c:708 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880740cc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880740cc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880740cc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880740cc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880740cc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 Read of size 8 at addr ffff8880740cc738 by task v4l_id/6067 CPU: 0 UID: 0 PID: 6067 Comm: v4l_id Not tainted 6.13.0-rc1-syzkaller-00036-g5076001689e4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 v4l2_fh_init+0x27d/0x2c0 drivers/media/v4l2-core/v4l2-fh.c:25 v4l2_fh_open+0x83/0xc0 drivers/media/v4l2-core/v4l2-fh.c:63 em28xx_v4l2_open+0x250/0x7e0 drivers/media/usb/em28xx/em28xx-video.c:2153 v4l2_open+0x222/0x490 drivers/media/v4l2-core/v4l2-dev.c:429 chrdev_open+0x237/0x6a0 fs/char_dev.c:414 do_dentry_open+0xf59/0x1ea0 fs/open.c:945 vfs_open+0x82/0x3f0 fs/open.c:1075 do_open fs/namei.c:3828 [inline] path_openat+0x1e6a/0x2d60 fs/namei.c:3987 do_filp_open+0x20c/0x470 fs/namei.c:4014 do_sys_openat2+0x17a/0x1e0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_openat fs/open.c:1433 [inline] __se_sys_openat fs/open.c:1428 [inline] __x64_sys_openat+0x175/0x210 fs/open.c:1428 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc5203929a4 Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffd0bae6de0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007ffd0bae6ff8 RCX: 00007fc5203929a4 RDX: 0000000000000000 RSI: 00007ffd0bae7f1d RDI: 00000000ffffff9c RBP: 00007ffd0bae7f1d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd0bae7010 R14: 000055b67ee29670 R15: 00007fc520555a80 Allocated by task 5854: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] em28xx_v4l2_init+0x114/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2532 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 5854: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kfree+0x14f/0x4b0 mm/slub.c:4746 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x22a4/0x4050 drivers/media/usb/em28xx/em28xx-video.c:2901 em28xx_init_extension+0x137/0x200 drivers/media/usb/em28xx/em28xx-core.c:1117 request_module_async+0x61/0x70 drivers/media/usb/em28xx/em28xx-cards.c:3457 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff8880740cc000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 1848 bytes inside of freed 8192-byte region [ffff8880740cc000, ffff8880740ce000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x740c8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042280 ffffea0000c1c800 0000000000000002 raw: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042280 ffffea0000c1c800 0000000000000002 head: 0000000000000000 0000000080020002 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0001d03201 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5818, tgid 5818 (syz-executor345), ts 66519340816, free_ts 57904281250 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2408 [inline] allocate_slab mm/slub.c:2574 [inline] new_slab+0x2c9/0x410 mm/slub.c:2627 ___slab_alloc+0xdac/0x1870 mm/slub.c:3815 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] __kmalloc_cache_noprof+0xfa/0x410 mm/slub.c:4309 kmalloc_noprof include/linux/slab.h:901 [inline] audit_log_d_path+0xce/0x1e0 kernel/audit.c:2149 dump_common_audit_data security/lsm_audit.c:224 [inline] common_lsm_audit+0x645/0x2250 security/lsm_audit.c:458 slow_avc_audit+0x17d/0x210 security/selinux/avc.c:773 avc_audit security/selinux/include/avc.h:127 [inline] avc_has_perm+0x18d/0x1c0 security/selinux/avc.c:1191 inode_has_perm+0x168/0x1d0 security/selinux/hooks.c:1676 path_has_perm security/selinux/hooks.c:1708 [inline] selinux_mount+0x2f5/0x380 security/selinux/hooks.c:2767 security_sb_mount+0xc8/0x260 security/security.c:1564 path_mount+0x129/0x1f20 fs/namespace.c:3776 page last free pid 5799 tgid 5799 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 __folio_put+0x32a/0x450 mm/swap.c:112 folio_put include/linux/mm.h:1488 [inline] put_page+0x21e/0x280 include/linux/mm.h:1560 anon_pipe_buf_release+0x11a/0x240 fs/pipe.c:128 pipe_buf_release include/linux/pipe_fs_i.h:219 [inline] pipe_update_tail fs/pipe.c:224 [inline] pipe_read+0x641/0x13f0 fs/pipe.c:344 new_sync_read fs/read_write.c:484 [inline] vfs_read+0xa4c/0xbe0 fs/read_write.c:565 ksys_read+0x207/0x250 fs/read_write.c:708 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880740cc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880740cc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880740cc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880740cc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880740cc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================