Extracting prog: 1m11.814841805s
Minimizing prog: 11m35.044118344s
Simplifying prog options: 4m8.220798052s
Extracting C: 1m12.714064261s
Simplifying C: 4m16.581127847s


extracting reproducer from 25 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$selinux_policy-openat$uinput-ioctl$UI_SET_SNDBIT-fcntl$addseals-socket$inet-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-sendmsg$inet6-socket-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay
detailed listing:
executing program 0:
r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x6)
fcntl$addseals(r0, 0x409, 0xe)
socket$inet(0x2, 0x2, 0x1)
prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000180)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000780)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000800), 0x318, 0x0)
recvmmsg(r3, &(0x7f0000000840), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000880)=0x100000000e2)
sendmsg$inet6(0xffffffffffffffff, 0x0, 0xc000)
socket(0x8000000010, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x1c0)
syz_mount_image$fuse(0x0, &(0x7f00000002c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x8, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
mount$overlay(0x0, &(0x7f00000003c0)='./bus\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Write in crypt_dec_pending
single: successfully extracted reproducer
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
pwrite64(0xffffffffffffffff, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
r1 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r1, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, 0x0)
r1 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r1, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
ioctl$DM_DEV_CREATE(0xffffffffffffffff, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r0=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(0xffffffffffffffff, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(0xffffffffffffffff, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r0)
r1 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r1, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, 0x0, 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, 0x0)
r1 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r1, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, 0x0)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, 0x0)
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, 0x0, 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, 0x0, 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0), 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Read in process_one_work
a never seen crash title: KASAN: use-after-free Read in process_one_work, ignore
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Read in pwq_activate_inactive_work
a never seen crash title: KASAN: use-after-free Read in pwq_activate_inactive_work, ignore
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Read in process_one_work
a never seen crash title: KASAN: use-after-free Read in process_one_work, ignore
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Write in crypt_dec_pending
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Write in crypt_dec_pending
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Write in crypt_dec_pending
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Write in crypt_dec_pending
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Write in crypt_dec_pending
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Read in process_one_work
a never seen crash title: KASAN: use-after-free Read in process_one_work, ignore
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Write in crypt_dec_pending
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
program crashed: KASAN: use-after-free Read in percpu_rwsem_async_destroy
a never seen crash title: KASAN: use-after-free Read in percpu_rwsem_async_destroy, ignore
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Write in crypt_dec_pending
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Write in crypt_dec_pending
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND-mknodat$dm-openat$dm_dev-pwrite64
