Extracting prog: 11m56.118102174s Minimizing prog: 1h9m7.485467406s Simplifying prog options: 0s Extracting C: 2m0.618666159s Simplifying C: 53m44.723960849s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 16m0s testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: corrupted list in flow_block_cb_setup_simple single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={0x0, 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x3c}}, 0xc050) program did not crash testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB], 0x3c}}, 0xc050) program did not crash extracting C reproducer testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple simplifying C reproducer testing compiled C program (duration=5m22.97745833s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: corrupted list in flow_block_cb_setup_simple testing compiled C program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH program crashed: BUG: unable to handle kernel NULL pointer dereference in flow_block_cb_setup_simple a never seen crash title: BUG: unable to handle kernel NULL pointer dereference in flow_block_cb_setup_simple, ignore testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash validation run: crashed=false testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program did not crash validation run: crashed=false testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: corrupted list in flow_block_cb_setup_simple validation run: crashed=true testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: corrupted list in flow_block_cb_setup_simple validation run: crashed=true testing program (duration=5m22.97745833s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d30000000000000080000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000400000a14000000020a497f75241d4e1deb00000500000614000000110001"], 0x3c}}, 0xc050) program crashed: BUG: corrupted list in flow_block_cb_setup_simple validation run: crashed=true reproducing took 2h39m34.475632105s repro crashed as (corrupted=false): slab kmalloc-128 start 85530b00 pointer offset 0 size 128 list_del corruption. next->prev should be 85530600, but was 00000000. (next=85530b00) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:65! Internal error: Oops - BUG: 0 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 6535 Comm: syz.0.1089 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __list_del_entry_valid_or_report+0xdc/0x108 lib/list_debug.c:65 LR is at __wake_up_klogd kernel/printk/printk.c:4647 [inline] LR is at __wake_up_klogd+0xa4/0x108 kernel/printk/printk.c:4618 pc : [<809670b4>] lr : [<802e7c4c>] psr: 600f0013 sp : ed9ed848 ip : ed9ed798 fp : ed9ed864 r10: 853f8888 r9 : 00000000 r8 : ed9ed8c8 r7 : 85530600 r6 : 82b857b8 r5 : 85530b00 r4 : 85530600 r3 : 847fbd40 r2 : 00000000 r1 : 00000000 r0 : 00000055 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 854e25c0 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: slab task_struct start 847fbd40 pointer offset 0 size 3136 Register r4 information: slab kmalloc-128 start 85530600 pointer offset 0 size 128 Register r5 information: slab kmalloc-128 start 85530b00 pointer offset 0 size 128 Register r6 information: non-slab/vmalloc memory Register r7 information: slab kmalloc-128 start 85530600 pointer offset 0 size 128 Register r8 information: 2-page vmalloc region starting at 0xed9ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r9 information: NULL pointer Register r10 information: slab kmalloc-cg-64 start 853f8880 pointer offset 8 size 64 Register r11 information: 2-page vmalloc region starting at 0xed9ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: 