Extracting prog: 2m57.536009699s Minimizing prog: 2h2m22.37182863s Simplifying prog options: 6m33.02761612s Extracting C: 4m28.680284576s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-fcntl$lock-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000000)={0x1, 0x0, 0x2, 0x2}) (rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-fcntl$lock-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000000)={0x1, 0x0, 0x2, 0x2}) (rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state single: successfully extracted reproducer found reproducer with 21 syscalls minimizing guilty program testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-fcntl$lock-openat$cgroup_ro-fcntl$lock detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000000)={0x1, 0x0, 0x2, 0x2}) (rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-fcntl$lock-openat$cgroup_ro-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000000)={0x1, 0x0, 0x2, 0x2}) (rerun: 64) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-fcntl$lock-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000000)={0x1, 0x0, 0x2, 0x2}) (rerun: 64) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r3) recvmmsg(r3, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r3, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r4, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r5, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r5, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-recvmmsg-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-syz_genetlink_get_family_id$ethtool-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r4) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r5, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-socket$nl_generic-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(r4, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r5, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-ioctl$sock_SIOCGIFINDEX-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000005c0)={'veth0_macvtap\x00', 0x0}) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r4, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e, r3}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r5, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: stack-out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-connect$inet6-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f00000010c0)={0xa, 0x8, 0x1, @dev={0xfe, 0x80, '\x00', 0x10}, 0x7}, 0x1c) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-openat2$dir-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0xdb) (async, rerun: 32) socket(0x11, 0x3, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: vmalloc-out-of-bounds Read in update_stack_state testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-syz_open_procfs-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r0, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-capset-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) (async, rerun: 32) pread64(0xffffffffffffffff, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r0, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: vmalloc-out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) (rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: stack-out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, 0x0) pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, 0x0, 0x0, 0x4) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0xffffffff}], 0x1, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB="18000000", @ANYRES16=r2, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r3, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, 0x0) (async) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, 0x0, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, 0x0, 0x0, 0x3) write$binfmt_misc(r1, &(0x7f0000000040), 0xfe46) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in unwind_next_frame testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in unwind_next_frame extracting C reproducer testing compiled C program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range program did not crash simplifying guilty program options testing program (duration=3m43.554741504s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash validation run: crashed=false testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash validation run: crashed=false testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state validation run: crashed=true testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in