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '1\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000840)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@crypt={0x0, 0x2000, 0x0, 0xa0, 'crypt\x00', {'aes-xts-plain64', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, '0', 0x20, {@ram={'/dev/ram', 0x1}, 0x20, '0'}, ' 1 integrity:8:none'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}})
mknodat$dm(0xffffff9c, &(0x7f0000000640)='./dm0\x00', 0x6180, r1)
r2 = openat$dm_dev(0xffffff9c, &(0x7f0000000680)='./dm0\x00', 0x2, 0x0)
pwrite64(r2, &(0x7f00000006c0)="0102030405060708", 0x8, 0x0)

program crashed: KASAN: use-after-free Write in crypt_dec_pending
validation run: crashed=true
reproducing took 23m14.54172688s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3526 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0xc4/0x270 mm/slub.c:4588

CPU: 1 PID: 39 Comm: kworker/1:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: kcryptd_io/253:0 kcryptd_io_read_work
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 kasan_report_invalid_free+0x58/0x90 mm/kasan/report.c:370
 ____kasan_slab_free+0x13d/0x160 mm/kasan/common.c:-1
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kfree+0xc4/0x270 mm/slub.c:4588
 crypt_dec_pending+0x1dd/0x2a0 drivers/md/dm-crypt.c:1755
 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1853
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 ____kasan_kmalloc mm/kasan/common.c:512 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521
 kasan_kmalloc include/linux/kasan.h:227 [inline]
 __kmalloc+0x13d/0x2c0 mm/slub.c:4436
 kmalloc include/linux/slab.h:624 [inline]
 crypt_map+0x3d1/0xb90 drivers/md/dm-crypt.c:3386
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kfree+0xc4/0x270 mm/slub.c:4588
 crypt_dec_pending+0x1dd/0x2a0 drivers/md/dm-crypt.c:1755
 kcryptd_io_read+0x371/0x480 drivers/md/dm-crypt.c:1837
 crypt_map+0x4c5/0xb90 drivers/md/dm-crypt.c:3401
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff88810fa9ed80
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 64-byte region [ffff88810fa9ed80, ffff88810fa9edc0)
The buggy address belongs to the page:
page:ffffea00043ea780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fa9e
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea00043c87c0 0000000300000003 ffff888100042780
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 102, ts 5489350301, free_ts 5489322829
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1937 [inline]
 new_slab+0xa0/0x4d0 mm/slub.c:2000
 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033
 __slab_alloc+0x49/0x90 mm/slub.c:3120
 slab_alloc_node mm/slub.c:3211 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc_trace+0x146/0x270 mm/slub.c:3272
 kmalloc include/linux/slab.h:619 [inline]
 kernfs_get_open_node fs/kernfs/file.c:552 [inline]
 kernfs_fop_open+0x8c0/0xbb0 fs/kernfs/file.c:698
 do_dentry_open+0x82a/0x1010 fs/open.c:828
 vfs_open+0x73/0x80 fs/open.c:960
 do_open fs/namei.c:3616 [inline]
 path_openat+0x26e6/0x2f80 fs/namei.c:3750
 do_filp_open+0x1df/0x400 fs/namei.c:3777
 do_sys_openat2+0x15e/0x7f0 fs/open.c:1236
 do_sys_open fs/open.c:1252 [inline]
 __do_sys_openat fs/open.c:1268 [inline]
 __se_sys_openat fs/open.c:1263 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1263
 x64_sys_call+0x219/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page+0xae/0x540 mm/page_alloc.c:3618
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x6c/0x100 mm/page_alloc.c:5900
 free_pages+0x82/0x90 mm/page_alloc.c:5911
 selinux_genfs_get_sid+0x20b/0x250 security/selinux/hooks.c:1382
 inode_doinit_with_dentry+0x884/0xd90 security/selinux/hooks.c:1577
 selinux_d_instantiate+0x27/0x40 security/selinux/hooks.c:6496
 security_d_instantiate+0x9e/0xf0 security/security.c:2075
 d_splice_alias+0x6d/0x390 fs/dcache.c:3073
 kernfs_iop_lookup+0x2c2/0x310 fs/kernfs/dir.c:1175
 lookup_open fs/namei.c:3448 [inline]
 open_last_lookups fs/namei.c:3540 [inline]
 path_openat+0x1436/0x2f80 fs/namei.c:3747
 do_filp_open+0x1df/0x400 fs/namei.c:3777
 do_sys_openat2+0x15e/0x7f0 fs/open.c:1236
