Extracting prog: 4m35.05933304s
Minimizing prog: 36m15.880317144s
Simplifying prog options: 0s
Extracting C: 49.816777076s
Simplifying C: 13m58.578491394s


extracting reproducer from 37 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-pipe2$watch_queue-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r7 = dup2(r6, r6)
write$6lowpan_enable(r7, &(0x7f00000000c0)='1', 0x1)
writev(r6, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
pipe2$watch_queue(&(0x7f0000001180), 0x80)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): rename-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_FRAME-add_key$fscrypt_provisioning-mount$fuse-socket$inet6_sctp-socket$inet_udp-readv-socket$netlink-sendmsg$nl_route-ioctl$sock_SIOCGIFINDEX-ioctl$sock_inet6_SIOCSIFADDR-socket$alg-getsockopt$IPT_SO_GET_ENTRIES-bind$alg-setsockopt$ALG_SET_KEY-accept4-sendmmsg$alg-recvmsg-syz_usb_connect-socket$inet_tcp-setsockopt$inet_msfilter-syz_usb_control_io$cdc_ecm-openat$rdma_cm-writev-syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00')
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r1=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)={0x28, 0x0, 0x1, 0x70bd25, 0x0, {{0x2}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x1, 0x51}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x4c854}, 0x20040880)
r2 = add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe)
mount$fuse(0x0, 0x0, 0x0, 0x1000430, &(0x7f0000000780)=ANY=[@ANYRESDEC=0x0, @ANYBLOB=',', @ANYBLOB="58e1a192964f91b2b2b082e5b2d36bfb79"])
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
socket$inet_udp(0x2, 0x2, 0x0)
readv(r3, &(0x7f0000000700)=[{&(0x7f00000004c0)=""/134, 0x86}, {&(0x7f0000000580)=""/45, 0x2d}, {&(0x7f0000000600)=""/64, 0x40}, {&(0x7f0000000680)=""/109, 0x6d}], 0x4)
r4 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="150000007200010b2bbd7000fedbdf252700af00", @ANYRES32=0x0, @ANYBLOB="0800010001000000"], 0x20}}, 0x4040)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth1_to_batadv\x00', <r5=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000180)={@loopback, 0x60, r5})
r6 = socket$alg(0x26, 0x5, 0x0)
getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000640)=ANY=[@ANYBLOB="736563757216ae2c69747900000000000000000000000000000000000000000000000004"], 0x0)
bind$alg(r6, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="2c991661ee", 0x5)
r7 = accept4(r6, 0x0, 0x0, 0x800)
sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
r8 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0)
r9 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_msfilter(r9, 0x0, 0x29, &(0x7f00000002c0)={@remote, @rand_addr=0x64010100, 0x1, 0x2, [@empty, @multicast2]}, 0x18)
syz_usb_control_io$cdc_ecm(r8, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
r10 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
writev(r10, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1)
r11 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r12 = syz_pidfd_open(r11, 0x0)
ioctl$EXT4_IOC_MIGRATE(r12, 0xff02)
syz_usb_ep_write$ath9k_ep1(r8, 0x82, 0xfffffd9e, &(0x7f00000007c0)=ANY=[@ANYRESDEC=r3, @ANYRES32=r10, @ANYRES16=r2, @ANYBLOB="48e00e6c203b6a746669c8f420152defda7c399ba732d4dd870c3ef2eec674d06f4f3969d71a2781ab01ea1c86a879d9f44c0775f967b83ffc952fa8bdcbf46f02b0a1dae28bd4c44ab1fe759e6c4af359b94c58998897d9c087e68f80676ebd50fea71030bc65dc4ac4852b80398953d240638d2c439e9affbc276e8a22a2adb5108b4510640bbf6a1f070465e0f182278d4fe99dcc48f2f08ab0da419827b594adab80a5bcb082d987bf196ea27d61d1c4fe1803380200d9a448ec7ffcb92955b51e0b062ee38074920d", @ANYRESOCT=r1])

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_ublk_setup_io_uring-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-add_key$keyring-pipe2$watch_queue-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
r6 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r7 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r8 = dup2(r7, r7)
write$6lowpan_enable(r8, &(0x7f00000000c0)='1', 0x1)
writev(r7, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_ublk_setup_io_uring(0x760, &(0x7f00000004c0)={0x0, 0x5387, 0x4000, 0x12, 0x9e, 0x0, r8}, &(0x7f0000000580)=<r9=>0x0, &(0x7f0000000400), &(0x7f0000000600))
r10 = mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x0, 0x8010, r8, 0x0)
syz_io_uring_submit(r9, r10, 0x0, &(0x7f0000000880)=@IORING_OP_FUTEX_WAKE={0x34, 0x8, 0x0, 0xfd, 0x4, &(0x7f0000000840)=[{&(0x7f0000000640)="40bceb1609f108f0c266c27f88044c2633b640cd49f21c1e86af9b9b22e6a2fea0d4fe04833e4f222a8a278659b7629050b7d9f5c5eb3a68e7a83fc8afd1c35ea88814e78295f929b2fb5211755ccb2f9ec6001035077a32a7389d7d5b955ba62481243037326a135d87d612eada1cb294ee92609f6f860b390ec6c1481ee00f03e2abfdbefc9065208d0c43445f9609ebd54231f718a950632aae4866de5d51f1b4b8f2d22655d694549b11cab1008e17b87efc1c615e8b163d33a436", 0xbd}, {&(0x7f0000000700)="3452f899753e", 0x6}, {&(0x7f0000000740)="e929c9dabebdea83090985950fffdebb105b2193ee1dd7e532477a9b5e125432cd5ca48f494f7232a0515a4f0da4996d65ba6a9ebca8667969a24314d57728be2d49bdfece7fbbaf2a3ea5b06c3a2c97b0ea545271ea6f51a5a315b7b07af0d6275039e156ea6b3a9e420a51eb50011a5d1726b162f38791bda2cc5a6a34d4687b3d9ba368567799a0735e80b1539cd6124d1f714a0267a2da96179935cb4dadc5807d54ab565fe2e493031e2651c9b9691ced173266f9aa9722119ef505a54de90a620b1b9e", 0xc6}], 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x800}})
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r6)
pipe2$watch_queue(&(0x7f0000001180), 0x80)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in input_dev_uevent
single: successfully extracted reproducer
found reproducer with 18 syscalls
minimizing guilty program
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_ublk_setup_io_uring-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-add_key$keyring-pipe2$watch_queue
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
r6 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r7 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r8 = dup2(r7, r7)
write$6lowpan_enable(r8, &(0x7f00000000c0)='1', 0x1)
writev(r7, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_ublk_setup_io_uring(0x760, &(0x7f00000004c0)={0x0, 0x5387, 0x4000, 0x12, 0x9e, 0x0, r8}, &(0x7f0000000580)=<r9=>0x0, &(0x7f0000000400), &(0x7f0000000600))
r10 = mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x0, 0x8010, r8, 0x0)
syz_io_uring_submit(r9, r10, 0x0, &(0x7f0000000880)=@IORING_OP_FUTEX_WAKE={0x34, 0x8, 0x0, 0xfd, 0x4, &(0x7f0000000840)=[{&(0x7f0000000640)="40bceb1609f108f0c266c27f88044c2633b640cd49f21c1e86af9b9b22e6a2fea0d4fe04833e4f222a8a278659b7629050b7d9f5c5eb3a68e7a83fc8afd1c35ea88814e78295f929b2fb5211755ccb2f9ec6001035077a32a7389d7d5b955ba62481243037326a135d87d612eada1cb294ee92609f6f860b390ec6c1481ee00f03e2abfdbefc9065208d0c43445f9609ebd54231f718a950632aae4866de5d51f1b4b8f2d22655d694549b11cab1008e17b87efc1c615e8b163d33a436", 0xbd}, {&(0x7f0000000700)="3452f899753e", 0x6}, {&(0x7f0000000740)="e929c9dabebdea83090985950fffdebb105b2193ee1dd7e532477a9b5e125432cd5ca48f494f7232a0515a4f0da4996d65ba6a9ebca8667969a24314d57728be2d49bdfece7fbbaf2a3ea5b06c3a2c97b0ea545271ea6f51a5a315b7b07af0d6275039e156ea6b3a9e420a51eb50011a5d1726b162f38791bda2cc5a6a34d4687b3d9ba368567799a0735e80b1539cd6124d1f714a0267a2da96179935cb4dadc5807d54ab565fe2e493031e2651c9b9691ced173266f9aa9722119ef505a54de90a620b1b9e", 0xc6}], 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x800}})
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r6)
pipe2$watch_queue(&(0x7f0000001180), 0x80)