2-page vmalloc region starting at 0xed9ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Process syz.0.1089 (pid: 6535, stack limit = 0xed9ec000) Stack: (0xed9ed848 to 0xed9ee000) d840: 85530600 85530608 ed9ed8b4 ed9ed8c8 ed9ed88c ed9ed868 d860: 816ac030 80966fe4 85b42000 00000001 8625f780 ed9ed8e0 00000000 00000000 d880: ed9ed8a4 ed9ed890 80f0ca28 816abf58 85b42700 00000001 ed9ed96c ed9ed8a8 d8a0: 817f991c 80f0c994 ed9ed8e0 ed9edac0 854f7bc0 00000001 00000001 00000000 d8c0: 84f0b000 8625f810 85530608 85530608 82b857b8 ed9ed8e0 00000000 8625f810 d8e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d900: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d920: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d940: 00000000 00000000 00000000 d4049cf8 86269180 00000000 00000001 8625f780 d960: ed9ed9a4 ed9ed970 817f9c78 817f98a8 8625f7a8 853f8880 00000000 8624f280 d980: 85932c88 81e7f1da ed9ed9b8 84f0b000 84f0b000 ed9edac0 ed9eda44 ed9ed9a8 d9a0: 817fa7bc 817f9bec 8022cc00 8022bb68 84f0b000 80968ca0 ed9edaa4 ed9eda30 d9c0: 80290c6c 80968ca0 00000000 00000000 00000000 d4049cf8 ed9eda0c ed9ed9e8 d9e0: ed9eda14 ed9ed9f0 00000020 00000dc0 00000020 00000dc0 83001240 847fbd40 da00: 854f7bc0 854f7bc0 ed9eda6c ed9eda18 8054797c d4049cf8 ed9eda44 85932c84 da20: 85932ca0 8384c540 00000011 847fbd40 84f0b000 ed9edac0 ed9edb1c ed9eda48 da40: 817eb044 817fa624 8624f280 85932c88 ed9eda84 ed9eda60 817d7ae4 80966f18 da60: 8625f7c0 00000001 ed9edac8 00000001 85932c80 85932c80 ed9edaa4 ed9eda88 da80: 817e3460 817d7aa8 86041600 00000005 00000001 85932c80 ed9edb1c 82a14ff0 daa0: 85932c88 847fbd40 8384c540 61c88647 833d0000 85932c80 ed9edab8 ed9edab8 dac0: ed9edac0 ed9edac0 84f0b000 00000000 00000000 00000000 00000432 4e1d2475 dae0: 00007f49 00000001 00000000 d4049cf8 80a01e34 833cf300 ed9edb68 85170268 db00: 00000011 847fbd40 81e7e028 81e7de58 ed9edca4 ed9edb20 8179bc68 817eae44 db20: 81e7e468 00000000 ed9edb84 0000003c 833cf300 82509eb8 847fbd40 00000000 db40: 82e3d204 000000c8 82e3d2cc 84f0b000 85170240 0000000a 81e7de58 8254373c db60: 8384c540 00000000 ed9edb68 ed9edb68 84f0b000 859e7800 85170254 85170264 db80: ed9edb84 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dba0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbe0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc60: 00000000 00000000 00000000 00000000 00000000 d4049cf8 80a01e34 8384c540 dc80: 00000000 85170240 00000014 0000003c 84f0b000 8613e184 ed9edcec ed9edca8 dca0: 8179bf74 8179b4a0 81e78c08 00000000 00000000 80a06140 81768870 00000000 dcc0: 00000000 d4049cf8 859e7864 859e7800 859e7864 0000003c 8595d280 8384c540 dce0: ed9edd2c ed9edcf0 8176bff8 8179be58 8384c540 00000000 00000000 d4049cf8 dd00: 00000000 ed9edf28 8384c540 0000003c 8613e000 00000000 00000000 00000000 dd20: ed9edd94 ed9edd30 8176c2d0 8176bd94 ed9edf28 834af6c0 00000000 00000000 dd40: 00000000 0000003c 840c7c00 00000000 00000432 00000000 00000000 00000000 dd60: 0000003c d4049cf8 ed9edd94 00000000 ed9edf28 834af6c0 00000000 ed9eddd4 dd80: 00000000 0000c050 ed9eddb4 ed9edd98 8162f7c4 8176c114 ed9edf28 834af6c0 dda0: 00000000 00000000 ed9ede24 ed9eddb8 81630864 8162f78c ed9ede30 ed9edf38 ddc0: 00000000 ed9edde0 ed9ede24 ed9eddd8 81630b30 00000000 00000000 00000000 dde0: 00000000 00000000 00000000 00000000 00000000 d4049cf8 00000000 00000000 de00: ed9edf28 834af6c0 00000000 0000c050 20000cc0 00000128 ed9edf1c ed9ede28 de20: 81630c64 81630638 00000000 80358d6c 00000000 20000bc0 0000003c 00000000 de40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dee0: 00000000 00000000 00000000 00000000 00000000 d4049cf8 00000003 85b9c901 df00: 20000cc0 0000c050 85b9c900 