Extracting prog: 23.395204039s
Minimizing prog: 1m30.203917789s
Simplifying prog options: 0s
Extracting C: 11.109743605s
Simplifying C: 1m6.512769433s


extracting reproducer from 21 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
detailed listing:
executing program 0:
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/mnt\x00')
setns(r0, 0x0)

program crashed: panic: runtime error: invalid memory address or nil pointer dereference
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace
detailed listing:
executing program 0:
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/mnt\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns
detailed listing:
executing program 0:
setns(0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
detailed listing:
executing program 0:
r0 = syz_open_procfs$namespace(0xffffffffffffffff, 0x0)
setns(r0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
program crashed: panic: runtime error: invalid memory address or nil pointer dereference
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
detailed listing:
executing program 0:
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/mnt\x00')
setns(r0, 0x0)

program crashed: panic: runtime error: invalid memory address or nil pointer dereference
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
detailed listing:
executing program 0:
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/mnt\x00')
setns(r0, 0x0)

program crashed: panic: runtime error: invalid memory address or nil pointer dereference
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$namespace-setns
detailed listing:
executing program 0:
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/mnt\x00')
setns(r0, 0x0)

program crashed: panic: runtime error: invalid memory address or nil pointer dereference
validation run: crashed=true
reproducing took 3m51.114233408s
repro crashed as (corrupted=false):
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xe07e2f]

goroutine 519 gp=0xc000d96700 m=16 mp=0xc000c1c808 [running]:
panic({0x194c0c0?, 0x2c93390?})
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/panic.go:802 +0x168 fp=0xc0006cfdd0 sp=0xc0006cfd20 pc=0x480428
runtime.panicmem(...)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/panic.go:262
runtime.sigpanic()
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc0006cfe30 sp=0xc0006cfdd0 pc=0x482fd9
gvisor.dev/gvisor/pkg/sentry/kernel.(*FSContext).DecRef(...)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/fs_context.go:88
gvisor.dev/gvisor/pkg/sentry/kernel.(*runExitMain).execute(0xc0015145a0?, 0xc0010a3908)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_exit.go:300 +0x7cf fp=0xc0006cff30 sp=0xc0006cfe30 pc=0xe07e2f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0010a3908, 0x4c)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_run.go:89 +0x3de fp=0xc0006cffc0 sp=0xc0006cff30 pc=0xe1b73e
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_start.go:416 +0x25 fp=0xc0006cffe0 sp=0xc0006cffc0 pc=0xe2de25
runtime.goexit({})
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc0006cffe8 sp=0xc0006cffe0 pc=0x4896c1
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 456
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_start.go:416 +0x110

final repro crashed as (corrupted=false):
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xe07e2f]

goroutine 519 gp=0xc000d96700 m=16 mp=0xc000c1c808 [running]:
panic({0x194c0c0?, 0x2c93390?})
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/panic.go:802 +0x168 fp=0xc0006cfdd0 sp=0xc0006cfd20 pc=0x480428
runtime.panicmem(...)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/panic.go:262
runtime.sigpanic()
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc0006cfe30 sp=0xc0006cfdd0 pc=0x482fd9
gvisor.dev/gvisor/pkg/sentry/kernel.(*FSContext).DecRef(...)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/fs_context.go:88
gvisor.dev/gvisor/pkg/sentry/kernel.(*runExitMain).execute(0xc0015145a0?, 0xc0010a3908)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_exit.go:300 +0x7cf fp=0xc0006cff30 sp=0xc0006cfe30 pc=0xe07e2f
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0010a3908, 0x4c)
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_run.go:89 +0x3de fp=0xc0006cffc0 sp=0xc0006cff30 pc=0xe1b73e
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_start.go:416 +0x25 fp=0xc0006cffe0 sp=0xc0006cffc0 pc=0xe2de25
runtime.goexit({})
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc0006cffe8 sp=0xc0006cffe0 pc=0x4896c1
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 456
	/syzkaller/.cache/bazel/_bazel_root/8c3527d6b90f1bcab77f0f2b1b1fec96/sandbox/linux-sandbox/23/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_start.go:416 +0x110