Extracting prog: 9m2.984041893s
Minimizing prog: 32m18.209949909s
Simplifying prog options: 0s
Extracting C: 1m26.49138995s
Simplifying C: 7m45.342546163s


extracting reproducer from 49 programs
testing a last program of every proc
single: executing 9 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-prctl$PR_SCHED_CORE-sendmsg$nl_route_sched-prlimit64-sched_setscheduler-getpid-sched_setaffinity-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-recvmmsg-socket$netlink-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-pipe-socket$inet6_tcp-bind$inet6-socket$netlink-fsconfig$FSCONFIG_SET_STRING-bpf$MAP_CREATE-bpf$BPF_GET_MAP_INFO-ioctl$sock_SIOCGIFINDEX-syz_io_uring_setup-io_uring_register$IORING_UNREGISTER_RING_FDS-sendmsg$nl_route_sched-socket$packet-sendto$packet
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x22, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xfffffffffffffea1, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x9}, 0x80}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$netlink(0x10, 0x3, 0x15)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10)
pipe(&(0x7f00000001c0))
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c)
socket$netlink(0x10, 0x3, 0x7)
fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000300)='source', &(0x7f0000000180)='%\xde({^\xfa@:', 0x0)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="11000000040000000400000002"], 0x48)
bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000340)={r6, 0x63, &(0x7f00000003c0)}, 0x10)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
r8 = syz_io_uring_setup(0x2, &(0x7f0000000180)={0x0, 0x289b, 0x10000, 0x1, 0x323}, &(0x7f0000000000), &(0x7f00000003c0))
io_uring_register$IORING_UNREGISTER_RING_FDS(r8, 0x15, &(0x7f0000005280)=[{0x0, 0x0, 0x0, &(0x7f00000006c0), 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0}], 0x2)
sendmsg$nl_route_sched(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
r9 = socket$packet(0x11, 0x3, 0x300)
sendto$packet(r9, &(0x7f00000002c0)="bada30fbc99b5400040000ea0756", 0xe, 0x48041, &(0x7f00000001c0)={0x11, 0x10, r7, 0x1, 0xd8, 0x6, @local}, 0x14)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_route_sched-socket$inet6_tcp-sendmsg$nl_route-socket$netlink-sendmmsg
detailed listing:
executing program 0:
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20004015}, 0x2404c8c0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$binfmt_register-openat$binder_debug-bind$inet6-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-sendto$packet
detailed listing:
executing program 0:
write$binfmt_register(0xffffffffffffffff, &(0x7f00000004c0)={0x3a, 'syz1', 0x3a, 'E', 0x3a, 0xd, 0x3a, 'debugfs\x00\x9c\xf52X\x8b\xf2\xee^\x9e\a\xd7\xad+\xad~\xc4Q\x8d\xf1GWh\xa4\'\x0e:\b+\xb9U/\xc5<8o\x8d\x0f\xa6\x8094\xb2\xe2\x17I0\v\x8a\xbb\xbei\xf4\x1d\xf6q\xa5\xb3W\x96]\x9e\x82\xfaA\x0e\xe4\xbd\xffxg\xb6_\xeav\xcf\xa0', 0x3a, 'D,>\xfb\xf1\xa3cn\t\xb2\xf8\x80\xd0=\xae\x00C\x82zb\xf0\xebs\x80\xf0\x1ep:\xed\xdb\x1db\x0f\xe6Ow\x85s\xf0`N\xe1s\x1cm\x0e\xea\xfb\xeaUy\xaaz`\'\xf4\xed\x90T\a\xeb\xb7\x8em\xd0\x92b\x0e\xce\x8e\x96f\x1e\x89\xa2\xa2\xba\x8a\xa1\xce\xc5\xec5((u\x12\x1d\x119B\ftG\xfa\xe3!\x01c\x9a\xd68\x86\xeay\x89\xaeX\x90IO\x8c;\x0e&\xa7\xf9K\xf5\v3M\x91\xdfy;3\xb8<\xe7\xa0F\xe9\xf4\xb4\x80\x15\xacu1\x1f[\xb8\x12\xad\x06{\xf5OA\xda\x83\xa1\x01\x80\x19\xd3\xc5\xb2cI\xba\x12\xae1\xb6\x043\x8f\xfb=\xc2\xb1\xa0\\\xabg\xcf\xa6\x95\x9cV+z\"\x89\x06\xa9\x8f)\x14\xf4\x1d,%\xca|\xcf\x18<\x8a\xce\xbbL\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8bL\xad\x13}\xf4\xc2y\x06\xb4\xaf\xac\b\xc9\x14\x1b\x89IRJ\xa1\x80h\x10\x1f\x1c\xc1\a\x98\xcc\x01\xf8 \xbcQ\x89\x139\x0e\x87\x87l\x03W\x15\xb0Q\xc5\xe5\xdb\x89\x1d\x1b:\x9d\xd7\x0e#\xfd\x0e\x12\x90MvE\xa2x\xb4\x1b\x9a\xb1\xf9\b\x00\x00\x00\x00\x00\x00\x00V\x84\x81\xf7\xbf\xe9\xdc\xab\xba\xea\x87\xff', 0x3a, './file0'}, 0x1bc)
