Extracting prog: 1m18.60725357s
Minimizing prog: 14m33.590193623s
Simplifying prog options: 0s
Extracting C: 22.202588845s
Simplifying C: 6m1.648702667s
extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-mount-openat-write-setsockopt$inet6_IPV6_XFRM_POLICY-openat-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-mount-openat-write-setsockopt$inet6_IPV6_XFRM_POLICY-openat
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-mount-openat-write-setsockopt$inet6_IPV6_XFRM_POLICY-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-mount-write-openat-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-epoll_pwait-mount-openat-write-openat-write
detailed listing:
executing program 0:
r0 = epoll_create(0x2)
epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): epoll_create-mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
epoll_create(0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, 0x0, 0x0) (fail_nth: 4)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300), 0x0) (fail_nth: 4)
program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in pci_scan_single_device
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='1', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1', 0x1) (fail_nth: 4)
program crashed: WARNING in pci_scan_single_device
validation run: crashed=true
reproducing took 24m31.417699545s
repro crashed as (corrupted=false):
RBP: 00007ffd8e1473b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f3155c25fac R14: 00007f3155c25fa0 R15: 00007f3155c25fa0
pci (null): [8086:1237] type 00 class 0x060000 conventional PCI endpoint
------------[ cut here ]------------
WARNING: CPU: 0 PID: 382 at drivers/pci/probe.c:2712 pci_device_add+0x126f/0x1600 drivers/pci/probe.c:2712
Modules linked in:
CPU: 0 UID: 0 PID: 382 Comm: syz.2.17 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:pci_device_add+0x126f/0x1600 drivers/pci/probe.c:2712
Code: f9 ff ff e9 77 f9 ff ff e8 2e 1a 9a fe 0f 0b 4c 8b 6c 24 30 e9 9f f9 ff ff e8 1d 1a 9a fe 0f 0b e9 6e fc ff ff e8 11 1a 9a fe <0f> 0b e9 64 fd ff ff 49 8d 8f 09 0b 00 00 80 e1 07 38 c1 0f 8c 1e
RSP: 0018:ffffc90000fff800 EFLAGS: 00010293
RAX: ffffffff82ed5e8f RBX: 00000000ffffffea RCX: ffff888114212600
RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000000
RBP: ffffc90000fff8f0 R08: ffff888115358103 R09: 1ffff11022a6b020
R10: dffffc0000000000 R11: ffffed1022a6b021 R12: ffff88810da4b028
R13: ffff888115358320 R14: dffffc0000000000 R15: ffff888115358b08
FS: 00005555589e6500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bee88dfb58 CR3: 0000000115794000 CR4: 00000000003526b0
Call Trace:
pci_scan_single_device+0x520/0x710 drivers/pci/probe.c:2731
pci_scan_slot+0x1e6/0x680 drivers/pci/probe.c:2814
pci_scan_child_bus_extend+0x54/0x8b0 drivers/pci/probe.c:3033
pci_scan_child_bus drivers/pci/probe.c:3147 [inline]
pci_rescan_bus+0x1d/0x40 drivers/pci/probe.c:3438
rescan_store+0xcd/0x150 drivers/pci/pci-sysfs.c:463
bus_attr_store+0x91/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x762/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f315599e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8e147348 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3155c25fa0 RCX: 00007f315599e159
RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007ffd8e1473b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f3155c25fac R14: 00007f3155c25fa0 R15: 00007f3155c25fa0
---[ end trace 0000000000000000 ]---
Oops: general protection fault, probably for non-canonical address 0xdffffc000000001a: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x00000000000000d0-0x00000000000000d7]
CPU: 0 UID: 0 PID: 382 Comm: syz.2.17 Tainted: G W syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__device_attach+0xb2/0x3c0 drivers/base/dd.c:1005