unwind_next_frame validation run: crashed=true testing program (duration=3m43.554741504s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SECCOMP_IOCTL_NOTIF_RECV-syz_open_procfs-pread64-socket$inet6_icmp_raw-socket-syz_genetlink_get_family_id$ethtool-recvmmsg-ioctl$BTRFS_IOC_SCRUB_CANCEL-sendmsg$ETHTOOL_MSG_STRSET_GET-ioctl$sock_inet6_SIOCDELRT-fsetxattr-write$binfmt_misc-openat$cgroup_ro-fcntl$lock-close_range detailed listing: executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') pread64(r0, &(0x7f0000000140)=""/15, 0xf, 0x4) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket(0x11, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9, 0x2, 0x2, 0x0, 0x7, 0x173981a888a898e}) fsetxattr(0xffffffffffffffff, &(0x7f00000001c0)=@random={'user.', 'veth0_macvtap\x00'}, &(0x7f0000000200)='\x00', 0x1, 0x3) write$binfmt_misc(r1, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r2, 0x26, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program crashed: KASAN: out-of-bounds Read in update_stack_state validation run: crashed=true reproducing took 2h29m46.160350085s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline] BUG: KASAN: out-of-bounds in update_stack_state+0x4b0/0x4d0 arch/x86/kernel/unwind_frame.c:248 Read of size 2 at addr ffffc90003cef420 by task syz.3.1153/4064 CPU: 1 UID: 0 PID: 4064 Comm: syz.3.1153 Not tainted syzkaller #0 59fd58dbf897e2c8ba33f91efbb53ce34092dff9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_address_description+0x71/0x210 mm/kasan/report.c:377 print_report+0x4a/0x70 mm/kasan/report.c:481 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379 user_mode arch/x86/include/asm/ptrace.h:214 [inline] update_stack_state+0x4b0/0x4d0 arch/x86/kernel/unwind_frame.c:248 unwind_next_frame+0x39e/0x6b0 arch/x86/kernel/unwind_frame.c:315 arch_stack_walk+0x138/0x170 arch/x86/kernel/stacktrace.c:25 stack_trace_save_tsk+0x171/0x210 kernel/stacktrace.c:150 proc_pid_stack+0x136/0x2c0 fs/proc/base.c:508 proc_single_show+0x11a/0x1b0 fs/proc/base.c:828 traverse+0x21b/0x700 fs/seq_file.c:111 seq_read_iter+0xdbd/0xf30 fs/seq_file.c:195 seq_read+0x368/0x490 fs/seq_file.c:162 vfs_read+0x288/0xc70 fs/read_write.c:568 ksys_pread64+0x170/0x270 fs/read_write.c:776 __do_sys_pread64 fs/read_write.c:786 [inline] __se_sys_pread64 fs/read_write.c:783 [inline] __x64_sys_pread64+0x9f/0xb0 fs/read_write.c:783 x64_sys_call+0x2a34/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:18 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f276079e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f27615d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 RAX: ffffffffffffffda RBX: 00007f2760a25fa0 RCX: 00007f276079e159 RDX: 000000000000000f RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f276083506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2760a26038 R14: 00007f2760a25fa0 R15: 00007ffd7dbc61c8 The buggy address belongs to a vmalloc virtual mapping The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810232d080 pfn:0x10232d flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88810232d080 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 3793, tgid 3793 (syz.3.1073), ts 74635236954, free_ts 74631290036 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1863 prep_new_page+0x2d/0x180 mm/page_alloc.c:1871 get_page_from_freelist+0x4aea/0x4ba0 mm/page_alloc.c:3948 __alloc_pages_noprof+0x35a/0x7e0 mm/page_alloc.c:5315 vm_area_alloc_pages mm/vmalloc.c:-1 [inline] __vmalloc_area_node mm/vmalloc.c:3696 [inline] __vmalloc_node_range_noprof+0x8e5/0x1300 mm/vmalloc.c:3878 alloc_thread_stack_node kernel/fork.c:325 [inline] dup_task_struct+0x5d6/0xd80 kernel/fork.c:1124 copy_process+0x57c/0x3350 kernel/fork.c:2249 kernel_clone+0x233/0x810 kernel/fork.c:2851 __do_sys_clone3 kernel/fork.c:3157 [inline] __se_sys_clone3+0x33e/0x360 kernel/fork.c:3136 __x64_sys_clone3+0x5f/0x80 kernel/fork.c:3136 x64_sys_call+0x28fc/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:436 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e page last free pid 20 tgid 20 stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1390 [inline] free_unref_page+0xbb8/0xf70 mm/page_alloc.c:2876 __free_pages+0x6b/0x3b0 mm/page_alloc.c:5402 pagetable_free include/linux/mm.h:3084 [inline] pagetable_dtor_free include/linux/mm.h:3174 [inline] __tlb_remove_table include/asm-generic/tlb.h:217 [inline] __tlb_remove_table_free mm/mmu_gather.c:228 [inline] tlb_remove_table_rcu+0x2b2/0x3d0 mm/mmu_gather.c:283 