Extracting prog: 5m53.863358096s Minimizing prog: 9m4.758657674s Simplifying prog options: 0s Extracting C: 1m26.078651294s Simplifying C: 7m50.427561323s extracting reproducer from 46 programs testing a last program of every proc single: executing 15 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-mkdirat-mkdirat-openat-write-openat-write-openat-write-openat-write-mkdirat-mkdirat-openat-write-openat-write-openat-write-mknodat-openat-dup2-openat-write-nanosleep-mkdirat-mount-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/cluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/mycluster/node\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/mycluster/node/mynode/local\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/mycluster/node/mynode/num\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)='0\n\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='127.0.0.1\n\x00', 0xa) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x2, 0x0) write(r3, &(0x7f00000003c0)='7777\n\x00', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/mycluster/heartbeat\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000004c0)='512\n\x00', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/cluster/mycluster/heartbeat/myregion/start_block\x00', 0x2, 0x0) write(r5, &(0x7f0000000540)='0\n\x00', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x2, 0x0) write(r6, &(0x7f00000005c0)='255\n\x00', 0x4) mknodat(0xffffffffffffff9c, &(0x7f0000000800)='./ram0\x00', 0x8000, 0x100) r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./ram0\x00', 0x2, 0x0) dup2(r7, 0x64) r8 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0) write(r8, &(0x7f0000000640)='100\n\x00', 0x4) nanosleep(&(0x7f0000000680)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./dlmfs\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./dlmfs\x00', &(0x7f0000000740)='ocfs2_dlmfs\x00', 0x0, 0x0) rmdir(&(0x7f00000007c0)='./dlmfs/mydomain\x00') program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-socket$inet6-ioctl$sock_inet_SIOCSIFFLAGS-ioctl$sock_inet6_SIOCSIFADDR-ioctl$sock_inet_SIOCSIFFLAGS detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/net/ipv6/conf/lo/keep_addr_on_down\x00', 0x2, 0x0) write(r0, &(0x7f0000000040)='1\n', 0x2) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00', 0x1}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={@rand_addr, 0x40, 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-syz_open_dev$video-ioctl$VIDIOC_REQBUFS-ioctl$VIDIOC_QBUF-ioctl$VIDIOC_STREAMON detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0xc, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000200), 0x4, 0x2) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000500)=0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-mkdirat-mount-openat-write-openat-write-mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000640)='-2 -3 +4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/recoverydir\x00', 0x2, 0x0) write(r1, &(0x7f0000000740)='/\n\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f00000000c0)='tcp 2049\n\x00', 0x9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000140)='1\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000540)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000200)='nfsd 127.0.0.1 2147483647 mydomain\n\x00', 0x23) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r5, &(0x7f0000000280)='mydomain / 2147483647 24576 0 0 0\n\x00', 0x22) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt\x00', 0x1ff) mount(&(0x7f0000000340)=@filename='127.0.0.1:/\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000380)='nfs4\x00', 0x0, &(0x7f00000003c0)='nolock,addr=127.0.0.1,port=2049\x00') openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt/file\x00', 0x42, 0x1ff) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-nanosleep detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in sysfs_emit testing program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) program did not crash testing program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-syz_usb_connect detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, 0x0, 0x0) program did not crash testing program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45.435434952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent simplifying C reproducer testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program did not crash testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing compiled C program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent testing program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent validation run: crashed=true testing program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent validation run: crashed=true testing program (duration=45.435434952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0) program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent validation run: crashed=true reproducing took 28m16.852277486s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 lib/vsprintf.c:730 Read of size 1 at addr ffff888036c9a758 by task udevd/4978 CPU: 1 UID: 0 PID: 4978 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 string_nocheck lib/vsprintf.c:648 [inline] string+0x471/0x4d0 lib/vsprintf.c:730 vsnprintf+0x422/0x1300 lib/vsprintf.c:2945 add_uevent_var+0x183/0x3a0 lib/kobject_uevent.c:682 rc_dev_uevent+0x17d/0x1c0 drivers/media/rc/rc-main.c:1632 dev_uevent+0x2f1/0x870 drivers/base/core.c:2779 uevent_show+0x1ca/0x3a0 drivers/base/core.c:2826 dev_attr_show+0x52/0xa0 drivers/base/core.c:2487 sysfs_kf_seq_show+0x217/0x3f0 fs/sysfs/file.c:65 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231 kernfs_fop_read_iter+0x46c/0x610 fs/kernfs/file.c:290 