Extracting prog: 43.04310424s Minimizing prog: 55m33.418914872s Simplifying prog options: 0s Extracting C: 49.650085617s Simplifying C: 24m8.971042899s extracting reproducer from 58 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-syz_init_net_socket$nl_generic-socket$alg detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r1, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r5 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r6 = openat$cgroup_pressure(r5, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r6, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r6) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r8, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r7, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r3, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) program crashed: KASAN: use-after-free Read in ax25_release single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-syz_init_net_socket$nl_generic detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r1, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r5 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r6 = openat$cgroup_pressure(r5, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r6, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r6) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r8, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r7, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r3, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) program crashed: KASAN: use-after-free Read in ax25_release program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$ifreq_SIOCGIFINDEX_batadv_hard detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r1, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r5 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r6 = openat$cgroup_pressure(r5, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r6, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r6) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r8, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r7, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r3, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r5 = openat$cgroup_pressure(r4, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r5, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r5) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = openat$cgroup_pressure(r3, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r4, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r4) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = openat$cgroup_pressure(r3, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r4, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r4) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @default, @default]}) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r3) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r3) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r3) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_init_net_socket$ax25(0x3, 0x2, 0xcf) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r3) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-close-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) close(r3) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-write$cgroup_pressure-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r3, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-openat$cgroup_pressure-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bpf$BPF_TASK_FD_QUERY-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-socketpair$unix-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-syz_init_net_socket$netrom-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socket$can_raw-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-syz_init_net_socket$bt_sco-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socket$inet6_sctp-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-ioctl$sock_SIOCETHTOOL-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_DEL_DAEMON-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-syz_genetlink_get_family_id$ipvs-socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-ioctl$IMGETDEVINFO-socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x22, 0x2, 0x4) ioctl$IMGETDEVINFO(r0, 0x80044944, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket-socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x22, 0x2, 0x4) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, 0x0, 0x0) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_release simplifying C reproducer testing compiled C program (duration=55.055992336s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: WARNING: refcount bug in ax25_release a never seen crash title: WARNING: refcount bug in ax25_release, ignore testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program did not crash testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program did not crash testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program did not crash testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program did not crash testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=55.055992336s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private program crashed: KASAN: use-after-free Read in ax25_fillin_cb reproducing took 1h21m15.083168557s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] BUG: KASAN: use-after-free in ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 Read of size 4 at addr ffff8880193ac238 by task syz-executor174/4180 CPU: 0 PID: 4180 Comm: syz-executor174 Not tainted 5.15.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Call Trace: dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 ax25_setsockopt+0x8a2/0xa40 net/ax25/af_ax25.c:690 __sys_setsockopt+0x3d6/0x5e0 net/socket.c:2203 __do_sys_setsockopt net/socket.c:2214 [inline] __se_sys_setsockopt net/socket.c:2211 [inline] __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2211 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f07bec8cf49 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f07bec49218 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f07bed17408 RCX: 00007f07bec8cf49 RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000008 RBP: 00007f07bed17400 R08: 0000000000000010 R09: 0000000000000000 R10: 0000200000000000 R11: 0000000000000246 R12: 00007f07bed1740c R13: 00007f07bece37ec R14: 0000200000000000 R15: 0000200000000084 Allocated by task 4174: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:735 [inline] ax25_dev_device_up+0x50/0x580 net/ax25/ax25_dev.c:55 ax25_device_event+0x483/0x4f0 net/ax25/af_ax25.c:139 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391 call_netdevice_notifiers_extack net/core/dev.c:2061 [inline] call_netdevice_notifiers net/core/dev.c:2075 [inline] __dev_notify_flags+0x178/0x2d0 net/core/dev.c:-1 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8928 dev_ifsioc+0x147/0xe70 net/core/dev_ioctl.c:324 dev_ioctl+0x55f/0xe50 net/core/dev_ioctl.c:587 sock_do_ioctl+0x222/0x2f0 net/socket.c:1154 sock_ioctl+0x4ed/0x6e0 net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4177: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0xef/0x2a0 mm/slub.c:4559 ax25_dev_put include/net/ax25.h:302 [inline] ax25_release+0x661/0x870 net/ax25/af_ax25.c:1062 __sock_release net/socket.c:649 [inline] sock_close+0xd5/0x240 net/socket.c:1336 __fput+0x234/0x930 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff8880193ac200 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 56 bytes inside of 192-byte region [ffff8880193ac200, ffff8880193ac2c0) The buggy address belongs to the page: page:ffffea000064eb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x193ac flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888016841a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2543120382, free_ts 0 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192 __alloc_pages+0x1e1/0x470 mm/page_alloc.c:5466 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2031 alloc_slab_page mm/slub.c:1775 [inline] allocate_slab mm/slub.c:1912 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1975 ___slab_alloc+0x81e/0xdf0 mm/slub.c:3008 __slab_alloc mm/slub.c:3095 [inline] slab_alloc_node mm/slub.c:3186 [inline] slab_alloc mm/slub.c:3228 [inline] __kmalloc_track_caller+0x1cb/0x330 mm/slub.c:4925 __do_krealloc mm/slab_common.c:1244 [inline] krealloc+0x5a/0xf0 mm/slab_common.c:1277 add_sysfs_param+0xe8/0x930 kernel/params.c:651 kernel_add_sysfs_param+0xaf/0x120 kernel/params.c:812 param_sysfs_builtin+0x164/0x1e0 kernel/params.c:851 param_sysfs_init+0x66/0x70 kernel/params.c:970 do_one_initcall+0x1ee/0x680 init/main.c:1302 do_initcall_level+0x137/0x1f0 init/main.c:1375 do_initcalls+0x4b/0x90 init/main.c:1391 kernel_init_freeable+0x3ce/0x560 init/main.c:1615 kernel_init+0x19/0x1b0 init/main.c:1506 page_owner free stack trace missing Memory state around the buggy address: ffff8880193ac100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880193ac180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8880193ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880193ac280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880193ac300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] BUG: KASAN: use-after-free in ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 Read of size 4 at addr ffff8880193ac238 by task syz-executor174/4180 CPU: 0 PID: 4180 Comm: syz-executor174 Not tainted 5.15.180-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Call Trace: dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 ax25_setsockopt+0x8a2/0xa40 net/ax25/af_ax25.c:690 __sys_setsockopt+0x3d6/0x5e0 net/socket.c:2203 __do_sys_setsockopt net/socket.c:2214 [inline] __se_sys_setsockopt net/socket.c:2211 [inline] __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2211 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f07bec8cf49 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f07bec49218 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f07bed17408 RCX: 00007f07bec8cf49 RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000008 RBP: 00007f07bed17400 R08: 0000000000000010 R09: 0000000000000000 R10: 0000200000000000 R11: 0000000000000246 R12: 00007f07bed1740c R13: 00007f07bece37ec R14: 0000200000000000 R15: 0000200000000084 Allocated by task 4174: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:735 [inline] ax25_dev_device_up+0x50/0x580 net/ax25/ax25_dev.c:55 ax25_device_event+0x483/0x4f0 net/ax25/af_ax25.c:139 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391 call_netdevice_notifiers_extack net/core/dev.c:2061 [inline] call_netdevice_notifiers net/core/dev.c:2075 [inline] __dev_notify_flags+0x178/0x2d0 net/core/dev.c:-1 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8928 dev_ifsioc+0x147/0xe70 net/core/dev_ioctl.c:324 dev_ioctl+0x55f/0xe50 net/core/dev_ioctl.c:587 sock_do_ioctl+0x222/0x2f0 net/socket.c:1154 sock_ioctl+0x4ed/0x6e0 net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4177: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0xef/0x2a0 mm/slub.c:4559 ax25_dev_put include/net/ax25.h:302 [inline] ax25_release+0x661/0x870 net/ax25/af_ax25.c:1062 __sock_release net/socket.c:649 [inline] sock_close+0xd5/0x240 net/socket.c:1336 __fput+0x234/0x930 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff8880193ac200 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 56 bytes inside of 192-byte region [ffff8880193ac200, ffff8880193ac2c0) The buggy address belongs to the page: page:ffffea000064eb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x193ac flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888016841a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2543120382, free_ts 0 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192 __alloc_pages+0x1e1/0x470 mm/page_alloc.c:5466 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2031 alloc_slab_page mm/slub.c:1775 [inline] allocate_slab mm/slub.c:1912 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1975 ___slab_alloc+0x81e/0xdf0 mm/slub.c:3008 __slab_alloc mm/slub.c:3095 [inline] slab_alloc_node mm/slub.c:3186 [inline] slab_alloc mm/slub.c:3228 [inline] __kmalloc_track_caller+0x1cb/0x330 mm/slub.c:4925 __do_krealloc mm/slab_common.c:1244 [inline] krealloc+0x5a/0xf0 mm/slab_common.c:1277 add_sysfs_param+0xe8/0x930 kernel/params.c:651 kernel_add_sysfs_param+0xaf/0x120 kernel/params.c:812 param_sysfs_builtin+0x164/0x1e0 kernel/params.c:851 param_sysfs_init+0x66/0x70 kernel/params.c:970 do_one_initcall+0x1ee/0x680 init/main.c:1302 do_initcall_level+0x137/0x1f0 init/main.c:1375 do_initcalls+0x4b/0x90 init/main.c:1391 kernel_init_freeable+0x3ce/0x560 init/main.c:1615 kernel_init+0x19/0x1b0 init/main.c:1506 page_owner free stack trace missing Memory state around the buggy address: ffff8880193ac100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880193ac180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8880193ac200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880193ac280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880193ac300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================