program did not crash
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_ublk_setup_io_uring-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
r6 = add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r7 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r8 = dup2(r7, r7)
write$6lowpan_enable(r8, &(0x7f00000000c0)='1', 0x1)
writev(r7, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_ublk_setup_io_uring(0x760, &(0x7f00000004c0)={0x0, 0x5387, 0x4000, 0x12, 0x9e, 0x0, r8}, &(0x7f0000000580)=<r9=>0x0, &(0x7f0000000400), &(0x7f0000000600))
r10 = mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x0, 0x8010, r8, 0x0)
syz_io_uring_submit(r9, r10, 0x0, &(0x7f0000000880)=@IORING_OP_FUTEX_WAKE={0x34, 0x8, 0x0, 0xfd, 0x4, &(0x7f0000000840)=[{&(0x7f0000000640)="40bceb1609f108f0c266c27f88044c2633b640cd49f21c1e86af9b9b22e6a2fea0d4fe04833e4f222a8a278659b7629050b7d9f5c5eb3a68e7a83fc8afd1c35ea88814e78295f929b2fb5211755ccb2f9ec6001035077a32a7389d7d5b955ba62481243037326a135d87d612eada1cb294ee92609f6f860b390ec6c1481ee00f03e2abfdbefc9065208d0c43445f9609ebd54231f718a950632aae4866de5d51f1b4b8f2d22655d694549b11cab1008e17b87efc1c615e8b163d33a436", 0xbd}, {&(0x7f0000000700)="3452f899753e", 0x6}, {&(0x7f0000000740)="e929c9dabebdea83090985950fffdebb105b2193ee1dd7e532477a9b5e125432cd5ca48f494f7232a0515a4f0da4996d65ba6a9ebca8667969a24314d57728be2d49bdfece7fbbaf2a3ea5b06c3a2c97b0ea545271ea6f51a5a315b7b07af0d6275039e156ea6b3a9e420a51eb50011a5d1726b162f38791bda2cc5a6a34d4687b3d9ba368567799a0735e80b1539cd6124d1f714a0267a2da96179935cb4dadc5807d54ab565fe2e493031e2651c9b9691ced173266f9aa9722119ef505a54de90a620b1b9e", 0xc6}], 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x800}})
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r6)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in input_dev_uevent
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_ublk_setup_io_uring-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r7 = dup2(r6, r6)
write$6lowpan_enable(r7, &(0x7f00000000c0)='1', 0x1)
writev(r6, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_ublk_setup_io_uring(0x760, &(0x7f00000004c0)={0x0, 0x5387, 0x4000, 0x12, 0x9e, 0x0, r7}, &(0x7f0000000580)=<r8=>0x0, &(0x7f0000000400), &(0x7f0000000600))
r9 = mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x0, 0x8010, r7, 0x0)
syz_io_uring_submit(r8, r9, 0x0, &(0x7f0000000880)=@IORING_OP_FUTEX_WAKE={0x34, 0x8, 0x0, 0xfd, 0x4, &(0x7f0000000840)=[{&(0x7f0000000640)="40bceb1609f108f0c266c27f88044c2633b640cd49f21c1e86af9b9b22e6a2fea0d4fe04833e4f222a8a278659b7629050b7d9f5c5eb3a68e7a83fc8afd1c35ea88814e78295f929b2fb5211755ccb2f9ec6001035077a32a7389d7d5b955ba62481243037326a135d87d612eada1cb294ee92609f6f860b390ec6c1481ee00f03e2abfdbefc9065208d0c43445f9609ebd54231f718a950632aae4866de5d51f1b4b8f2d22655d694549b11cab1008e17b87efc1c615e8b163d33a436", 0xbd}, {&(0x7f0000000700)="3452f899753e", 0x6}, {&(0x7f0000000740)="e929c9dabebdea83090985950fffdebb105b2193ee1dd7e532477a9b5e125432cd5ca48f494f7232a0515a4f0da4996d65ba6a9ebca8667969a24314d57728be2d49bdfece7fbbaf2a3ea5b06c3a2c97b0ea545271ea6f51a5a315b7b07af0d6275039e156ea6b3a9e420a51eb50011a5d1726b162f38791bda2cc5a6a34d4687b3d9ba368567799a0735e80b1539cd6124d1f714a0267a2da96179935cb4dadc5807d54ab565fe2e493031e2651c9b9691ced173266f9aa9722119ef505a54de90a620b1b9e", 0xc6}], 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x800}})
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_ublk_setup_io_uring-mmap$IORING_OFF_SQ_RING-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r7 = dup2(r6, r6)
write$6lowpan_enable(r7, &(0x7f00000000c0)='1', 0x1)
writev(r6, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_ublk_setup_io_uring(0x760, &(0x7f00000004c0)={0x0, 0x5387, 0x4000, 0x12, 0x9e, 0x0, r7}, &(0x7f0000000580), &(0x7f0000000400), &(0x7f0000000600))
mmap$IORING_OFF_SQ_RING(0x0, 0x3, 0x0, 0x8010, r7, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_ublk_setup_io_uring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r7 = dup2(r6, r6)
write$6lowpan_enable(r7, &(0x7f00000000c0)='1', 0x1)
writev(r6, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_ublk_setup_io_uring(0x760, &(0x7f00000004c0)={0x0, 0x5387, 0x4000, 0x12, 0x9e, 0x0, r7}, &(0x7f0000000580), &(0x7f0000000400), &(0x7f0000000600))
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-writev-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r7 = dup2(r6, r6)
write$6lowpan_enable(r7, &(0x7f00000000c0)='1', 0x1)
writev(r6, &(0x7f0000000540)=[{&(0x7f0000001680)='0', 0x1}], 0x1)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-write$6lowpan_enable-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r7 = dup2(r6, r6)
write$6lowpan_enable(r7, &(0x7f00000000c0)='1', 0x1)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-dup2-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
dup2(r6, r6)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-openat$6lowpan_enable-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
r5 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
add_key$keyring(&(0x7f0000000280), &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r5)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
r4 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x1}, 0x0, 0x0, r4)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r2)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-ioctl$sock_SIOCETHTOOL-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'veth1_macvtap\x00', &(0x7f0000000000)=@ethtool_perm_addr={0x4b, 0x50, "67856f081d9fc303c68bf9098547cc55cfcf22c9"}})
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-socketpair$nbd-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0))
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
r1 = add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
add_key$keyring(&(0x7f00000000c0), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, r1)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
add_key$keyring(&(0x7f0000000100), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in input_dev_uevent
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-syz_usb_connect
detailed listing:
executing program 0:
add_key$keyring(&(0x7f0000000300), &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, 0x0, 0x0)