Code: 8d 66 68 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 d0 3b 9c fe 4d 8b 2c 24 4d 8d a5 d0 00 00 00 4c 89 e0 48 c1 e8 03 <0f> b6 04 18 84 c0 0f 85 dd 02 00 00 41 0f b6 1c 24 89 de 83 e6 01
RSP: 0018:ffffc90000fff9c0 EFLAGS: 00010202
RAX: 000000000000001a RBX: dffffc0000000000 RCX: ffffffff85a662a7
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc90000fff940
RBP: ffffc90000fffa68 R08: ffffc90000fff947 R09: 1ffff920001fff28
R10: dffffc0000000000 R11: fffff520001fff29 R12: 00000000000000d0
R13: 0000000000000000 R14: ffff8881153580c8 R15: 0000000000000000
FS: 00005555589e6500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bee88dfb58 CR3: 0000000115794000 CR4: 00000000003526b0
Call Trace:
device_attach+0x1b/0x40 drivers/base/dd.c:1072
pci_bus_add_device+0x11f/0x1f0 drivers/pci/bus.c:378
pci_bus_add_devices+0x98/0x1c0 drivers/pci/bus.c:401
pci_rescan_bus+0x30/0x40 drivers/pci/probe.c:3440
rescan_store+0xcd/0x150 drivers/pci/pci-sysfs.c:463
bus_attr_store+0x91/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x762/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f315599e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8e147348 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3155c25fa0 RCX: 00007f315599e159
RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007ffd8e1473b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f3155c25fac R14: 00007f3155c25fa0 R15: 00007f3155c25fa0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__device_attach+0xb2/0x3c0 drivers/base/dd.c:1005
Code: 8d 66 68 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 d0 3b 9c fe 4d 8b 2c 24 4d 8d a5 d0 00 00 00 4c 89 e0 48 c1 e8 03 <0f> b6 04 18 84 c0 0f 85 dd 02 00 00 41 0f b6 1c 24 89 de 83 e6 01
RSP: 0018:ffffc90000fff9c0 EFLAGS: 00010202
RAX: 000000000000001a RBX: dffffc0000000000 RCX: ffffffff85a662a7
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc90000fff940
RBP: ffffc90000fffa68 R08: ffffc90000fff947 R09: 1ffff920001fff28
R10: dffffc0000000000 R11: fffff520001fff29 R12: 00000000000000d0
R13: 0000000000000000 R14: ffff8881153580c8 R15: 0000000000000000
FS: 00005555589e6500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3155870050 CR3: 0000000115794000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
0: 8d 66 68 lea 0x68(%rsi),%esp
3: 4c 89 e0 mov %r12,%rax
6: 48 c1 e8 03 shr $0x3,%rax
a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
e: 74 08 je 0x18
10: 4c 89 e7 mov %r12,%rdi
13: e8 d0 3b 9c fe call 0xfe9c3be8
18: 4d 8b 2c 24 mov (%r12),%r13
1c: 4d 8d a5 d0 00 00 00 lea 0xd0(%r13),%r12
23: 4c 89 e0 mov %r12,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 dd 02 00 00 jne 0x313
36: 41 0f b6 1c 24 movzbl (%r12),%ebx
3b: 89 de mov %ebx,%esi
3d: 83 e6 01 and $0x1,%esi
final repro crashed as (corrupted=false):
RBP: 00007ffd8e1473b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f3155c25fac R14: 00007f3155c25fa0 R15: 00007f3155c25fa0
pci (null): [8086:1237] type 00 class 0x060000 conventional PCI endpoint
------------[ cut here ]------------
WARNING: CPU: 0 PID: 382 at drivers/pci/probe.c:2712 pci_device_add+0x126f/0x1600 drivers/pci/probe.c:2712
Modules linked in:
CPU: 0 UID: 0 PID: 382 Comm: syz.2.17 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:pci_device_add+0x126f/0x1600 drivers/pci/probe.c:2712
Code: f9 ff ff e9 77 f9 ff ff e8 2e 1a 9a fe 0f 0b 4c 8b 6c 24 30 e9 9f f9 ff ff e8 1d 1a 9a fe 0f 0b e9 6e fc ff ff e8 11 1a 9a fe <0f> 0b e9 64 fd ff ff 49 8d 8f 09 0b 00 00 80 e1 07 38 c1 0f 8c 1e
RSP: 0018:ffffc90000fff800 EFLAGS: 00010293
RAX: ffffffff82ed5e8f RBX: 00000000ffffffea RCX: ffff888114212600
RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000000
RBP: ffffc90000fff8f0 R08: ffff888115358103 R09: 1ffff11022a6b020
