Extracting prog: 19m39.017473251s Minimizing prog: 3h9m48.899078019s Simplifying prog options: 0s Extracting C: 2m37.344438649s Simplifying C: 2h30m55.749476743s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$kcm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0x1, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$kcm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0x1, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 16m0s testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$kcm-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0x1, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: corrupted list in flow_block_cb_setup_simple single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$kcm-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0x1, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$kcm-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0x1, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={0x0, 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x3c}}, 0xc050) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB], 0x3c}}, 0xc050) program did not crash extracting C reproducer testing compiled C program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple simplifying C reproducer testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: unable to handle kernel NULL pointer dereference in flow_block_cb_setup_simple a never seen crash title: BUG: unable to handle kernel NULL pointer dereference in flow_block_cb_setup_simple, ignore testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: INFO: task hung in rtnl_lock validation run: crashed=true testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: unable to handle kernel NULL pointer dereference in flow_block_cb_setup_simple validation run: crashed=true testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: unable to handle kernel paging request in flow_block_cb_setup_simple validation run: crashed=true reproducing took 6h26m32.996319998s repro crashed as (corrupted=false): 8<--- cut here --- Unable to handle kernel paging request at virtual address 696c6583 when read [696c6583] *pgd=863dc003, *pmd=00000000 Internal error: Oops: 206 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 4907 Comm: syz.2.544 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at flow_block_cb_is_busy net/core/flow_offload.c:326 [inline] PC is at flow_block_cb_setup_simple+0x124/0x1fc net/core/flow_offload.c:351 LR is at nsim_setup_tc+0xa0/0xdc drivers/net/netdevsim/tc.c:87 pc : [<816ac070>] lr : [<80f0ca28>] psr: 30000013 sp : ee5ed868 ip : 696c6573 fp : ee5ed88c r10: 83f38b88 r9 : 00000001 r8 : 00000000 r7 : 85c5a700 r6 : ee5ed8b4 r5 : 80f0c938 r4 : 82b857b8 r3 : 6c65732e r2 : 80f0c938 r1 : 82b857b8 r0 : ee5ed8b4 Flags: nzCV IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8609e500 DAC: fffffffd Register r0 information: 2-page vmalloc region starting at 0xee5ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r1 information: non-slab/vmalloc memory Register r2 information: non-slab/vmalloc memory Register r3 information: non-paged memory Register r4 information: non-slab/vmalloc memory Register r5 information: non-slab/vmalloc memory Register r6 information: 2-page vmalloc region starting at 0xee5ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r7 information: slab kmalloc-cg-8k start 85c5a000 pointer offset 1792 size 8192 Register r8 information: NULL pointer Register r9 