program did not crash
testing program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45.443373918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
simplifying C reproducer
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program did not crash
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing compiled C program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: KASAN: slab-use-after-free Read in sur40_open
testing program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
validation run: crashed=true
testing program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in sur40_open
validation run: crashed=true
testing program (duration=45.443373918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0)

program crashed: KASAN: slab-use-after-free Read in input_dev_uevent
validation run: crashed=true
reproducing took 1h3m10.424929943s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff88802b56ac0a by task udevd/4979

CPU: 0 UID: 0 PID: 4979 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 string_nocheck lib/vsprintf.c:648 [inline]
 string+0x216/0x2d0 lib/vsprintf.c:730
 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
 add_uevent_var+0x1ce/0x460 lib/kobject_uevent.c:682
 input_dev_uevent+0x170/0x6e0 drivers/input/input.c:1676
 dev_uevent+0x537/0x870 drivers/base/core.c:2779
 uevent_show+0x1a0/0x310 drivers/base/core.c:2826
 dev_attr_show+0x58/0xc0 drivers/base/core.c:2487
 sysfs_kf_seq_show+0x331/0x490 fs/sysfs/file.c:65
 seq_read_iter+0x463/0xca0 fs/seq_file.c:231
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x595/0xa80 fs/read_write.c:574
 ksys_read+0x150/0x270 fs/read_write.c:716
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb92b4a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd5470cba0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fb92bc14880 RCX: 00007fb92b4a7407
RDX: 0000000000001000 RSI: 000055aa6b59e2c0 RDI: 000000000000000c
RBP: 00007fb92b5efff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007fb92b5efea0 R14: 0000000000000000 R15: 000055aa6b55a7a0
 </TASK>

