Extracting prog: 1m12.555179203s
Minimizing prog: 28m49.049211204s
Simplifying prog options: 0s
Extracting C: 56.035041408s
Simplifying C: 8m57.123645889s


extracting reproducer from 37 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark-socket$nl_route-sendmsg$nl_route_sched-ioctl$VHOST_SET_VRING_ADDR
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, 0x0, 0x0)
ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
single: successfully extracted reproducer
found reproducer with 19 syscalls
minimizing guilty program
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark-socket$nl_route-sendmsg$nl_route_sched
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, 0x0, 0x0)

program crashed: KASAN: use-after-free Read in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark-socket$nl_route
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1-fanotify_mark
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
r1 = fanotify_init(0x8, 0x0) (fail_nth: 4)
r2 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r2, 0x0, 0x0)
epoll_create1(0x0)
fanotify_mark(r1, 0x21, 0x8000019, 0xffffffffffffffff, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun-epoll_create1
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)
r1 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r1, 0x0, 0x0)
epoll_create1(0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun-read$qrtrtun
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)
r1 = openat$qrtrtun(0xffffff9c, 0x0, 0x101840)
read$qrtrtun(r1, 0x0, 0x0)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init-openat$qrtrtun
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)
openat$qrtrtun(0xffffff9c, 0x0, 0x101840)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-eventfd
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
eventfd(0x0)

program did not crash
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-getrlimit-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
getrlimit(0x4, &(0x7f0000000040))
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: slab-out-of-bounds Read in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$TUNSETIFF-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_open_dev$MSR-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-sched_setscheduler-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-prlimit64-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-ioctl$vim2m_VIDIOC_S_FMT-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}], 0x0, 0x0, 0x0, 0x0, 0x2}})
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-recvmmsg-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
recvmmsg(0xffffffffffffffff, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f0000000180)=[{0x0}, {0x0}], 0x2}, 0x7}], 0x1, 0x2, 0x0)
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$ifreq_SIOCGIFINDEX_vcan-fanotify_init
detailed listing:
executing program 0:
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'})
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
detailed listing:
executing program 0:
fanotify_init(0x8, 0x0) (fail_nth: 4)

program crashed: KASAN: use-after-free Write in __put_unused_fd
testing program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
detailed listing:
executing program 0:
fanotify_init(0x8, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m5.372164398s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
simplifying C reproducer
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
testing compiled C program (duration=1m5.372164398s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init
program crashed: KASAN: use-after-free Write in __put_unused_fd
reproducing took 39m54.763094162s
repro crashed as (corrupted=false):
RAX: ffffffffffffffda RBX: 00007ffc3264b100 RCX: 00007f8030e60669
RDX: 00007f8030e5f8a0 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffc3264ae87 R09: 00000000000000a0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
==================================================================
BUG: KASAN: use-after-free in instrument_write include/linux/instrumented.h:40 [inline]
BUG: KASAN: use-after-free in ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
BUG: KASAN: use-after-free in __clear_open_fd fs/file.c:324 [inline]
BUG: KASAN: use-after-free in __put_unused_fd+0xdb/0x2a0 fs/file.c:600
Write of size 8 at addr ffff88809c5ab588 by task syz-executor189/5832

CPU: 0 UID: 0 PID: 5832 Comm: syz-executor189 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_write include/linux/instrumented.h:40 [inline]
 ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
 __clear_open_fd fs/file.c:324 [inline]
 __put_unused_fd+0xdb/0x2a0 fs/file.c:600
 put_unused_fd+0x5c/0x70 fs/file.c:609
 __do_sys_fanotify_init fs/notify/fanotify/fanotify_user.c:1628 [inline]
 __se_sys_fanotify_init+0x800/0x970 fs/notify/fanotify/fanotify_user.c:1466
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8030e60669
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3264b0e8 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
RAX: ffffffffffffffda RBX: 00007ffc3264b100 RCX: 00007f8030e60669
RDX: 00007f8030e5f8a0 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffc3264ae87 R09: 00000000000000a0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c5ab
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0002716ac8 ffffea0002716ac8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88809c5ab480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88809c5ab500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88809c5ab580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff88809c5ab600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88809c5ab680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================

final repro crashed as (corrupted=false):
RAX: ffffffffffffffda RBX: 00007ffc3264b100 RCX: 00007f8030e60669
RDX: 00007f8030e5f8a0 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffc3264ae87 R09: 00000000000000a0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
==================================================================
BUG: KASAN: use-after-free in instrument_write include/linux/instrumented.h:40 [inline]
BUG: KASAN: use-after-free in ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
BUG: KASAN: use-after-free in __clear_open_fd fs/file.c:324 [inline]
BUG: KASAN: use-after-free in __put_unused_fd+0xdb/0x2a0 fs/file.c:600
Write of size 8 at addr ffff88809c5ab588 by task syz-executor189/5832

CPU: 0 UID: 0 PID: 5832 Comm: syz-executor189 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_write include/linux/instrumented.h:40 [inline]
 ___clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:44 [inline]
 __clear_open_fd fs/file.c:324 [inline]
 __put_unused_fd+0xdb/0x2a0 fs/file.c:600
 put_unused_fd+0x5c/0x70 fs/file.c:609
 __do_sys_fanotify_init fs/notify/fanotify/fanotify_user.c:1628 [inline]
 __se_sys_fanotify_init+0x800/0x970 fs/notify/fanotify/fanotify_user.c:1466
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8030e60669
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3264b0e8 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
RAX: ffffffffffffffda RBX: 00007ffc3264b100 RCX: 00007f8030e60669
RDX: 00007f8030e5f8a0 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 0000000000000001 R08: 00007ffc3264ae87 R09: 00000000000000a0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c5ab
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0002716ac8 ffffea0002716ac8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffff88809c5ab480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88809c5ab500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88809c5ab580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                      ^
 ffff88809c5ab600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88809c5ab680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================