Extracting prog: 41.183750004s
Minimizing prog: 27m8.686361473s
Simplifying prog options: 0s
Extracting C: 1m1.048914121s
Simplifying C: 20m57.058382926s


extracting reproducer from 10 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
single: successfully extracted reproducer
found reproducer with 15 syscalls
minimizing guilty program
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r2 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r2, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, 0x0)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(0xffffffffffffffff, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r2, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-mount-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mkdirat-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', 0x0, 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(0x0, 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, 0x0, 0x0)

program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: KASAN: use-after-free Read in release_card_device
simplifying C reproducer
testing compiled C program (duration=45.324970273s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: WARNING in release_card_device
a never seen crash title: WARNING in release_card_device, ignore
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
program did not crash
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
validation run: crashed=false
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
validation run: crashed=true
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
validation run: crashed=true
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
validation run: crashed=false
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
validation run: crashed=false
testing program (duration=45.324970273s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$loop-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(0xffffffffffffffff, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: KASAN: use-after-free Read in release_card_device
validation run: crashed=true
reproducing took 58m7.192531692s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:612 [inline]
BUG: KASAN: use-after-free in release_card_device+0x188/0x198 sound/core/init.c:145
Read of size 1 at addr ffff0000d5148d99 by task syz.0.17/4528

CPU: 0 PID: 4528 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 snd_card_do_free sound/core/init.c:612 [inline]
 release_card_device+0x188/0x198 sound/core/init.c:145
 device_release+0x94/0x1b4 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x2a8/0x41c lib/kobject.c:729
 put_device+0x28/0x40 drivers/base/core.c:3820
 snd_card_file_remove+0x2e4/0x340 sound/core/init.c:1147
 snd_pcm_release+0x120/0x14c sound/core/pcm_native.c:2939
 snd_disconnect_release+0x224/0x298 sound/core/init.c:438
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:00000000daf06181 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115148
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc0003bc0008 ffff00019f3890b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d5148c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5148d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d5148d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff0000d5148e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5148e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:612 [inline]
BUG: KASAN: use-after-free in release_card_device+0x188/0x198 sound/core/init.c:145
Read of size 1 at addr ffff0000d5148d99 by task syz.0.17/4528

CPU: 0 PID: 4528 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 snd_card_do_free sound/core/init.c:612 [inline]
 release_card_device+0x188/0x198 sound/core/init.c:145
 device_release+0x94/0x1b4 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x2a8/0x41c lib/kobject.c:729
 put_device+0x28/0x40 drivers/base/core.c:3820
 snd_card_file_remove+0x2e4/0x340 sound/core/init.c:1147
 snd_pcm_release+0x120/0x14c sound/core/pcm_native.c:2939
 snd_disconnect_release+0x224/0x298 sound/core/init.c:438
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:00000000daf06181 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115148
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc0003bc0008 ffff00019f3890b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d5148c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5148d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d5148d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff0000d5148e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5148e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================