openat$binder_debug(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e24, 0x1, @empty, 0x65}, 0x1c)
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0x1, 0x4)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r1=>0x0})
sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc1411002c4788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$inet6_sctp-ioctl$sock_inet6_SIOCADDRT-ioctl$sock_inet6_SIOCADDRT-sendmsg$kcm-socket$inet_tcp-connect$inet-sendmsg$inet-socket$nl_rdma-getsockopt$inet_IP_IPSEC_POLICY-bpf$MAP_CREATE_CONST_STR-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-gettid-openat-openat$fuse-mount$fuse-sched_setscheduler-sched_setaffinity-ioctl$USBDEVFS_FREE_STREAMS-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-mount$9p_virtio-socketpair$unix-sendmmsg$unix-close-connect$unix-sendmmsg
detailed listing:
executing program 0:
r0 = socket$kcm(0x10, 0x2, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000580)={@private2, @loopback, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2000000, 0x0, 0x7d, 0x200, 0xfffffffffffffffd, 0x930311})
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000200)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback={0x3f}, @loopback, 0x6, 0x0, 0x40, 0x0, 0x4000000000000009, 0x10200})
sendmsg$kcm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000000)="d80000001000810468f70082db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000300014006000d00036010fab94dcf5c0461c1d67f6f94000534cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x20000004)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10)
sendmsg$inet(r2, &(0x7f00000015c0)={0x0, 0x0, 0x0}, 0x0)
socket$nl_rdma(0x10, 0x3, 0x14)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000700)={{{@in6=@loopback, @in6=@empty}}, {{@in6=@private1}, 0x0, @in6=@local}}, &(0x7f0000000300)=0x68051a1724300031)
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8f}, 0x0)
r3 = gettid()
r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0)
mount$fuse(0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB, @ANYBLOB=',gro', @ANYRESDEC=0x0])
sched_setscheduler(r3, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
ioctl$USBDEVFS_FREE_STREAMS(r4, 0x8008551d, &(0x7f0000000280)={0x3d00, 0xb, [{0xc, 0x1}, {0xc}, {0xa}, {0x1}, {0x8, 0x1}, {0xc, 0x1}, {0x6}, {0x4}, {0xd}, {0xd, 0x1}, {0x1}]})
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r6 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0)
read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8)
mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0)
close(r7)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD-madvise-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_REGISTER-socket
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
r8 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_REGISTER(r8, 0xc020aa07, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xd9000}, 0x1, 0x2})
socket(0xa, 0x3, 0x3a)