 do_sys_open fs/open.c:1252 [inline]
 __do_sys_openat fs/open.c:1268 [inline]
 __se_sys_openat fs/open.c:1263 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1263
 x64_sys_call+0x219/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff88810fa9ec80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88810fa9ed00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88810fa9ed80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff88810fa9ee00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88810fa9ee80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
==================================================================
BUG: KASAN: use-after-free in crypt_dec_pending+0x275/0x2a0 drivers/md/dm-crypt.c:1757
Write of size 1 at addr ffff88812b21b332 by task kworker/1:1/39

CPU: 1 PID: 39 Comm: kworker/1:1 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: kcryptd_io/253:0 kcryptd_io_read_work
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/report_generic.c:311
 crypt_dec_pending+0x275/0x2a0 drivers/md/dm-crypt.c:1757
 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1853
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 __kasan_slab_alloc+0xb7/0xe0 mm/kasan/common.c:466
 kasan_slab_alloc include/linux/kasan.h:217 [inline]
 slab_post_alloc_hook+0x4f/0x2b0 mm/slab.h:550
 slab_alloc_node mm/slub.c:3245 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc+0xf7/0x260 mm/slub.c:3260
 mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
 mempool_alloc+0x167/0x4c0 mm/mempool.c:393
 bio_alloc_bioset+0x124/0x910 block/bio.c:469
 alloc_io drivers/md/dm.c:536 [inline]
 init_clone_info drivers/md/dm.c:1536 [inline]
 __split_and_process_bio drivers/md/dm.c:1550 [inline]
 dm_submit_bio+0x211/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kmem_cache_free+0x100/0x320 mm/slub.c:3544
 mempool_free_slab+0x1d/0x30 mm/mempool.c:520
 mempool_free+0xd5/0x330 mm/mempool.c:502
 bio_free+0x255/0x360 block/bio.c:239
 bio_put+0x91/0x610 block/bio.c:700
 free_io drivers/md/dm.c:562 [inline]
 dm_io_dec_pending+0x314/0xa50 drivers/md/dm.c:844
 __split_and_process_bio drivers/md/dm.c:1584 [inline]
 dm_submit_bio+0xc1b/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd2/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 insert_work+0x51/0x310 kernel/workqueue.c:1373
 __queue_work+0x8e1/0xc60 kernel/workqueue.c:1539
 queue_work_on+0xde/0x150 kernel/workqueue.c:1566
 queue_work include/linux/workqueue.h:510 [inline]
 kcryptd_queue_read drivers/md/dm-crypt.c:1861 [inline]
 crypt_map+0x5bf/0xb90 drivers/md/dm-crypt.c:3402
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff88812b21af80
 which belongs to the cache bio-1080 of size 1080
The buggy address is located 946 bytes inside of
 1080-byte region [ffff88812b21af80, ffff88812b21b3b8)
The buggy address belongs to the page:
page:ffffea0004ac8600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12b218
head:ffffea0004ac8600 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810b257e00
raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 371, ts 25967350952, free_ts 0
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1937 [inline]
 new_slab+0xa0/0x4d0 mm/slub.c:2000
 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033
 __slab_alloc+0x49/0x90 mm/slub.c:3120
 slab_alloc_node mm/slub.c:3211 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc+0x138/0x260 mm/slub.c:3260
 mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
 mempool_init_node+0x1e3/0x4a0 mm/mempool.c:202
 mempool_init+0x3c/0x50 mm/mempool.c:231
 mempool_init_slab_pool include/linux/mempool.h:62 [inline]
 bioset_init+0x205/0x5f0 block/bio.c:1627
 bioset_init_from_src+0xb3/0x120 block/bio.c:1668
 __bind_mempools drivers/md/dm.c:1901 [inline]
 __bind drivers/md/dm.c:1974 [inline]
 dm_swap_table+0x442/0x610 drivers/md/dm.c:2362
 do_resume drivers/md/dm-ioctl.c:1176 [inline]
 dev_suspend+0x1e0/0x740 drivers/md/dm-ioctl.c:1226
 ctl_ioctl drivers/md/dm-ioctl.c:2024 [inline]
 dm_ctl_ioctl+0x8ee/0xca0 drivers/md/dm-ioctl.c:2046