information: non-paged memory Register r10 information: slab kmalloc-cg-64 start 83f38b80 pointer offset 8 size 64 Register r11 information: 2-page vmalloc region starting at 0xee5ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: non-paged memory Process syz.2.544 (pid: 4907, stack limit = 0xee5ec000) Stack: (0xee5ed868 to 0xee5ee000) d860: 85c5a000 00000000 86317540 ee5ed8e0 00000000 00000001 d880: ee5ed8a4 ee5ed890 80f0ca28 816abf58 85c5a700 00000001 ee5ed96c ee5ed8a8 d8a0: 817f991c 80f0c994 ee5ed8e0 ee5edac8 00000003 00000000 00000001 00000000 d8c0: 85c13000 863175d0 ee5ed8c8 ee5ed8c8 82b857b8 ee5ed8e0 00000000 863175d0 d8e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d900: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d920: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d940: 00000000 00000000 00000000 213f1550 86042840 00000000 00000000 86317540 d960: ee5ed9a4 ee5ed970 817f9c78 817f98a8 86317568 83f38b80 00000000 8638fb00 d980: 86048288 81e7f1da ee5ed9b8 85c13000 85c13000 ee5edac0 ee5eda44 ee5ed9a8 d9a0: 817fa7bc 817f9bec 00000000 00000000 85c13000 00000000 00000000 00000000 d9c0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d9e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 da00: 00000000 00000000 00000000 00000000 00000000 213f1550 ee5eda44 86048284 da20: 860482a0 831fe540 00000011 85080000 85c13000 ee5edac0 ee5edb1c ee5eda48 da40: 817eb044 817fa624 00000001 83143c00 8567cb40 85c13000 ee5edb1c ee5eda68 da60: 817e80f8 817e71ec ee5edb84 86048288 ee5edaa4 ee5eda80 817d7ae4 80966f18 da80: 81d123e0 00000024 00000020 00000004 00000000 84f03914 00000001 82a14ff0 daa0: 86048288 85080000 831fe540 ee5edbf0 8567d000 86048280 ee5edab8 ee5edab8 dac0: ee5edac0 ee5edac0 85c13000 00000000 00000000 00000000 0000010f 00000000 dae0: 00000101 00000000 00000000 213f1550 80a01e34 8567cb40 ee5edb68 84f03958 db00: 00000011 85080000 81e7e028 81e7de58 ee5edca4 ee5edb20 8179bc68 817eae44 db20: 81e7e400 00000000 ee5edb84 000000ac 8567cb40 82509eb8 85080000 00000000 db40: 82e3d204 000000c8 82e3d2cc 85c13000 84f038c0 0000000a 81e7de58 8254373c db60: 831fe540 00000000 ee5edb68 ee5edb68 85c13000 85e0cc00 84f038f4 84f03904 db80: ee5edb84 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dba0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbe0: 00000000 00000000 00000000 00000000 00000000 84f03908 00000000 84f03914 dc00: 84f03928 00000000 00000000 00000000 00000000 00000000 84f03920 00000000 dc20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc60: 00000000 00000000 00000000 00000000 00000000 213f1550 80a01e34 831fe540 dc80: 00000000 84f038c0 00000014 000000ac 85c13000 86132584 ee5edcec ee5edca8 dca0: 8179bf74 8179b4a0 81e78c08 00000000 00000000 80a06140 81768870 00000000 dcc0: 00000000 213f1550 85e0cc64 85e0cc00 85e0cc64 000000ac 85fdc740 831fe540 dce0: ee5edd2c ee5edcf0 8176bff8 8179be58 831fe540 00000000 7fffffff 213f1550 dd00: 00000000 ee5edf28 831fe540 000000ac 86132400 00000000 00000000 00000000 dd20: ee5edd94 ee5edd30 8176c2d0 8176bd94 ee5edf28 835d9440 00000000 00000000 dd40: 00000000 000000ac 838fed80 00000000 0000010f 00000000 00000000 00000000 dd60: 000000ac 213f1550 ee5edd94 00000000 ee5edf28 835d9440 00000000 ee5eddd4 dd80: 00000000 00000000 ee5eddb4 ee5edd98 8162f7c4 8176c114 ee5edf28 835d9440 dda0: 00000000 00000000 ee5ede24 ee5eddb8 81630864 8162f78c ee5ede30 ee5edf38 ddc0: 00000000 ee5edde0 ee5ede24 ee5eddd8 81630b30 00000000 00000000 00000000 dde0: 00000000 00000000 00000000 00000000 00000000 213f1550 00000804 00000000 de00: ee5edf28 835d9440 00000000 00000000 2000c2c0 00000128 ee5edf1c ee5ede28 de20: 81630c64 81630638 00000000 00000001 00000000 20000380 000000ac 00000000 de40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dee0: 00000000 00000000 00000000 00000000 00000000 213f1550 00000003 85744500 df00: 2000c2c0 00000000 85744500 85080000 ee5edf94 ee5edf20 81632e3c 81630bd4 df20: 00000000 00000000 00000000 00000000 00000000 00000000 00010000 000000ac df40: 20000380 00000000 00000001 00000000 00000000 00000001 00000000 00000000 df60: 00000000 00000000 ecac8b10 213f1550 00000000 00000000 00000000 00356310 df80: 00000128 8020029c ee5edfa4 ee5edf98 81632ea4 81632dbc 00000000 ee5edfa8 dfa0: 80200060 81632e9c 00000000 00000000 00000003 2000c2c0 00000000 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000008 00000000 dfe0: 7e8637a0 7e863790 00018fa0 00130a50 60000010 00000003 00000000 00000000 Call trace: [<816abf4c>] (flow_block_cb_setup_simple) from [<80f0ca28>] (nsim_setup_tc+0xa0/0xdc drivers/net/netdevsim/tc.c:87) r9:00000001 r8:00000000 r7:ee5ed8e0 r6:86317540 r5:00000000 r4:85c5a000 [<80f0c988>] (nsim_setup_tc) from [<817f991c>] (nft_block_offload_cmd+0x80/0xf4 net/netfilter/nf_tables_offload.c:397) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_chain_offload_cmd net/netfilter/nf_tables_offload.c:451 [inline]) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_flow_block_chain+0x98/0x184 net/netfilter/nf_tables_offload.c:471) r7:86317540 r6:00000000 r5:00000000 r4:86042840 [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]) [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_rule_offload_commit+0x1a4/0x1f4 net/netfilter/nf_tables_offload.c:592) r10:ee5edac0 r9:85c13000 r8:85c13000 r7:ee5ed9b8 r6:81e7f1da r5:86048288 r4:8638fb00 [<817fa618>] (nft_flow_rule_offload_commit) from [<817eb044>] (nf_tables_commit+0x20c/0x2250 net/netfilter/nf_tables_api.c:10934) r10:ee5edac0 r9:85c13000 r8:85080000 r7:00000011 r6:831fe540 r5:860482a0 r4:86048284 [<817eae38>] (nf_tables_commit) from [<8179bc68>] (nfnetlink_rcv_batch+0x7d4/0x9b8 net/netfilter/nfnetlink.c:574) r10:81e7de58 r9:81e7e028 r8:85080000 r7:00000011 r6:84f03958 r5:ee5edb68 r4:8567cb40 [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]) [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv+0x128/0x15c net/netfilter/nfnetlink.c:665) r10:86132584 r9:85c13000 r8:000000ac r7:00000014 r6:84f038c0 r5:00000000 r4:831fe540 [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]) [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast+0x270/0x380 net/netlink/af_netlink.c:1345) r8:831fe540 r7:85fdc740 r6:000000ac r5:85e0cc64 r4:85e0cc00 [<8176bd88>] (netlink_unicast) from [<8176c2d0>] (netlink_sendmsg+0x1c8/0x444 net/netlink/af_netlink.c:1900) r10:00000000 r9:00000000 r8:00000000 r7:86132400 r6:000000ac r5:831fe540 r4:ee5edf28 [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (sock_sendmsg_nosec net/socket.c:800 [inline]) [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (__sock_sendmsg+0x44/0x78 net/socket.c:815) r10:00000000 r9:00000000 r8:ee5eddd4 r7:00000000 r6:835d9440 r5:ee5edf28 r4:00000000 [<8162f780>] (__sock_sendmsg) from [<81630864>] (____sys_sendmsg+0x238/0x2c4 net/socket.c:2709) r7:00000000 r6:00000000 r5:835d9440 r4:ee5edf28 [<8163062c>] (____sys_sendmsg) from [<81630c64>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2763) r10:00000128 