program crashed: memory leak in xas_create
single: successfully extracted reproducer
found reproducer with 29 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD-madvise-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
r8 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_REGISTER(r8, 0xc020aa07, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xd9000}, 0x1, 0x2})

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD-madvise-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
r8 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD-madvise-userfaultfd-ioctl$UFFDIO_API
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
r8 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0))

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD-madvise-userfaultfd
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
userfaultfd(0x80001)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-bpf$PROG_LOAD
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-ioctl$KVM_CREATE_VM-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2a)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-syz_io_uring_setup-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
syz_io_uring_setup(0x10b, 0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-setfsuid-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
setfsuid(0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-timer_settime-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300)=<r6=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r6, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mprotect-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-fcntl$lock-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300))
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f2, 0x1})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-timer_create-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
timer_create(0x0, 0x0, &(0x7f0000000300))
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$packet-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
socket$packet(0x11, 0x2, 0x300)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtfilter={0x64, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xffff}, {0xfff1}, {0x4, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_MARK={0x10, 0xa, {0x287b, 0xa}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0xffffffff}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x3}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4c000}, 0x24040084)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r5=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-ioctl$sock_SIOCGIFINDEX-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r2, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r3=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r3, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r4, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-ioctl$SNDCTL_FM_4OP_ENABLE-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r1, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r2=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r2, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_FM_4OP_ENABLE(r3, 0x4004510f, &(0x7f0000000080)=0xfb9fa3e5)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-openat$sequencer-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r1, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r2=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r2, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-sendmsg$TCPDIAG_GETSOCK-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r1, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', <r2=>0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc84fc84032e27209}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24010000120001002abd7000fddbdf25180300024e224e20fcffffff", @ANYRES32=r2, @ANYRESOCT=r0], 0x124}, 0x1, 0x0, 0x0, 0x1}, 0x4040000)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
r0 = socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r1, 0x4b65, 0x75)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'tunl0\x00', 0x0, 0x1, 0x8037, 0x8, 0x8, {{0x6, 0x4, 0x0, 0x38, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @local, {[@noop]}}}}})
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-ioctl$KDSKBLED-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$KDSKBLED(r0, 0x4b65, 0x75)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-syz_open_dev$tty20-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
syz_open_dev$tty20(0xc, 0x4, 0x1)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-socket$unix-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
socket(0x10, 0x803, 0x0)
socket$unix(0x1, 0x1, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-socket-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
socket(0x10, 0x803, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$evdev-mmap-madvise
detailed listing:
executing program 0:
syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
detailed listing:
executing program 0:
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
program crashed: memory leak in xas_create
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
detailed listing:
executing program 0:
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
detailed listing:
executing program 0:
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-madvise
detailed listing:
executing program 0:
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)

program crashed: memory leak in xas_create
validation run: crashed=true
reproducing took 53m48.342014254s
repro crashed as (corrupted=false):
BUG: memory leak
unreferenced object 0xffff888113124000 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    06 11 08 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    90 72 a7 0d 81 88 ff ff 18 40 12 13 81 88 ff ff  .r.......@......
  backtrace (crc ec9d7d61):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113124248 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 07 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff 60 42 12 13 81 88 ff ff  .r......`B......
  backtrace (crc 78dc8c67):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113124490 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 06 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff a8 44 12 13 81 88 ff ff  .r.......D......
  backtrace (crc 89acb466):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881131246d8 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 05 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff f0 46 12 13 81 88 ff ff  .r.......F......
  backtrace (crc 53cc13ad):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113124920 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 04 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff 38 49 12 13 81 88 ff ff  .r......8I......
  backtrace (crc b03dc225):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

final repro crashed as (corrupted=false):
BUG: memory leak
unreferenced object 0xffff888113124000 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    06 11 08 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    90 72 a7 0d 81 88 ff ff 18 40 12 13 81 88 ff ff  .r.......@......
  backtrace (crc ec9d7d61):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113124248 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 07 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff 60 42 12 13 81 88 ff ff  .r......`B......
  backtrace (crc 78dc8c67):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113124490 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 06 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff a8 44 12 13 81 88 ff ff  .r.......D......
  backtrace (crc 89acb466):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881131246d8 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 05 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff f0 46 12 13 81 88 ff ff  .r.......F......
  backtrace (crc 53cc13ad):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113124920 (size 576):
  comm "syz.0.17", pid 6085, jiffies 4294943448
  hex dump (first 32 bytes):
    00 04 00 00 00 00 00 00 00 40 12 13 81 88 ff ff  .........@......
    90 72 a7 0d 81 88 ff ff 38 49 12 13 81 88 ff ff  .r......8I......
  backtrace (crc b03dc225):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_lru_noprof+0x3bb/0x5a0 mm/slub.c:5282
    xas_alloc+0xf6/0x120 lib/xarray.c:378
    xas_create+0x48a/0x820 lib/xarray.c:685
    xas_create_range+0xb6/0x1b0 lib/xarray.c:725
    collapse_file+0x1e0/0x1ae0 mm/khugepaged.c:1891
    hpage_collapse_scan_file+0x613/0xb00 mm/khugepaged.c:2387
    madvise_collapse+0x1f7/0x650 mm/khugepaged.c:2810
    madvise_vma_behavior+0x6e2/0x1260 mm/madvise.c:1372
    madvise_walk_vmas+0x152/0x530 mm/madvise.c:1721
    madvise_do_behavior+0xc4/0x2e0 mm/madvise.c:1937
    do_madvise+0x118/0x1c0 mm/madvise.c:2030
    __do_sys_madvise mm/madvise.c:2039 [inline]
    __se_sys_madvise mm/madvise.c:2037 [inline]
    __x64_sys_madvise+0x2c/0x40 mm/madvise.c:2037
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF