Extracting prog: 1m58.360213241s
Minimizing prog: 27m43.458991658s
Simplifying prog options: 0s
Extracting C: 1m10.052444855s
Simplifying C: 7m50.203144953s


extracting reproducer from 37 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark-socket$nl_route-sendmsg$nl_route_sched-ioctl$VHOST_SET_VRING_ADDR
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, 0x0, 0x0)
ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0)

program crashed: KASAN: slab-out-of-bounds Write in __put_unused_fd
single: successfully extracted reproducer
found reproducer with 19 syscalls
minimizing guilty program
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark-socket$nl_route-sendmsg$nl_route_sched
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, 0x0, 0x0)

program crashed: KASAN: slab-use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark-socket$nl_route
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)
r1 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r1, 0x0, 0x0)
epoll_create1(0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)
r1 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r1, 0x0, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)
openat$qrtrtun(0xffffff9c, 0x0, 0x101840)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: slab-out-of-bounds Read in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)

program did not crash
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: slab-out-of-bounds Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
detailed listing:
executing program 0:
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
detailed listing:
executing program 0:
fanotify_init(0x8, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=53.494006546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
simplifying C reproducer
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program did not crash
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program did not crash
testing compiled C program (duration=53.494006546s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
reproducing took 38m42.074824457s
repro crashed as (corrupted=false):
RAX: ffffffffffffffda RBX: 00007ffffb31dd60 RCX: 00007f5733169979
RDX: 00007f5733168c50 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffffb31daf7 R09: 0000000000000034
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffffb31dfd8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
==================================================================
BUG: KASAN: use-after-free in instrument_write include/linux/instrumented.h:40 [inline]
BUG: KASAN: use-after-free in ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
BUG: KASAN: use-after-free in __clear_open_fd fs/file.c:324 [inline]
BUG: KASAN: use-after-free in __put_unused_fd+0xdb/0x2a0 fs/file.c:600
Write of size 8 at addr ffff88804440b588 by task syz-executor140/5826

CPU: 0 UID: 0 PID: 5826 Comm: syz-executor140 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_write include/linux/instrumented.h:40 [inline]
 ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
 __clear_open_fd fs/file.c:324 [inline]
 __put_unused_fd+0xdb/0x2a0 fs/file.c:600
 put_unused_fd+0x5c/0x70 fs/file.c:609
 __do_sys_fanotify_init fs/notify/fanotify/fanotify_user.c:1628 [inline]
 __se_sys_fanotify_init+0x800/0x970 fs/notify/fanotify/fanotify_user.c:1466
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5733169979
Code: d8 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffffb31dd58 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
RAX: ffffffffffffffda RBX: 00007ffffb31dd60 RCX: 00007f5733169979
RDX: 00007f5733168c50 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffffb31daf7 R09: 0000000000000034
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffffb31dfd8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4440b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 1, tgid 1 (swapper/0), ts 15207279371, free_ts 15592290212
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
 split_free_pages+0xe1/0x2d0 mm/page_alloc.c:6374
 alloc_contig_range_noprof+0x10eb/0x1770 mm/page_alloc.c:6551
 __alloc_contig_pages mm/page_alloc.c:6581 [inline]
 alloc_contig_pages_noprof+0x4b3/0x5c0 mm/page_alloc.c:6663
 debug_vm_pgtable_alloc_huge_page+0xaf/0x100 mm/debug_vm_pgtable.c:1084
 init_args+0x83b/0xb20 mm/debug_vm_pgtable.c:1266
 debug_vm_pgtable+0xe0/0x550 mm/debug_vm_pgtable.c:1304
 do_one_initcall+0x248/0x870 init/main.c:1267
 do_initcall_level+0x157/0x210 init/main.c:1329
 do_initcalls+0x3f/0x80 init/main.c:1345
 kernel_init_freeable+0x435/0x5d0 init/main.c:1578
 kernel_init+0x1d/0x2b0 init/main.c:1467
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 1 tgid 1 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0xe0d/0x10e0 mm/page_alloc.c:2660
 free_contig_range+0x14c/0x430 mm/page_alloc.c:6697
 destroy_args+0x92/0x910 mm/debug_vm_pgtable.c:1017
 debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1397
 do_one_initcall+0x248/0x870 init/main.c:1267
 do_initcall_level+0x157/0x210 init/main.c:1329
 do_initcalls+0x3f/0x80 init/main.c:1345
 kernel_init_freeable+0x435/0x5d0 init/main.c:1578
 kernel_init+0x1d/0x2b0 init/main.c:1467
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
 ffff88804440b480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88804440b500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804440b580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff88804440b600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88804440b680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

final repro crashed as (corrupted=false):
RAX: ffffffffffffffda RBX: 00007ffffb31dd60 RCX: 00007f5733169979
RDX: 00007f5733168c50 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffffb31daf7 R09: 0000000000000034
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffffb31dfd8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
==================================================================
BUG: KASAN: use-after-free in instrument_write include/linux/instrumented.h:40 [inline]
BUG: KASAN: use-after-free in ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
BUG: KASAN: use-after-free in __clear_open_fd fs/file.c:324 [inline]
BUG: KASAN: use-after-free in __put_unused_fd+0xdb/0x2a0 fs/file.c:600
Write of size 8 at addr ffff88804440b588 by task syz-executor140/5826

CPU: 0 UID: 0 PID: 5826 Comm: syz-executor140 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_write include/linux/instrumented.h:40 [inline]
 ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
 __clear_open_fd fs/file.c:324 [inline]
 __put_unused_fd+0xdb/0x2a0 fs/file.c:600
 put_unused_fd+0x5c/0x70 fs/file.c:609
 __do_sys_fanotify_init fs/notify/fanotify/fanotify_user.c:1628 [inline]
 __se_sys_fanotify_init+0x800/0x970 fs/notify/fanotify/fanotify_user.c:1466
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5733169979
Code: d8 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffffb31dd58 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
RAX: ffffffffffffffda RBX: 00007ffffb31dd60 RCX: 00007f5733169979
RDX: 00007f5733168c50 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffffb31daf7 R09: 0000000000000034
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffffb31dfd8 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4440b
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 1, tgid 1 (swapper/0), ts 15207279371, free_ts 15592290212
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f4/0x240 mm/page_alloc.c:1551
 split_free_pages+0xe1/0x2d0 mm/page_alloc.c:6374
 alloc_contig_range_noprof+0x10eb/0x1770 mm/page_alloc.c:6551
 __alloc_contig_pages mm/page_alloc.c:6581 [inline]
 alloc_contig_pages_noprof+0x4b3/0x5c0 mm/page_alloc.c:6663
 debug_vm_pgtable_alloc_huge_page+0xaf/0x100 mm/debug_vm_pgtable.c:1084
 init_args+0x83b/0xb20 mm/debug_vm_pgtable.c:1266
 debug_vm_pgtable+0xe0/0x550 mm/debug_vm_pgtable.c:1304
 do_one_initcall+0x248/0x870 init/main.c:1267
 do_initcall_level+0x157/0x210 init/main.c:1329
 do_initcalls+0x3f/0x80 init/main.c:1345
 kernel_init_freeable+0x435/0x5d0 init/main.c:1578
 kernel_init+0x1d/0x2b0 init/main.c:1467
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 1 tgid 1 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0xe0d/0x10e0 mm/page_alloc.c:2660
 free_contig_range+0x14c/0x430 mm/page_alloc.c:6697
 destroy_args+0x92/0x910 mm/debug_vm_pgtable.c:1017
 debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1397
 do_one_initcall+0x248/0x870 init/main.c:1267
 do_initcall_level+0x157/0x210 init/main.c:1329
 do_initcalls+0x3f/0x80 init/main.c:1345
 kernel_init_freeable+0x435/0x5d0 init/main.c:1578
 kernel_init+0x1d/0x2b0 init/main.c:1467
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
 ffff88804440b480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88804440b500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804440b580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff88804440b600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88804440b680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================