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88812b21b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88812b21b280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88812b21b300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff88812b21b380: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
 ffff88812b21b400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3526 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0xc4/0x270 mm/slub.c:4588

CPU: 1 PID: 39 Comm: kworker/1:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: kcryptd_io/253:0 kcryptd_io_read_work
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 kasan_report_invalid_free+0x58/0x90 mm/kasan/report.c:370
 ____kasan_slab_free+0x13d/0x160 mm/kasan/common.c:-1
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kfree+0xc4/0x270 mm/slub.c:4588
 crypt_dec_pending+0x1dd/0x2a0 drivers/md/dm-crypt.c:1755
 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1853
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 ____kasan_kmalloc mm/kasan/common.c:512 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521
 kasan_kmalloc include/linux/kasan.h:227 [inline]
 __kmalloc+0x13d/0x2c0 mm/slub.c:4436
 kmalloc include/linux/slab.h:624 [inline]
 crypt_map+0x3d1/0xb90 drivers/md/dm-crypt.c:3386
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kfree+0xc4/0x270 mm/slub.c:4588
 crypt_dec_pending+0x1dd/0x2a0 drivers/md/dm-crypt.c:1755
 kcryptd_io_read+0x371/0x480 drivers/md/dm-crypt.c:1837
 crypt_map+0x4c5/0xb90 drivers/md/dm-crypt.c:3401
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff88810fa9ed80
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 64-byte region [ffff88810fa9ed80, ffff88810fa9edc0)
The buggy address belongs to the page:
page:ffffea00043ea780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fa9e
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea00043c87c0 0000000300000003 ffff888100042780
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 102, ts 5489350301, free_ts 5489322829
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1937 [inline]
 new_slab+0xa0/0x4d0 mm/slub.c:2000
 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033
 __slab_alloc+0x49/0x90 mm/slub.c:3120
 slab_alloc_node mm/slub.c:3211 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc_trace+0x146/0x270 mm/slub.c:3272
 kmalloc include/linux/slab.h:619 [inline]
 kernfs_get_open_node fs/kernfs/file.c:552 [inline]
 kernfs_fop_open+0x8c0/0xbb0 fs/kernfs/file.c:698
 do_dentry_open+0x82a/0x1010 fs/open.c:828
 vfs_open+0x73/0x80 fs/open.c:960
 do_open fs/namei.c:3616 [inline]
 path_openat+0x26e6/0x2f80 fs/namei.c:3750
 do_filp_open+0x1df/0x400 fs/namei.c:3777
 do_sys_openat2+0x15e/0x7f0 fs/open.c:1236
 do_sys_open fs/open.c:1252 [inline]
 __do_sys_openat fs/open.c:1268 [inline]
 __se_sys_openat fs/open.c:1263 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1263
 x64_sys_call+0x219/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1474 [inline]
 free_pcp_prepare mm/page_alloc.c:1546 [inline]
 free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536
 free_unref_page+0xae/0x540 mm/page_alloc.c:3618
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x6c/0x100 mm/page_alloc.c:5900
 free_pages+0x82/0x90 mm/page_alloc.c:5911
 selinux_genfs_get_sid+0x20b/0x250 security/selinux/hooks.c:1382
 inode_doinit_with_dentry+0x884/0xd90 security/selinux/hooks.c:1577
 selinux_d_instantiate+0x27/0x40 security/selinux/hooks.c:6496
 security_d_instantiate+0x9e/0xf0 security/security.c:2075
 d_splice_alias+0x6d/0x390 fs/dcache.c:3073
 kernfs_iop_lookup+0x2c2/0x310 fs/kernfs/dir.c:1175
 lookup_open fs/namei.c:3448 [inline]
 open_last_lookups fs/namei.c:3540 [inline]
 path_openat+0x1436/0x2f80 fs/namei.c:3747
 do_filp_open+0x1df/0x400 fs/namei.c:3777
 do_sys_openat2+0x15e/0x7f0 fs/open.c:1236
 do_sys_open fs/open.c:1252 [inline]
 __do_sys_openat fs/open.c:1268 [inline]
 __se_sys_openat fs/open.c:1263 [inline]
 __x64_sys_openat+0x136/0x160 fs/open.c:1263
 x64_sys_call+0x219/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80

Memory state around the buggy address:
 ffff88810fa9ec80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88810fa9ed00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88810fa9ed80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff88810fa9ee00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88810fa9ee80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
==================================================================
BUG: KASAN: use-after-free in crypt_dec_pending+0x275/0x2a0 drivers/md/dm-crypt.c:1757
Write of size 1 at addr ffff88812b21b332 by task kworker/1:1/39

CPU: 1 PID: 39 Comm: kworker/1:1 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: kcryptd_io/253:0 kcryptd_io_read_work
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/report_generic.c:311
 crypt_dec_pending+0x275/0x2a0 drivers/md/dm-crypt.c:1757
 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1853
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 __kasan_slab_alloc+0xb7/0xe0 mm/kasan/common.c:466
 kasan_slab_alloc include/linux/kasan.h:217 [inline]
 slab_post_alloc_hook+0x4f/0x2b0 mm/slab.h:550
 slab_alloc_node mm/slub.c:3245 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc+0xf7/0x260 mm/slub.c:3260
 mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
 mempool_alloc+0x167/0x4c0 mm/mempool.c:393
 bio_alloc_bioset+0x124/0x910 block/bio.c:469
 alloc_io drivers/md/dm.c:536 [inline]
 init_clone_info drivers/md/dm.c:1536 [inline]
 __split_and_process_bio drivers/md/dm.c:1550 [inline]
 dm_submit_bio+0x211/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 371:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kmem_cache_free+0x100/0x320 mm/slub.c:3544
 mempool_free_slab+0x1d/0x30 mm/mempool.c:520
 mempool_free+0xd5/0x330 mm/mempool.c:502
 bio_free+0x255/0x360 block/bio.c:239
 bio_put+0x91/0x610 block/bio.c:700
 free_io drivers/md/dm.c:562 [inline]
 dm_io_dec_pending+0x314/0xa50 drivers/md/dm.c:844
 __split_and_process_bio drivers/md/dm.c:1584 [inline]
 dm_submit_bio+0xc1b/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd2/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 insert_work+0x51/0x310 kernel/workqueue.c:1373
 __queue_work+0x8e1/0xc60 kernel/workqueue.c:1539
 queue_work_on+0xde/0x150 kernel/workqueue.c:1566
 queue_work include/linux/workqueue.h:510 [inline]
 kcryptd_queue_read drivers/md/dm-crypt.c:1861 [inline]
 crypt_map+0x5bf/0xb90 drivers/md/dm-crypt.c:3402
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff88812b21af80
 which belongs to the cache bio-1080 of size 1080
The buggy address is located 946 bytes inside of
 1080-byte region [ffff88812b21af80, ffff88812b21b3b8)
The buggy address belongs to the page:
page:ffffea0004ac8600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12b218
head:ffffea0004ac8600 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810b257e00
raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 371, ts 25967350952, free_ts 0
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1937 [inline]
 new_slab+0xa0/0x4d0 mm/slub.c:2000
 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033
 __slab_alloc+0x49/0x90 mm/slub.c:3120
 slab_alloc_node mm/slub.c:3211 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc+0x138/0x260 mm/slub.c:3260
 mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
 mempool_init_node+0x1e3/0x4a0 mm/mempool.c:202
 mempool_init+0x3c/0x50 mm/mempool.c:231
 mempool_init_slab_pool include/linux/mempool.h:62 [inline]
 bioset_init+0x205/0x5f0 block/bio.c:1627
 bioset_init_from_src+0xb3/0x120 block/bio.c:1668
 __bind_mempools drivers/md/dm.c:1901 [inline]
 __bind drivers/md/dm.c:1974 [inline]
 dm_swap_table+0x442/0x610 drivers/md/dm.c:2362
 do_resume drivers/md/dm-ioctl.c:1176 [inline]
 dev_suspend+0x1e0/0x740 drivers/md/dm-ioctl.c:1226
 ctl_ioctl drivers/md/dm-ioctl.c:2024 [inline]
 dm_ctl_ioctl+0x8ee/0xca0 drivers/md/dm-ioctl.c:2046
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88812b21b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88812b21b280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88812b21b300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff88812b21b380: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
 ffff88812b21b400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================