847fbd40 ed9edf94 ed9edf20 81632e3c 81630bd4 df20: 00000000 00000000 00000000 00000000 00000000 00000000 00010000 0000003c df40: 20000bc0 00000000 00000001 00000000 00000000 00000001 0000c050 00000000 df60: 00000000 00000000 ecac8b10 d4049cf8 00000000 00000000 00000000 00356310 df80: 00000128 8020029c ed9edfa4 ed9edf98 81632ea4 81632dbc 00000000 ed9edfa8 dfa0: 80200060 81632e9c 00000000 00000000 00000003 20000cc0 0000c050 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000001 76fa90dc dfe0: 76fa8e88 76fa8e78 00018fa0 00130a50 60000010 00000003 00000000 00000000 Call trace: [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (__list_del_entry_valid include/linux/list.h:132 [inline]) [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (__list_del_entry include/linux/list.h:246 [inline]) [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (list_del include/linux/list.h:260 [inline]) [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (flow_block_cb_setup_simple+0xe4/0x1fc net/core/flow_offload.c:367) r7:ed9ed8c8 r6:ed9ed8b4 r5:85530608 r4:85530600 [<816abf4c>] (flow_block_cb_setup_simple) from [<80f0ca28>] (nsim_setup_tc+0xa0/0xdc drivers/net/netdevsim/tc.c:87) r9:00000000 r8:00000000 r7:ed9ed8e0 r6:8625f780 r5:00000001 r4:85b42000 [<80f0c988>] (nsim_setup_tc) from [<817f991c>] (nft_block_offload_cmd+0x80/0xf4 net/netfilter/nf_tables_offload.c:397) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_chain_offload_cmd net/netfilter/nf_tables_offload.c:451 [inline]) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_flow_block_chain+0x98/0x184 net/netfilter/nf_tables_offload.c:471) r7:8625f780 r6:00000001 r5:00000000 r4:86269180 [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]) [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_rule_offload_commit+0x1a4/0x1f4 net/netfilter/nf_tables_offload.c:592) r10:ed9edac0 r9:84f0b000 r8:84f0b000 r7:ed9ed9b8 r6:81e7f1da r5:85932c88 r4:8624f280 [<817fa618>] (nft_flow_rule_offload_commit) from [<817eb044>] (nf_tables_commit+0x20c/0x2250 net/netfilter/nf_tables_api.c:10934) r10:ed9edac0 r9:84f0b000 r8:847fbd40 r7:00000011 r6:8384c540 r5:85932ca0 r4:85932c84 [<817eae38>] (nf_tables_commit) from [<8179bc68>] (nfnetlink_rcv_batch+0x7d4/0x9b8 net/netfilter/nfnetlink.c:574) r10:81e7de58 r9:81e7e028 r8:847fbd40 r7:00000011 r6:85170268 r5:ed9edb68 r4:833cf300 [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]) [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv+0x128/0x15c net/netfilter/nfnetlink.c:665) r10:8613e184 r9:84f0b000 r8:0000003c r7:00000014 r6:85170240 r5:00000000 r4:8384c540 [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]) [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast+0x270/0x380 net/netlink/af_netlink.c:1345) r8:8384c540 r7:8595d280 r6:0000003c r5:859e7864 r4:859e7800 [<8176bd88>] (netlink_unicast) from [<8176c2d0>] (netlink_sendmsg+0x1c8/0x444 net/netlink/af_netlink.c:1900) r10:00000000 r9:00000000 r8:00000000 r7:8613e000 r6:0000003c r5:8384c540 r4:ed9edf28 [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (sock_sendmsg_nosec net/socket.c:800 [inline]) [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (__sock_sendmsg+0x44/0x78 net/socket.c:815) r10:0000c050 r9:00000000 r8:ed9eddd4 r7:00000000 r6:834af6c0 r5:ed9edf28 r4:00000000 [<8162f780>] (__sock_sendmsg) from [<81630864>] (____sys_sendmsg+0x238/0x2c4 net/socket.c:2709) r7:00000000 r6:00000000 r5:834af6c0 r4:ed9edf28 [<8163062c>] (____sys_sendmsg) from [<81630c64>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2763) r10:00000128 r9:20000cc0 r8:0000c050 r7:00000000 r6:834af6c0 r5:ed9edf28 r4:00000000 [<81630bc8>] (___sys_sendmsg) from [<81632e3c>] (__sys_sendmsg+0x8c/0xe0 net/socket.c:2795) r9:847fbd40 r8:85b9c900 r7:0000c050 r6:20000cc0 r5:85b9c901 r4:00000003 [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (__do_sys_sendmsg net/socket.c:2800 [inline]) [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (sys_sendmsg+0x14/0x18 net/socket.c:2798) r8:8020029c r7:00000128 r6:00356310 r5:00000000 r4:00000000 [<81632e90>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xed9edfa8 to 0xed9edff0) dfa0: 00000000 00000000 00000003 20000cc0 0000c050 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000001 76fa90dc dfe0: 76fa8e88 76fa8e78 00018fa0 00130a50 Code: e1a01007 e30101e0 e3480239 ebe27390 (e7f001f2) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e1a01007 mov r1, r7 4: e30101e0 movw r0, #4576 @ 0x11e0 8: e3480239 movt r0, #33337 @ 0x8239 c: ebe27390 bl 0xff89ce54 * 10: e7f001f2 udf #18 <-- trapping instruction final repro crashed as (corrupted=false): slab kmalloc-128 start 85530b00 pointer offset 0 size 128 list_del corruption. next->prev should be 85530600, but was 00000000. (next=85530b00) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:65! Internal error: Oops - BUG: 0 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 6535 Comm: syz.0.1089 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __list_del_entry_valid_or_report+0xdc/0x108 lib/list_debug.c:65 LR is at __wake_up_klogd kernel/printk/printk.c:4647 [inline] LR is at __wake_up_klogd+0xa4/0x108 kernel/printk/printk.c:4618 pc : [<809670b4>] lr : [<802e7c4c>] psr: 600f0013 sp : ed9ed848 ip : ed9ed798 fp : ed9ed864 r10: 853f8888 r9 : 00000000 r8 : ed9ed8c8 r7 : 85530600 r6 : 82b857b8 r5 : 85530b00 r4 : 85530600 r3 : 847fbd40 r2 : 00000000 r1 : 00000000 r0 : 00000055 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 854e25c0 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: slab task_struct start 847fbd40 pointer offset 0 size 3136 Register r4 information: slab kmalloc-128 start 85530600 pointer offset 0 size 128 Register r5 information: slab kmalloc-128 start 85530b00 pointer offset 0 size 128 Register r6 information: non-slab/vmalloc memory Register r7 information: slab kmalloc-128 start 85530600 pointer offset 0 size 128 Register r8 information: 2-page vmalloc region starting at 0xed9ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r9 information: NULL pointer Register r10 information: slab kmalloc-cg-64 start 853f8880 pointer offset 8 size 64 Register r11 information: 2-page vmalloc region starting at 0xed9ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: 2-page vmalloc region starting at 0xed9ec000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Process syz.0.1089 (pid: 6535, stack limit = 0xed9ec000) Stack: (0xed9ed848 to 0xed9ee000) d840: 85530600 85530608 ed9ed8b4 ed9ed8c8 ed9ed88c ed9ed868 d860: 816ac030 80966fe4 85b42000 00000001 8625f780 ed9ed8e0 00000000 00000000 d880: ed9ed8a4 ed9ed890 80f0ca28 816abf58 85b42700 00000001 ed9ed96c ed9ed8a8 d8a0: 817f991c 80f0c994 ed9ed8e0 ed9edac0 854f7bc0 00000001 00000001 00000000 d8c0: 84f0b000 8625f810 85530608 85530608 82b857b8 ed9ed8e0 00000000 8625f810 d8e0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d900: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d920: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 d940: 00000000 00000000 00000000 d4049cf8 86269180 00000000 00000001 8625f780 d960: ed9ed9a4 ed9ed970 817f9c78 817f98a8 8625f7a8 853f8880 00000000 8624f280 d980: 85932c88 81e7f1da ed9ed9b8 84f0b000 84f0b000 ed9edac0 ed9eda44 ed9ed9a8 d9a0: 817fa7bc 817f9bec 8022cc00 8022bb68 84f0b000 80968ca0 ed9edaa4 ed9eda30 d9c0: 