Extracting prog: 56.096554896s
Minimizing prog: 15m49.971554047s
Simplifying prog options: 1m56.437459307s
Extracting C: 42.765244238s
Simplifying C: 0s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r4, 0x0)
write$nci(r3, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program crashed: WARNING: locking bug in __rmqueue_pcplist
single: successfully extracted reproducer
found reproducer with 12 syscalls
minimizing guilty program
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r4, 0x0)
write$nci(r3, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r4 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r4, 0x0)
write$nci(r3, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r0 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
write$nci(r3, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, 0xffffffffffffffff, 0x0)
write$nci(r3, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r2=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(0xffffffffffffffff, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_GETRESOURCES-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[0x0], 0x0, 0x0, 0x0, 0x1})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
r1 = syz_open_dev$dri(&(0x7f0000000200), 0x200, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program crashed: WARNING in ip6mr_free_table
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r0=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r2, 0x0)
write$nci(r1, 0x0, 0x8)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(0x0, 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r2, 0x0)
write$nci(r1, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, 0x0, 0x0, 0x0})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r2, 0x0)
write$nci(r1, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, 0x0)
r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r2 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r2, 0x0)
write$nci(r1, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(0x0, 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
program did not crash
simplifying guilty program options
testing program (duration=36.637543068s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
testing program (duration=36.637543068s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_open_dev$loop-ioctl$DRM_IOCTL_MODE_GETRESOURCES-ioctl$DRM_IOCTL_MODE_SETCRTC-openat$nci-open-mmap-write$nci-ioctl$BLKTRACESETUP-openat$nullb-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
socket(0x9, 0x80000, 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000040), 0x3, 0x68541)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000026c0)={0x0, &(0x7f0000002600)=[<r1=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1, r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "427f4d05618664ecb7f952ed7667675bc32afc7ebbfea1deee1e2e520cc38c6a"}})
r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r3 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x4002011, r3, 0x0)
write$nci(r2, 0x0, 0x8)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000021c0)={'\x00', 0x0, 0xf, 0x1e23c38, 0x9, 0x20})
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5a, 0x4, 0x6, 0x73ae, 0x6, 0xffffffffffffffff})

program did not crash
reproducing took 19m25.27083182s
repro crashed as (corrupted=false):
percpu: allocation failed, size=32 align=4 atomic=1, atomic alloc failed, no space left
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5955 at net/ipv6/ip6mr.c:419 ip6mr_free_table+0xbd/0x120 net/ipv6/ip6mr.c:419
Modules linked in:
CPU: 0 UID: 0 PID: 5955 Comm: syz-executor Not tainted 6.13.0-rc1-syzkaller-00001-ge70140ba0d2b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ip6mr_free_table+0xbd/0x120 net/ipv6/ip6mr.c:419
Code: 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 58 49 83 bc 24 c0 0e 00 00 00 74 09 e8 c4 c5 af f7 90 <0f> 0b 90 e8 bb c5 af f7 48 8d 7b 38 e8 22 86 9c f7 48 89 df be 0f
RSP: 0018:ffffc90004497bd8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88804c1bc000 RCX: ffffffff89ea4014
RDX: ffff888023100000 RSI: ffffffff89ea404c RDI: ffff88804c090ec0
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88804c090000
R13: ffff88804c1bc000 R14: ffff88804c1bc008 R15: dead000000000100
FS:  000055558a989500(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6702349350 CR3: 000000002dbd6000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ip6mr_rules_exit+0x176/0x2d0 net/ipv6/ip6mr.c:283
 ip6mr_net_exit_batch+0x53/0xa0 net/ipv6/ip6mr.c:1388
 ops_exit_list+0x128/0x180 net/core/net_namespace.c:177
 setup_net+0x4fe/0x860 net/core/net_namespace.c:394
 copy_net_ns+0x2b4/0x6b0 net/core/net_namespace.c:500
 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
 ksys_unshare+0x45d/0xa40 kernel/fork.c:3334
 __do_sys_unshare kernel/fork.c:3405 [inline]
 __se_sys_unshare kernel/fork.c:3403 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3403
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8694d81717
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeb52746b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8694f45f40 RCX: 00007f8694d81717
RDX: 00007f8694d7ff19 RSI: 00007ffeb5274680 RDI: 0000000040000000
RBP: 00007f8694f46578 R08: 00007f8694eff9d0 R09: 00007f8694eff9d0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 0000000000000006 R14: 0000000000000009 R15: 0000000000000000
 </TASK>

final repro crashed as (corrupted=false):
percpu: allocation failed, size=32 align=4 atomic=1, atomic alloc failed, no space left
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5955 at net/ipv6/ip6mr.c:419 ip6mr_free_table+0xbd/0x120 net/ipv6/ip6mr.c:419
Modules linked in:
CPU: 0 UID: 0 PID: 5955 Comm: syz-executor Not tainted 6.13.0-rc1-syzkaller-00001-ge70140ba0d2b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ip6mr_free_table+0xbd/0x120 net/ipv6/ip6mr.c:419
Code: 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 58 49 83 bc 24 c0 0e 00 00 00 74 09 e8 c4 c5 af f7 90 <0f> 0b 90 e8 bb c5 af f7 48 8d 7b 38 e8 22 86 9c f7 48 89 df be 0f
RSP: 0018:ffffc90004497bd8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88804c1bc000 RCX: ffffffff89ea4014
RDX: ffff888023100000 RSI: ffffffff89ea404c RDI: ffff88804c090ec0
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88804c090000
R13: ffff88804c1bc000 R14: ffff88804c1bc008 R15: dead000000000100
FS:  000055558a989500(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6702349350 CR3: 000000002dbd6000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ip6mr_rules_exit+0x176/0x2d0 net/ipv6/ip6mr.c:283
 ip6mr_net_exit_batch+0x53/0xa0 net/ipv6/ip6mr.c:1388
 ops_exit_list+0x128/0x180 net/core/net_namespace.c:177
 setup_net+0x4fe/0x860 net/core/net_namespace.c:394
 copy_net_ns+0x2b4/0x6b0 net/core/net_namespace.c:500
 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
 ksys_unshare+0x45d/0xa40 kernel/fork.c:3334
 __do_sys_unshare kernel/fork.c:3405 [inline]
 __se_sys_unshare kernel/fork.c:3403 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3403
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8694d81717
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeb52746b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f8694f45f40 RCX: 00007f8694d81717
RDX: 00007f8694d7ff19 RSI: 00007ffeb5274680 RDI: 0000000040000000
RBP: 00007f8694f46578 R08: 00007f8694eff9d0 R09: 00007f8694eff9d0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 0000000000000006 R14: 0000000000000009 R15: 0000000000000000
 </TASK>