rcu_do_batch+0x56a/0xcb0 kernel/rcu/tree.c:2575 nocb_cb_wait kernel/rcu/tree_nocb.h:923 [inline] rcu_nocb_cb_kthread+0x533/0xb60 kernel/rcu/tree_nocb.h:957 kthread+0x2c4/0x360 kernel/kthread.c:389 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffffc90003cef300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90003cef380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90003cef400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffffc90003cef480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90003cef500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline] BUG: KASAN: out-of-bounds in update_stack_state+0x4b0/0x4d0 arch/x86/kernel/unwind_frame.c:248 Read of size 2 at addr ffffc90003cef420 by task syz.3.1153/4064 CPU: 1 UID: 0 PID: 4064 Comm: syz.3.1153 Not tainted syzkaller #0 59fd58dbf897e2c8ba33f91efbb53ce34092dff9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_address_description+0x71/0x210 mm/kasan/report.c:377 print_report+0x4a/0x70 mm/kasan/report.c:481 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379 user_mode arch/x86/include/asm/ptrace.h:214 [inline] update_stack_state+0x4b0/0x4d0 arch/x86/kernel/unwind_frame.c:248 unwind_next_frame+0x39e/0x6b0 arch/x86/kernel/unwind_frame.c:315 arch_stack_walk+0x138/0x170 arch/x86/kernel/stacktrace.c:25 stack_trace_save_tsk+0x171/0x210 kernel/stacktrace.c:150 proc_pid_stack+0x136/0x2c0 fs/proc/base.c:508 proc_single_show+0x11a/0x1b0 fs/proc/base.c:828 traverse+0x21b/0x700 fs/seq_file.c:111 seq_read_iter+0xdbd/0xf30 fs/seq_file.c:195 seq_read+0x368/0x490 fs/seq_file.c:162 vfs_read+0x288/0xc70 fs/read_write.c:568 ksys_pread64+0x170/0x270 fs/read_write.c:776 __do_sys_pread64 fs/read_write.c:786 [inline] __se_sys_pread64 fs/read_write.c:783 [inline] __x64_sys_pread64+0x9f/0xb0 fs/read_write.c:783 x64_sys_call+0x2a34/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:18 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f276079e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f27615d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 RAX: ffffffffffffffda RBX: 00007f2760a25fa0 RCX: 00007f276079e159 RDX: 000000000000000f RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f276083506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2760a26038 R14: 00007f2760a25fa0 R15: 00007ffd7dbc61c8 The buggy address belongs to a vmalloc virtual mapping The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810232d080 pfn:0x10232d flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88810232d080 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 3793, tgid 3793 (syz.3.1073), ts 74635236954, free_ts 74631290036 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1863 prep_new_page+0x2d/0x180 mm/page_alloc.c:1871 get_page_from_freelist+0x4aea/0x4ba0 mm/page_alloc.c:3948 __alloc_pages_noprof+0x35a/0x7e0 mm/page_alloc.c:5315 vm_area_alloc_pages mm/vmalloc.c:-1 [inline] __vmalloc_area_node mm/vmalloc.c:3696 [inline] __vmalloc_node_range_noprof+0x8e5/0x1300 mm/vmalloc.c:3878 alloc_thread_stack_node kernel/fork.c:325 [inline] dup_task_struct+0x5d6/0xd80 kernel/fork.c:1124 copy_process+0x57c/0x3350 kernel/fork.c:2249 kernel_clone+0x233/0x810 kernel/fork.c:2851 __do_sys_clone3 kernel/fork.c:3157 [inline] __se_sys_clone3+0x33e/0x360 kernel/fork.c:3136 __x64_sys_clone3+0x5f/0x80 kernel/fork.c:3136 x64_sys_call+0x28fc/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:436 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e page last free pid 20 tgid 20 stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1390 [inline] free_unref_page+0xbb8/0xf70 mm/page_alloc.c:2876 __free_pages+0x6b/0x3b0 mm/page_alloc.c:5402 pagetable_free include/linux/mm.h:3084 [inline] pagetable_dtor_free include/linux/mm.h:3174 [inline] __tlb_remove_table include/asm-generic/tlb.h:217 [inline] __tlb_remove_table_free mm/mmu_gather.c:228 [inline] tlb_remove_table_rcu+0x2b2/0x3d0 mm/mmu_gather.c:283 rcu_do_batch+0x56a/0xcb0 kernel/rcu/tree.c:2575 nocb_cb_wait kernel/rcu/tree_nocb.h:923 [inline] rcu_nocb_cb_kthread+0x533/0xb60 kernel/rcu/tree_nocb.h:957 kthread+0x2c4/0x360 kernel/kthread.c:389 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffffc90003cef300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90003cef380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90003cef400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffffc90003cef480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90003cef500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================