80290c6c 80968ca0 00000000 00000000 00000000 d4049cf8 ed9eda0c ed9ed9e8 d9e0: ed9eda14 ed9ed9f0 00000020 00000dc0 00000020 00000dc0 83001240 847fbd40 da00: 854f7bc0 854f7bc0 ed9eda6c ed9eda18 8054797c d4049cf8 ed9eda44 85932c84 da20: 85932ca0 8384c540 00000011 847fbd40 84f0b000 ed9edac0 ed9edb1c ed9eda48 da40: 817eb044 817fa624 8624f280 85932c88 ed9eda84 ed9eda60 817d7ae4 80966f18 da60: 8625f7c0 00000001 ed9edac8 00000001 85932c80 85932c80 ed9edaa4 ed9eda88 da80: 817e3460 817d7aa8 86041600 00000005 00000001 85932c80 ed9edb1c 82a14ff0 daa0: 85932c88 847fbd40 8384c540 61c88647 833d0000 85932c80 ed9edab8 ed9edab8 dac0: ed9edac0 ed9edac0 84f0b000 00000000 00000000 00000000 00000432 4e1d2475 dae0: 00007f49 00000001 00000000 d4049cf8 80a01e34 833cf300 ed9edb68 85170268 db00: 00000011 847fbd40 81e7e028 81e7de58 ed9edca4 ed9edb20 8179bc68 817eae44 db20: 81e7e468 00000000 ed9edb84 0000003c 833cf300 82509eb8 847fbd40 00000000 db40: 82e3d204 000000c8 82e3d2cc 84f0b000 85170240 0000000a 81e7de58 8254373c db60: 8384c540 00000000 ed9edb68 ed9edb68 84f0b000 859e7800 85170254 85170264 db80: ed9edb84 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dba0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dbe0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dc60: 00000000 00000000 00000000 00000000 00000000 d4049cf8 80a01e34 8384c540 dc80: 00000000 85170240 00000014 0000003c 84f0b000 8613e184 ed9edcec ed9edca8 dca0: 8179bf74 8179b4a0 81e78c08 00000000 00000000 80a06140 81768870 00000000 dcc0: 00000000 d4049cf8 859e7864 859e7800 859e7864 0000003c 8595d280 8384c540 dce0: ed9edd2c ed9edcf0 8176bff8 8179be58 8384c540 00000000 00000000 d4049cf8 dd00: 00000000 ed9edf28 8384c540 0000003c 8613e000 00000000 00000000 00000000 dd20: ed9edd94 ed9edd30 8176c2d0 8176bd94 ed9edf28 834af6c0 00000000 00000000 dd40: 00000000 0000003c 840c7c00 00000000 00000432 00000000 00000000 00000000 dd60: 0000003c d4049cf8 ed9edd94 00000000 ed9edf28 834af6c0 00000000 ed9eddd4 dd80: 00000000 0000c050 ed9eddb4 ed9edd98 8162f7c4 8176c114 ed9edf28 834af6c0 dda0: 00000000 00000000 ed9ede24 ed9eddb8 81630864 8162f78c ed9ede30 ed9edf38 ddc0: 00000000 ed9edde0 ed9ede24 ed9eddd8 81630b30 00000000 00000000 00000000 dde0: 00000000 00000000 00000000 00000000 00000000 d4049cf8 00000000 00000000 de00: ed9edf28 834af6c0 00000000 0000c050 20000cc0 00000128 ed9edf1c ed9ede28 de20: 81630c64 81630638 00000000 80358d6c 00000000 20000bc0 0000003c 00000000 de40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 de80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dee0: 00000000 00000000 00000000 00000000 00000000 d4049cf8 00000003 85b9c901 df00: 20000cc0 0000c050 85b9c900 847fbd40 ed9edf94 ed9edf20 81632e3c 81630bd4 df20: 00000000 00000000 00000000 00000000 00000000 00000000 00010000 0000003c df40: 20000bc0 00000000 00000001 00000000 00000000 00000001 0000c050 00000000 df60: 00000000 00000000 ecac8b10 d4049cf8 00000000 00000000 00000000 00356310 df80: 00000128 8020029c ed9edfa4 ed9edf98 81632ea4 81632dbc 00000000 ed9edfa8 dfa0: 80200060 81632e9c 00000000 00000000 00000003 20000cc0 0000c050 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000001 76fa90dc dfe0: 76fa8e88 76fa8e78 00018fa0 00130a50 60000010 00000003 00000000 00000000 Call trace: [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (__list_del_entry_valid include/linux/list.h:132 [inline]) [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (__list_del_entry include/linux/list.h:246 [inline]) [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (list_del include/linux/list.h:260 [inline]) [<80966fd8>] (__list_del_entry_valid_or_report) from [<816ac030>] (flow_block_cb_setup_simple+0xe4/0x1fc