r9:2000c2c0 r8:00000000 r7:00000000 r6:835d9440 r5:ee5edf28 r4:00000000 [<81630bc8>] (___sys_sendmsg) from [<81632e3c>] (__sys_sendmsg+0x8c/0xe0 net/socket.c:2795) r9:85080000 r8:85744500 r7:00000000 r6:2000c2c0 r5:85744500 r4:00000003 [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (__do_sys_sendmsg net/socket.c:2800 [inline]) [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (sys_sendmsg+0x14/0x18 net/socket.c:2798) r8:8020029c r7:00000128 r6:00356310 r5:00000000 r4:00000000 [<81632e90>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xee5edfa8 to 0xee5edff0) dfa0: 00000000 00000000 00000003 2000c2c0 00000000 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000008 00000000 dfe0: 7e8637a0 7e863790 00018fa0 00130a50 Code: ea00000a e59cc000 e154000c 0a000007 (e59c3010) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: ea00000a b 0x30 4: e59cc000 ldr ip, [ip] 8: e154000c cmp r4, ip c: 0a000007 beq 0x30 * 10: e59c3010 ldr r3, [ip, #16] <-- trapping instruction final repro crashed as (corrupted=false): 8<--- cut here --- Unable to handle kernel paging request at virtual address 696c6583 when read [696c6583] *pgd=863dc003, *pmd=00000000 Internal error: Oops: 206 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 4907 Comm: syz.2.544 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at flow_block_cb_is_busy net/core/flow_offload.c:326 [inline] PC is at flow_block_cb_setup_simple+0x124/0x1fc net/core/flow_offload.c:351 LR is at nsim_setup_tc+0xa0/0xdc drivers/net/netdevsim/tc.c:87 pc : [<816ac070>] lr : [<80f0ca28>] psr: 30000013 sp : ee5ed868 ip : 696c6573 fp : ee5ed88c r10: 83f38b88 r9 : 00000001 r8 : 00000000 r7 : 85c5a700 r6 : ee5ed8b4 r5 : 80f0c938 r4 : 82b857b8 r3 : 6c65732e r2 : 80f0c938 r1 : 82b857b8 r0 : ee5ed8b4 Flags: nzCV IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8609e500 DAC: fffffffd Register r0 information: 2-page vmalloc region starting at 0xee5ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r1 information: non-slab/vmalloc memory Register r2 information: non-slab/vmalloc memory Register r3 information: non-paged memory Register r4 information: non-slab/vmalloc memory Register r5 information: non-slab/vmalloc memory Register r6 information: 2-page vmalloc region starting at 0xee5ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r7 information: slab kmalloc-cg-8k start 85c5a000 pointer offset 1792 size 8192 Register r8 information: NULL pointer Register r9 information: non-paged memory Register r10 information: slab kmalloc-cg-64 start 83f38b80 pointer offset 8 size 64 Register r11 information: 2-page vmalloc region starting at 0xee5ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: non-paged memory Process syz.2.544 (pid: 4907, stack limit = 0xee5ec000) Stack: (0xee5ed868 to 0xee5ee000) d860: 85c5a000 00000000 86317540 ee5ed8e0 00000000 00000001 d880: ee5ed8a4 ee5ed890 80f0ca28 816abf58 85c5a700 00000001 ee5ed96c ee5ed8a8 d8a0: 817f991c 80f0c994 ee5ed8e0 ee5edac8 00000003 00000000 00000001 00000000 d8c0: 85c13000 863175d0 ee5ed8c8 ee5ed8c8 82b857b8 ee5ed8e0 00000000 863175d0 d8e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d900: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d920: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d940: 00000000 00000000 00000000 213f1550 86042840 00000000 00000000 86317540 d960: ee5ed9a4 ee5ed970 817f9c78 817f98a8 86317568 83f38b80 00000000 8638fb00 d980: 86048288 81e7f1da ee5ed9b8 