Extracting prog: 1m48.261111933s
Minimizing prog: 21m27.900295479s
Simplifying prog options: 0s
Extracting C: 26.911295929s
Simplifying C: 21m13.938593254s


extracting reproducer from 26 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})
close_range(r1, 0xffffffffffffffff, 0x0)

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: WARNING in release_card_device
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(0xffffffffffffffff, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', 0x0, 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(0x0, 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0), 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)

program did not crash
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in release_card_device
simplifying C reproducer
testing compiled C program (duration=40.543605318s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: slab-out-of-bounds Read in release_card_device
a never seen crash title: KASAN: slab-out-of-bounds Read in release_card_device, ignore
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: WARNING in release_card_device
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
program did not crash
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in release_card_device
testing compiled C program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f sound/core/init.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: KASAN: use-after-free Read in release_card_device
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program crashed: KASAN: use-after-free Read in release_card_device
validation run: crashed=true
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program crashed: KASAN: use-after-free Read in release_card_device
validation run: crashed=true
testing program (duration=40.543605318s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_open_dev$sndpcmp-openat-syz_open_dev$sndpcmc-write-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$sndpcmp(0x0, 0x1, 0x88240)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})

program crashed: KASAN: use-after-free Read in release_card_device
validation run: crashed=true
reproducing took 48m58.495288304s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:612 [inline]
BUG: KASAN: use-after-free in release_card_device+0x188/0x198 sound/core/init.c:145
Read of size 1 at addr ffff0000d5a1cd99 by task syz.3.20/4500

CPU: 0 PID: 4500 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 snd_card_do_free sound/core/init.c:612 [inline]
 release_card_device+0x188/0x198 sound/core/init.c:145
 device_release+0x94/0x1b4 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x2a8/0x41c lib/kobject.c:729
 put_device+0x28/0x40 drivers/base/core.c:3820
 snd_card_file_remove+0x2e4/0x340 sound/core/init.c:1147
 snd_pcm_release+0x120/0x14c sound/core/pcm_native.c:2939
 snd_disconnect_release+0x224/0x298 sound/core/init.c:438
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:000000003cd6465b refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115a1c
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc00032cc208 ffff00019f39b0b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d5a1cc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5a1cd00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d5a1cd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff0000d5a1ce00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5a1ce80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:612 [inline]
BUG: KASAN: use-after-free in release_card_device+0x188/0x198 sound/core/init.c:145
Read of size 1 at addr ffff0000d5a1cd99 by task syz.3.20/4500

CPU: 0 PID: 4500 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 snd_card_do_free sound/core/init.c:612 [inline]
 release_card_device+0x188/0x198 sound/core/init.c:145
 device_release+0x94/0x1b4 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x2a8/0x41c lib/kobject.c:729
 put_device+0x28/0x40 drivers/base/core.c:3820
 snd_card_file_remove+0x2e4/0x340 sound/core/init.c:1147
 snd_pcm_release+0x120/0x14c sound/core/pcm_native.c:2939
 snd_disconnect_release+0x224/0x298 sound/core/init.c:438
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the physical page:
page:000000003cd6465b refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115a1c
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffc00032cc208 ffff00019f39b0b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d5a1cc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5a1cd00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d5a1cd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff0000d5a1ce00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d5a1ce80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================