net/core/flow_offload.c:367) r7:ed9ed8c8 r6:ed9ed8b4 r5:85530608 r4:85530600 [<816abf4c>] (flow_block_cb_setup_simple) from [<80f0ca28>] (nsim_setup_tc+0xa0/0xdc drivers/net/netdevsim/tc.c:87) r9:00000000 r8:00000000 r7:ed9ed8e0 r6:8625f780 r5:00000001 r4:85b42000 [<80f0c988>] (nsim_setup_tc) from [<817f991c>] (nft_block_offload_cmd+0x80/0xf4 net/netfilter/nf_tables_offload.c:397) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_chain_offload_cmd net/netfilter/nf_tables_offload.c:451 [inline]) [<817f989c>] (nft_block_offload_cmd) from [<817f9c78>] (nft_flow_block_chain+0x98/0x184 net/netfilter/nf_tables_offload.c:471) r7:8625f780 r6:00000001 r5:00000000 r4:86269180 [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]) [<817f9be0>] (nft_flow_block_chain) from [<817fa7bc>] (nft_flow_rule_offload_commit+0x1a4/0x1f4 net/netfilter/nf_tables_offload.c:592) r10:ed9edac0 r9:84f0b000 r8:84f0b000 r7:ed9ed9b8 r6:81e7f1da r5:85932c88 r4:8624f280 [<817fa618>] (nft_flow_rule_offload_commit) from [<817eb044>] (nf_tables_commit+0x20c/0x2250 net/netfilter/nf_tables_api.c:10934) r10:ed9edac0 r9:84f0b000 r8:847fbd40 r7:00000011 r6:8384c540 r5:85932ca0 r4:85932c84 [<817eae38>] (nf_tables_commit) from [<8179bc68>] (nfnetlink_rcv_batch+0x7d4/0x9b8 net/netfilter/nfnetlink.c:574) r10:81e7de58 r9:81e7e028 r8:847fbd40 r7:00000011 r6:85170268 r5:ed9edb68 r4:833cf300 [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]) [<8179b494>] (nfnetlink_rcv_batch) from [<8179bf74>] (nfnetlink_rcv+0x128/0x15c net/netfilter/nfnetlink.c:665) r10:8613e184 r9:84f0b000 r8:0000003c r7:00000014 r6:85170240 r5:00000000 r4:8384c540 [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]) [<8179be4c>] (nfnetlink_rcv) from [<8176bff8>] (netlink_unicast+0x270/0x380 net/netlink/af_netlink.c:1345) r8:8384c540 r7:8595d280 r6:0000003c r5:859e7864 r4:859e7800 [<8176bd88>] (netlink_unicast) from [<8176c2d0>] (netlink_sendmsg+0x1c8/0x444 net/netlink/af_netlink.c:1900) r10:00000000 r9:00000000 r8:00000000 r7:8613e000 r6:0000003c r5:8384c540 r4:ed9edf28 [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (sock_sendmsg_nosec net/socket.c:800 [inline]) [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (__sock_sendmsg+0x44/0x78 net/socket.c:815) r10:0000c050 r9:00000000 r8:ed9eddd4 r7:00000000 r6:834af6c0 r5:ed9edf28 r4:00000000 [<8162f780>] (__sock_sendmsg) from [<81630864>] (____sys_sendmsg+0x238/0x2c4 net/socket.c:2709) r7:00000000 r6:00000000 r5:834af6c0 r4:ed9edf28 [<8163062c>] (____sys_sendmsg) from [<81630c64>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2763) r10:00000128 r9:20000cc0 r8:0000c050 r7:00000000 r6:834af6c0 r5:ed9edf28 r4:00000000 [<81630bc8>] (___sys_sendmsg) from [<81632e3c>] (__sys_sendmsg+0x8c/0xe0 net/socket.c:2795) r9:847fbd40 r8:85b9c900 r7:0000c050 r6:20000cc0 r5:85b9c901 r4:00000003 [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (__do_sys_sendmsg net/socket.c:2800 [inline]) [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (sys_sendmsg+0x14/0x18 net/socket.c:2798) r8:8020029c r7:00000128 r6:00356310 r5:00000000 r4:00000000 [<81632e90>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xed9edfa8 to 0xed9edff0) dfa0: 00000000 00000000 00000003 20000cc0 0000c050 00000000 dfc0: 00000000 00000000 00356310 00000128 003562d8 00000000 00000001 76fa90dc dfe0: 76fa8e88 76fa8e78 00018fa0 00130a50 Code: e1a01007 e30101e0 e3480239 ebe27390 (e7f001f2) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e1a01007 mov r1, r7 4: e30101e0 movw r0, #4576 @ 0x11e0 8: e3480239 movt r0, #33337 @ 0x8239 c: ebe27390 bl 0xff89ce54 * 10: e7f001f2 udf #18 <-- trapping instruction