Extracting prog: 4m21.442277178s
Minimizing prog: 1h0m55.066442473s
Simplifying prog options: 5m3.249871674s
Extracting C: 2m5.842776482s
Simplifying C: 0s


extracting reproducer from 17 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usbip_server_init-socket$inet6_mptcp-setsockopt$inet6_tcp_TCP_CONGESTION-bind$inet6-connect$inet6-setsockopt$inet6_tcp_TCP_CONGESTION-listen-socket$nl_route-socket$inet6_udp-setsockopt$inet6_tcp_TCP_CONGESTION-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-shutdown
detailed listing:
executing program 0:
syz_usbip_server_init(0x4)
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0)
listen(0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='cdg\x00', 0x4)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x0, 0x0, 0x7fffffff}}}}]}, 0x4c}}, 0x0)
shutdown(r0, 0x2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat$proc_mixer-sendmsg$inet6-socket-sendmmsg-recvmmsg
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sendmsg$inet6(0xffffffffffffffff, 0x0, 0x0)
r3 = socket(0x2000000000000021, 0x2, 0x10000000000002)
sendmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0)
recvmmsg(r3, &(0x7f0000000d00), 0xf000, 0x10002, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in l2cap_connect_cfm
single: successfully extracted reproducer
found reproducer with 20 syscalls
minimizing guilty program
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r3=>0x0, &(0x7f00000000c0)=<r4=>0x0)
syz_io_uring_submit(r3, r4, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100), &(0x7f00000000c0))
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, 0x0)
io_uring_enter(0xffffffffffffffff, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r2 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r3=>0x0, &(0x7f00000000c0)=<r4=>0x0)
syz_io_uring_submit(r3, r4, 0x0)
io_uring_enter(r2, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-mmap$IORING_OFF_SQ_RING-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r1, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r2 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r3=>0x0, &(0x7f00000000c0)=<r4=>0x0)
syz_io_uring_submit(r3, r4, 0x0)
io_uring_enter(r2, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in l2cap_connect_cfm
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(0xffffffffffffffff, 0x90004)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r1, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r2 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r3=>0x0, &(0x7f00000000c0)=<r4=>0x0)
syz_io_uring_submit(r3, r4, 0x0)
io_uring_enter(r2, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {0xffffffffffffffff, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, 0x0, 0x0)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in l2cap_connect_cfm
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, 0x0, 0x0)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, 0x0, 0x0)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, 0x0, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, 0x0, &(0x7f00000000c0)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, 0x0)
syz_io_uring_submit(r4, 0x0, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(0x0, 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(0x0, 0x0, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
program did not crash
simplifying guilty program options
testing program (duration=45.996831295s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in l2cap_connect_cfm
validation run: crashed=true
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Read in l2cap_connect_cfm
validation run: crashed=true
testing program (duration=45.996831295s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_CONTINUE-mlock-listen-socket$inet6_tcp-setsockopt$inet6_int-setsockopt$sock_int-sendmmsg$inet6-read$FUSE-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-syz_emit_vhci-ppoll
detailed listing:
executing program 0:
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
r1 = userfaultfd(0x801)
ioctl$UFFDIO_API(r1, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0)
ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, 0x0)
mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000)
listen(r0, 0x90004)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4)
setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000080)=0x40, 0x4)
sendmmsg$inet6(r2, 0x0, 0x0, 0x4000001)
read$FUSE(0xffffffffffffffff, 0x0, 0x0)
r3 = syz_io_uring_setup(0x50e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0xffffffff, 0x1}, &(0x7f0000000100)=<r4=>0x0, &(0x7f00000000c0)=<r5=>0x0)
syz_io_uring_submit(r4, r5, 0x0)
io_uring_enter(r3, 0x567, 0x1000a387, 0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x80}, {r0, 0x60}], 0x2, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)

program did not crash
validation run: crashed=false
reproducing took 1h28m47.011076285s
repro crashed as (corrupted=false):
kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci0: failed to register connection device
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x6df/0x1030 net/bluetooth/l2cap_core.c:7275
Read of size 8 at addr ffff888079ae9480 by task kworker/u5:5/5915

CPU: 1 PID: 5915 Comm: kworker/u5:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xac/0x220 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
 l2cap_connect_cfm+0x6df/0x1030 net/bluetooth/l2cap_core.c:7275
 hci_connect_cfm+0x8f/0x130 include/net/bluetooth/hci_core.h:1970
 le_conn_complete_evt+0xcd0/0x1220 net/bluetooth/hci_event.c:5752
 hci_le_conn_complete_evt+0x187/0x440 net/bluetooth/hci_event.c:5778
 hci_event_func net/bluetooth/hci_event.c:7420 [inline]
 hci_event_packet+0x795/0x1210 net/bluetooth/hci_event.c:7475
 hci_rx_work+0x43a/0xd80 net/bluetooth/hci_core.c:4018
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Allocated by task 5915:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 l2cap_chan_create+0x50/0x760 net/bluetooth/l2cap_core.c:445
 l2cap_sock_alloc net/bluetooth/l2cap_sock.c:1890 [inline]
 l2cap_sock_new_connection_cb+0x182/0x2b0 net/bluetooth/l2cap_sock.c:1469
 l2cap_connect_cfm+0x375/0x1030 net/bluetooth/l2cap_core.c:7258
 hci_connect_cfm+0x8f/0x130 include/net/bluetooth/hci_core.h:1970
 le_conn_complete_evt+0xcd0/0x1220 net/bluetooth/hci_event.c:5752
 hci_le_conn_complete_evt+0x187/0x440 net/bluetooth/hci_event.c:5778
 hci_event_func net/bluetooth/hci_event.c:7420 [inline]
 hci_event_packet+0x795/0x1210 net/bluetooth/hci_event.c:7475
 hci_rx_work+0x43a/0xd80 net/bluetooth/hci_core.c:4018
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

Freed by task 6017:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 l2cap_sock_cleanup_listen+0xea/0x3e0 net/bluetooth/l2cap_sock.c:1452
 l2cap_sock_release+0x6a/0x1e0 net/bluetooth/l2cap_sock.c:1410
 __sock_release net/socket.c:659 [inline]
 sock_close+0xbd/0x230 net/socket.c:1421
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1ce/0x250 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888079ae9000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1152 bytes inside of
 freed 2048-byte region [ffff888079ae9000, ffff888079ae9800)

The buggy address belongs to the physical page:
page:ffffea0001e6ba00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888079aef000 pfn:0x79ae8
head:ffffea0001e6ba00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017842000 ffffea00017a7400 0000000000000002
raw: ffff888079aef000 0000000080080005 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5865, tgid 5865 (syz-executor), ts 95482621919, free_ts 95456972388
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 alloc_slab_page+0x5d/0x170 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2e0 mm/slub.c:2081
 ___slab_alloc+0xc6d/0x1300 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x1a2/0x260 mm/slub.c:3534
 __do_kmalloc_node mm/slab_common.c:1006 [inline]
 __kmalloc+0xa4/0x240 mm/slab_common.c:1020
 kmalloc include/linux/slab.h:604 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 ipt_alloc_initial_table+0x6e/0x610 net/ipv4/netfilter/ip_tables.c:36
 iptable_mangle_table_init+0x1b/0x60 net/ipv4/netfilter/iptable_mangle.c:88
 xt_find_table_lock+0x306/0x3e0 net/netfilter/x_tables.c:1259
 xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1284
 get_info net/ipv4/netfilter/ip_tables.c:963 [inline]
 do_ipt_get_ctl+0x729/0x1140 net/ipv4/netfilter/ip_tables.c:1659
 nf_getsockopt+0x262/0x280 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x1c1/0x210 net/ipv4/ip_sockglue.c:1790
 do_sock_getsockopt+0x368/0x440 net/socket.c:2384
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc+0x11e/0x2e0 mm/slub.c:3519
 getname_flags+0xbb/0x500 fs/namei.c:140
 getname fs/namei.c:219 [inline]
 __do_sys_mkdirat fs/namei.c:4151 [inline]
 __se_sys_mkdirat fs/namei.c:4149 [inline]
 __x64_sys_mkdirat+0x7c/0xa0 fs/namei.c:4149
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff888079ae9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888079ae9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888079ae9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888079ae9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888079ae9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci0: failed to register connection device
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x6df/0x1030 net/bluetooth/l2cap_core.c:7275
Read of size 8 at addr ffff888079ae9480 by task kworker/u5:5/5915