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x82e/0xb40 fs/read_write.c:574 ksys_read+0x12a/0x250 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7c15ea7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffdbed697d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f7c1656f880 RCX: 00007f7c15ea7407 RDX: 0000000000001000 RSI: 00005562db7c87a0 RDI: 000000000000000c RBP: 00007f7c15fefff0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a R13: 00007f7c15fefea0 R14: 0000000000000000 R15: 00005562db7b1b20 Allocated by task 29: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] redrat3_dev_probe+0x326/0x2b50 drivers/media/rc/redrat3.c:1023 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 29: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x22b/0x6c0 mm/slub.c:6692 redrat3_delete drivers/media/rc/redrat3.c:466 [inline] redrat3_dev_probe+0x107a/0x2b50 drivers/media/rc/redrat3.c:1124 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888036c9a000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1880 bytes inside of freed 2048-byte region [ffff888036c9a000, ffff888036c9a800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36c98 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 29, tgid 29 (kworker/1:1), ts 97547535000, free_ts 93976100763 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x640 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] usb_set_configuration+0x10cb/0x1c60 drivers/usb/core/message.c:2096 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 page last free pid 5273 tgid 5273 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6775 sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3013 unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2137 unix_seqpacket_sendmsg+0x12a/0x1d0 net/unix/af_unix.c:2538 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] sock_write_iter+0x53a/0x5b0 net/socket.c:1241 do_iter_readv_writev+0x6f7/0x930 fs/read_write.c:828 vfs_writev+0x360/0xdd0 fs/read_write.c:1058 do_writev+0x28a/0x340 fs/read_write.c:1104 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888036c9a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036c9a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888036c9a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888036c9a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036c9a800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 lib/vsprintf.c:730 Read of size 1 at addr ffff888036c9a758 by task udevd/4978 CPU: 1 UID: 0 PID: 4978 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 string_nocheck lib/vsprintf.c:648 [inline] string+0x471/0x4d0 lib/vsprintf.c:730 vsnprintf+0x422/0x1300 lib/vsprintf.c:2945 add_uevent_var+0x183/0x3a0 lib/kobject_uevent.c:682 rc_dev_uevent+0x17d/0x1c0 drivers/media/rc/rc-main.c:1632 dev_uevent+0x2f1/0x870 drivers/base/core.c:2779 uevent_show+0x1ca/0x3a0 drivers/base/core.c:2826 dev_attr_show+0x52/0xa0 drivers/base/core.c:2487 sysfs_kf_seq_show+0x217/0x3f0 fs/sysfs/file.c:65 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231 kernfs_fop_read_iter+0x46c/0x610 fs/kernfs/file.c:290 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x82e/0xb40 fs/read_write.c:574 ksys_read+0x12a/0x250 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7c15ea7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffdbed697d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f7c1656f880 RCX: 00007f7c15ea7407 RDX: 0000000000001000 RSI: 00005562db7c87a0 RDI: 000000000000000c RBP: 00007f7c15fefff0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a R13: 00007f7c15fefea0 R14: 0000000000000000 R15: 00005562db7b1b20 Allocated by task 29: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] redrat3_dev_probe+0x326/0x2b50 drivers/media/rc/redrat3.c:1023 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 29: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x22b/0x6c0 mm/slub.c:6692 redrat3_delete drivers/media/rc/redrat3.c:466 [inline] redrat3_dev_probe+0x107a/0x2b50 drivers/media/rc/redrat3.c:1124 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888036c9a000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1880 bytes inside of freed 2048-byte region [ffff888036c9a000, ffff888036c9a800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36c98 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe28000 dead000000000100 dead000000000122 head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 29, tgid 29 (kworker/1:1), ts 97547535000, free_ts 93976100763 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x640 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] usb_set_configuration+0x10cb/0x1c60 drivers/usb/core/message.c:2096 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 page last free pid 5273 tgid 5273 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_node_noprof+0x27d/0x6b0 mm/slub.c:4989 __alloc_skb+0x140/0x710 net/core/skbuff.c:704 alloc_skb include/linux/skbuff.h:1384 [inline] alloc_skb_with_frags+0xdd/0x760 net/core/skbuff.c:6775 sock_alloc_send_pskb+0x801/0x980 net/core/sock.c:3013 unix_dgram_sendmsg+0x3c7/0x1810 net/unix/af_unix.c:2137 unix_seqpacket_sendmsg+0x12a/0x1d0 net/unix/af_unix.c:2538 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] sock_write_iter+0x53a/0x5b0 net/socket.c:1241 do_iter_readv_writev+0x6f7/0x930 fs/read_write.c:828 vfs_writev+0x360/0xdd0 fs/read_write.c:1058 do_writev+0x28a/0x340 fs/read_write.c:1104 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888036c9a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036c9a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888036c9a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888036c9a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036c9a800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================