Allocated by task 10:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 sur40_probe+0x16d/0xfa0 drivers/input/touchscreen/sur40.c:675
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2703
 hub_port_connect drivers/usb/core/hub.c:5575 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
 port_event drivers/usb/core/hub.c:5879 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5961
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 10:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x1c5/0x640 mm/slub.c:6692
 sur40_probe+0x918/0xfa0 drivers/input/touchscreen/sur40.c:816
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2703
 hub_port_connect drivers/usb/core/hub.c:5575 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
 port_event drivers/usb/core/hub.c:5879 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5961
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88802b56a000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 3082 bytes inside of
 freed 4096-byte region [ffff88802b56a000, ffff88802b56b000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b568
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b005140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b005140 dead000000000100 dead000000000122
head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4989, tgid 4989 (udevd), ts 44031026238, free_ts 43938304635
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3380
 new_slab mm/slub.c:3426 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0x485/0x720 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x283/0x560 security/tomoyo/file.c:827
 security_inode_getattr+0x12b/0x310 security/security.c:1895
 vfs_getattr+0x23/0x70 fs/stat.c:259
 vfs_statx_path+0x2b/0x230 fs/stat.c:299
 vfs_statx+0x12e/0x200 fs/stat.c:356
 vfs_fstatat+0x11b/0x170 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat fs/stat.c:532 [inline]
 __x64_sys_newfstatat+0x151/0x200 fs/stat.c:532
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
page last free pid 4986 tgid 4986 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5741
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4931
 alloc_filename fs/namei.c:147 [inline]
 do_getname+0x2e/0x250 fs/namei.c:187
 class_filename_uflags_constructor include/linux/fs.h:2567 [inline]
 do_fchmodat+0xca/0x230 fs/open.c:678
 __do_sys_chmod fs/open.c:706 [inline]
 __se_sys_chmod fs/open.c:704 [inline]
 __x64_sys_chmod+0x62/0x70 fs/open.c:704
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802b56ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802b56ab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802b56ac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88802b56ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802b56ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff88802b56ac0a by task udevd/4979

CPU: 0 UID: 0 PID: 4979 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 string_nocheck lib/vsprintf.c:648 [inline]
 string+0x216/0x2d0 lib/vsprintf.c:730
 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
 add_uevent_var+0x1ce/0x460 lib/kobject_uevent.c:682
 input_dev_uevent+0x170/0x6e0 drivers/input/input.c:1676
 dev_uevent+0x537/0x870 drivers/base/core.c:2779
 uevent_show+0x1a0/0x310 drivers/base/core.c:2826
 dev_attr_show+0x58/0xc0 drivers/base/core.c:2487
 sysfs_kf_seq_show+0x331/0x490 fs/sysfs/file.c:65
 seq_read_iter+0x463/0xca0 fs/seq_file.c:231
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x595/0xa80 fs/read_write.c:574
 ksys_read+0x150/0x270 fs/read_write.c:716
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb92b4a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd5470cba0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fb92bc14880 RCX: 00007fb92b4a7407
RDX: 0000000000001000 RSI: 000055aa6b59e2c0 RDI: 000000000000000c
RBP: 00007fb92b5efff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007fb92b5efea0 R14: 0000000000000000 R15: 000055aa6b55a7a0
 </TASK>

Allocated by task 10:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 sur40_probe+0x16d/0xfa0 drivers/input/touchscreen/sur40.c:675
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2703
 hub_port_connect drivers/usb/core/hub.c:5575 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
 port_event drivers/usb/core/hub.c:5879 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5961
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 10:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x1c5/0x640 mm/slub.c:6692
 sur40_probe+0x918/0xfa0 drivers/input/touchscreen/sur40.c:816
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2703
 hub_port_connect drivers/usb/core/hub.c:5575 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
 port_event drivers/usb/core/hub.c:5879 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5961
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88802b56a000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 3082 bytes inside of
 freed 4096-byte region [ffff88802b56a000, ffff88802b56b000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b568
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b005140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b005140 dead000000000100 dead000000000122
head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4989, tgid 4989 (udevd), ts 44031026238, free_ts 43938304635
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3266 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3380
 new_slab mm/slub.c:3426 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7310
 refill_sheaf mm/slub.c:2804 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4675
 alloc_from_pcs mm/slub.c:4773 [inline]
 slab_alloc_node mm/slub.c:4905 [inline]
 __do_kmalloc_node mm/slub.c:5333 [inline]
 __kmalloc_noprof+0x485/0x720 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x283/0x560 security/tomoyo/file.c:827
 security_inode_getattr+0x12b/0x310 security/security.c:1895
 vfs_getattr+0x23/0x70 fs/stat.c:259
 vfs_statx_path+0x2b/0x230 fs/stat.c:299
 vfs_statx+0x12e/0x200 fs/stat.c:356
 vfs_fstatat+0x11b/0x170 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat fs/stat.c:532 [inline]
 __x64_sys_newfstatat+0x151/0x200 fs/stat.c:532
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
page last free pid 4986 tgid 4986 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5741
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4931
 alloc_filename fs/namei.c:147 [inline]
 do_getname+0x2e/0x250 fs/namei.c:187
 class_filename_uflags_constructor include/linux/fs.h:2567 [inline]
 do_fchmodat+0xca/0x230 fs/open.c:678
 __do_sys_chmod fs/open.c:706 [inline]
 __se_sys_chmod fs/open.c:704 [inline]
 __x64_sys_chmod+0x62/0x70 fs/open.c:704
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802b56ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802b56ab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802b56ac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88802b56ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802b56ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================