CPU: 1 PID: 5915 Comm: kworker/u5:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xac/0x220 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
 l2cap_connect_cfm+0x6df/0x1030 net/bluetooth/l2cap_core.c:7275
 hci_connect_cfm+0x8f/0x130 include/net/bluetooth/hci_core.h:1970
 le_conn_complete_evt+0xcd0/0x1220 net/bluetooth/hci_event.c:5752
 hci_le_conn_complete_evt+0x187/0x440 net/bluetooth/hci_event.c:5778
 hci_event_func net/bluetooth/hci_event.c:7420 [inline]
 hci_event_packet+0x795/0x1210 net/bluetooth/hci_event.c:7475
 hci_rx_work+0x43a/0xd80 net/bluetooth/hci_core.c:4018
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Allocated by task 5915:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
 kmalloc include/linux/slab.h:600 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 l2cap_chan_create+0x50/0x760 net/bluetooth/l2cap_core.c:445
 l2cap_sock_alloc net/bluetooth/l2cap_sock.c:1890 [inline]
 l2cap_sock_new_connection_cb+0x182/0x2b0 net/bluetooth/l2cap_sock.c:1469
 l2cap_connect_cfm+0x375/0x1030 net/bluetooth/l2cap_core.c:7258
 hci_connect_cfm+0x8f/0x130 include/net/bluetooth/hci_core.h:1970
 le_conn_complete_evt+0xcd0/0x1220 net/bluetooth/hci_event.c:5752
 hci_le_conn_complete_evt+0x187/0x440 net/bluetooth/hci_event.c:5778
 hci_event_func net/bluetooth/hci_event.c:7420 [inline]
 hci_event_packet+0x795/0x1210 net/bluetooth/hci_event.c:7475
 hci_rx_work+0x43a/0xd80 net/bluetooth/hci_core.c:4018
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

Freed by task 6017:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 l2cap_sock_cleanup_listen+0xea/0x3e0 net/bluetooth/l2cap_sock.c:1452
 l2cap_sock_release+0x6a/0x1e0 net/bluetooth/l2cap_sock.c:1410
 __sock_release net/socket.c:659 [inline]
 sock_close+0xbd/0x230 net/socket.c:1421
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1ce/0x250 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888079ae9000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1152 bytes inside of
 freed 2048-byte region [ffff888079ae9000, ffff888079ae9800)

The buggy address belongs to the physical page:
page:ffffea0001e6ba00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888079aef000 pfn:0x79ae8
head:ffffea0001e6ba00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017842000 ffffea00017a7400 0000000000000002
raw: ffff888079aef000 0000000080080005 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5865, tgid 5865 (syz-executor), ts 95482621919, free_ts 95456972388
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 alloc_slab_page+0x5d/0x170 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2e0 mm/slub.c:2081
 ___slab_alloc+0xc6d/0x1300 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x1a2/0x260 mm/slub.c:3534
 __do_kmalloc_node mm/slab_common.c:1006 [inline]
 __kmalloc+0xa4/0x240 mm/slab_common.c:1020
 kmalloc include/linux/slab.h:604 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 ipt_alloc_initial_table+0x6e/0x610 net/ipv4/netfilter/ip_tables.c:36
 iptable_mangle_table_init+0x1b/0x60 net/ipv4/netfilter/iptable_mangle.c:88
 xt_find_table_lock+0x306/0x3e0 net/netfilter/x_tables.c:1259
 xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1284
 get_info net/ipv4/netfilter/ip_tables.c:963 [inline]
 do_ipt_get_ctl+0x729/0x1140 net/ipv4/netfilter/ip_tables.c:1659
 nf_getsockopt+0x262/0x280 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x1c1/0x210 net/ipv4/ip_sockglue.c:1790
 do_sock_getsockopt+0x368/0x440 net/socket.c:2384
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc+0x11e/0x2e0 mm/slub.c:3519
 getname_flags+0xbb/0x500 fs/namei.c:140
 getname fs/namei.c:219 [inline]
 __do_sys_mkdirat fs/namei.c:4151 [inline]
 __se_sys_mkdirat fs/namei.c:4149 [inline]
 __x64_sys_mkdirat+0x7c/0xa0 fs/namei.c:4149
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff888079ae9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888079ae9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888079ae9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888079ae9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888079ae9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================