85c13000 85c13000 ee5edac0 ee5eda44 ee5ed9a8 d9a0: 817fa7bc 817f9bec 00000000 00000000 85c13000 00000000 00000000 00000000 d9c0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d9e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 da00: 00000000 00000000 00000000 00000000 00000000 213f1550 ee5eda44 86048284 da20: 860482a0 831fe540 00000011 85080000 85c13000 ee5edac0 ee5edb1c ee5eda48 da40: 817eb044 817fa624 00000001 83143c00 8567cb40 85c13000 ee5edb1c ee5eda68 da60: 817e80f8 817e71ec ee5edb84 86048288 ee5edaa4 ee5eda80 817d7ae4 80966f18 da80: 81d123e0 00000024 00000020 00000004 00000000 84f03914 00000001 82a14ff0 daa0: 86048288 85080000 831fe540 ee5edbf0 8567d000 86048280 ee5edab8 ee5edab8 dac0: ee5edac0 ee5edac0 85c13000 00000000 00000000 00000000 0000010f 00000000 dae0: 00000101 00000000 00000000 213f1550 80a01e34 8567cb40 ee5edb68 84f03958 db00: 00000011 85080000 81e7e028 81e7de58 ee5edca4 ee5edb20 8179bc68 817eae44 db20: 81e7e400 00000000 ee5edb84 000000ac 8567cb40 82509eb8 85080000 00000000 db40: 82e3d204 000000c8 82e3d2cc 85c13000 84f038c0 0000000a 81e7de58 8254373c db60: 831fe540 00000000 ee5edb68 ee5edb68 85c13000 85e0cc00 84f038f4 84f03904 db80: ee5edb84 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dba0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbe0: 00000000 00000000 00000000 00000000 00000000 84f03908 00000000 84f03914 dc00: 84f03928 00000000 00000000 00000000 00000000 00000000 84f03920 00000000 dc20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc60: 00000000 00000000 00000000 00000000 00000000 213f1550 80a01e34 831fe540 dc80: 00000000 84f038c0 00000014 000000ac 85c13000 86132584 ee5edcec ee5edca8 dca0: 8179bf74 8179b4a0 81e78c08 00000000 00000000 80a06140 81768870 00000000 dcc0: 00000000 213f1550 85e0cc64 85e0cc00 85e0cc64 000000ac 85fdc740 831fe540 dce0: ee5edd2c ee5edcf0 8176bff8 8179be58 831fe540 00000000 7fffffff 213f1550 dd00: 00000000 ee5edf28 831fe540 000000ac 86132400 00000000 00000000 00000000 dd20: ee5edd94 ee5edd30 8176c2d0 8176bd94 ee5edf28 835d9440 00000000 00000000 dd40: 00000000 000000ac 838fed80 00000000 0000010f 00000000 00000000 00000000 dd60: 000000ac 213f1550 ee5edd94 00000000 ee5edf28 835d9440 00000000 ee5eddd4 dd80: 00000000 00000000 ee5eddb4 ee5edd98 8162f7c4 8176c114 ee5edf28 835d9440 dda0: 00000000 00000000 ee5ede24 ee5eddb8 81630864 8162f78c ee5ede30 ee5edf38 ddc0: 00000000 ee5edde0 ee5ede24 ee5eddd8 81630b30 00000000 00000000 00000000 dde0: 00000000 00000000 00000000 00000000 00000000 213f1550 00000804 00000000 de00: ee5edf28 835d9440 00000000 00000000 2000c2c0 00000128 ee5edf1c ee5ede28 de20: 81630c64 81630638 00000000 00000001 00000000 20000380 000000ac 00000000 de40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dee0: 00000000 00000000 00000000 00000000 00000000 213f1550 00000003 85744500 df00: 2000c2c0 00000000 85744500 85080000 ee5edf94 ee5edf20 81632e3c 81630bd4 df20: 00000000 00000000 00000000 00000000 00000000 00000000 00010000 000000ac df40: 20000380 00000000 00000001 00000000 00000000 00000001 00000000 00000000 df60: 00000000 00000000 ecac8b10 213f1550 00000000 00000000 00000000 00356310 df80: 00000128 8020029c ee5edfa4 ee5edf98 81632ea4 81632dbc 00000000 ee5edfa8 dfa0: 80200060 81632e9c 00000000 00000000 00000003 2000c2c0 00000000 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000008 00000000 dfe0: 7e8637a0 7e863790 00018fa0 00130a50 60000010 00000003 00000000 00000000 Call trace: [<816abf4c>] (flow_block_cb_setup_simple) from [<80f0ca28>] (nsim_setup_tc+0xa0/0xdc drivers/net/netdevsim/tc.c:87) r9:00000001 r8:00000000 r7:ee5ed8e0 r6:86317540 r5:00000000 r4:85c5a000 [<80f0c988>] (nsim_setup_tc) from [<817f991c>] (nft_block_offload_cmd+0x80/0xf4 net/netfilter/nf_tables_offload.c:397) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_chain_offload_cmd net/netfilter/nf_tables_offload.c:451 [inline]) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_flow_block_chain+0x98/0x184 net/netfilter/nf_tables_offload.c:471) r7:86317540 r6:00000000 r5:00000000 r4:86042840 [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]) [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_rule_offload_commit+0x1a4/0x1f4 net/netfilter/nf_tables_offload.c:592) r10:ee5edac0 r9:85c13000 r8:85c13000 r7:ee5ed9b8 r6:81e7f1da r5:86048288 r4:8638fb00 [<817fa618>] (nft_flow_rule_offload_commit) from [<817eb044>] (nf_tables_commit+0x20c/0x2250 net/netfilter/nf_tables_api.c:10934) r10:ee5edac0 r9:85c13000 r8:85080000 r7:00000011 r6:831fe540 r5:860482a0 r4:86048284 [<817eae38>] (nf_tables_commit) from [<8179bc68>] (nfnetlink_rcv_batch+0x7d4/0x9b8 net/netfilter/nfnetlink.c:574) r10:81e7de58 r9:81e7e028 r8:85080000 r7:00000011 r6:84f03958 r5:ee5edb68 r4:8567cb40 [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]) [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv+0x128/0x15c net/netfilter/nfnetlink.c:665) r10:86132584 r9:85c13000 r8:000000ac r7:00000014 r6:84f038c0 r5:00000000 r4:831fe540 [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]) [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast+0x270/0x380 net/netlink/af_netlink.c:1345) r8:831fe540 r7:85fdc740 r6:000000ac r5:85e0cc64 r4:85e0cc00 [<8176bd88>] (netlink_unicast) from [<8176c2d0>] (netlink_sendmsg+0x1c8/0x444 net/netlink/af_netlink.c:1900) r10:00000000 r9:00000000 r8:00000000 r7:86132400 r6:000000ac r5:831fe540 r4:ee5edf28 [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (sock_sendmsg_nosec net/socket.c:800 [inline]) [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (__sock_sendmsg+0x44/0x78 net/socket.c:815) r10:00000000 r9:00000000 r8:ee5eddd4 r7:00000000 r6:835d9440 r5:ee5edf28 r4:00000000 [<8162f780>] (__sock_sendmsg) from [<81630864>] (____sys_sendmsg+0x238/0x2c4 net/socket.c:2709) r7:00000000 r6:00000000 r5:835d9440 r4:ee5edf28 [<8163062c>] (____sys_sendmsg) from [<81630c64>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2763) r10:00000128 r9:2000c2c0 r8:00000000 r7:00000000 r6:835d9440 r5:ee5edf28 r4:00000000 [<81630bc8>] (___sys_sendmsg) from [<81632e3c>] (__sys_sendmsg+0x8c/0xe0 net/socket.c:2795) r9:85080000 r8:85744500 r7:00000000 r6:2000c2c0 r5:85744500 r4:00000003 [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (__do_sys_sendmsg net/socket.c:2800 [inline]) [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (sys_sendmsg+0x14/0x18 net/socket.c:2798) r8:8020029c r7:00000128 r6:00356310 r5:00000000 r4:00000000 [<81632e90>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xee5edfa8 to 0xee5edff0) dfa0: 00000000 00000000 00000003 2000c2c0 00000000 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000008 00000000 dfe0: 7e8637a0 7e863790 00018fa0 00130a50 Code: ea00000a e59cc000 e154000c 0a000007 (e59c3010) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: ea00000a b 0x30 4: e59cc000 ldr ip, [ip] 8: e154000c cmp r4, ip c: 0a000007 beq 0x30 * 10: e59c3010 ldr r3, [ip, #16] <-- trapping instruction