R10: dffffc0000000000 R11: ffffed1022a6b021 R12: ffff88810da4b028
R13: ffff888115358320 R14: dffffc0000000000 R15: ffff888115358b08
FS: 00005555589e6500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bee88dfb58 CR3: 0000000115794000 CR4: 00000000003526b0
Call Trace:
pci_scan_single_device+0x520/0x710 drivers/pci/probe.c:2731
pci_scan_slot+0x1e6/0x680 drivers/pci/probe.c:2814
pci_scan_child_bus_extend+0x54/0x8b0 drivers/pci/probe.c:3033
pci_scan_child_bus drivers/pci/probe.c:3147 [inline]
pci_rescan_bus+0x1d/0x40 drivers/pci/probe.c:3438
rescan_store+0xcd/0x150 drivers/pci/pci-sysfs.c:463
bus_attr_store+0x91/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x762/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f315599e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8e147348 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3155c25fa0 RCX: 00007f315599e159
RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007ffd8e1473b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f3155c25fac R14: 00007f3155c25fa0 R15: 00007f3155c25fa0
---[ end trace 0000000000000000 ]---
Oops: general protection fault, probably for non-canonical address 0xdffffc000000001a: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x00000000000000d0-0x00000000000000d7]
CPU: 0 UID: 0 PID: 382 Comm: syz.2.17 Tainted: G W syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__device_attach+0xb2/0x3c0 drivers/base/dd.c:1005
Code: 8d 66 68 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 d0 3b 9c fe 4d 8b 2c 24 4d 8d a5 d0 00 00 00 4c 89 e0 48 c1 e8 03 <0f> b6 04 18 84 c0 0f 85 dd 02 00 00 41 0f b6 1c 24 89 de 83 e6 01
RSP: 0018:ffffc90000fff9c0 EFLAGS: 00010202
RAX: 000000000000001a RBX: dffffc0000000000 RCX: ffffffff85a662a7
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc90000fff940
RBP: ffffc90000fffa68 R08: ffffc90000fff947 R09: 1ffff920001fff28
R10: dffffc0000000000 R11: fffff520001fff29 R12: 00000000000000d0
R13: 0000000000000000 R14: ffff8881153580c8 R15: 0000000000000000
FS: 00005555589e6500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bee88dfb58 CR3: 0000000115794000 CR4: 00000000003526b0
Call Trace:
device_attach+0x1b/0x40 drivers/base/dd.c:1072
pci_bus_add_device+0x11f/0x1f0 drivers/pci/bus.c:378
pci_bus_add_devices+0x98/0x1c0 drivers/pci/bus.c:401
pci_rescan_bus+0x30/0x40 drivers/pci/probe.c:3440
rescan_store+0xcd/0x150 drivers/pci/pci-sysfs.c:463
bus_attr_store+0x91/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x762/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f315599e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8e147348 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3155c25fa0 RCX: 00007f315599e159
RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007ffd8e1473b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f3155c25fac R14: 00007f3155c25fa0 R15: 00007f3155c25fa0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__device_attach+0xb2/0x3c0 drivers/base/dd.c:1005
Code: 8d 66 68 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 d0 3b 9c fe 4d 8b 2c 24 4d 8d a5 d0 00 00 00 4c 89 e0 48 c1 e8 03 <0f> b6 04 18 84 c0 0f 85 dd 02 00 00 41 0f b6 1c 24 89 de 83 e6 01
RSP: 0018:ffffc90000fff9c0 EFLAGS: 00010202
RAX: 000000000000001a RBX: dffffc0000000000 RCX: ffffffff85a662a7
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc90000fff940
RBP: ffffc90000fffa68 R08: ffffc90000fff947 R09: 1ffff920001fff28
R10: dffffc0000000000 R11: fffff520001fff29 R12: 00000000000000d0
R13: 0000000000000000 R14: ffff8881153580c8 R15: 0000000000000000
FS: 00005555589e6500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3155870050 CR3: 0000000115794000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
0: 8d 66 68 lea 0x68(%rsi),%esp
3: 4c 89 e0 mov %r12,%rax
6: 48 c1 e8 03 shr $0x3,%rax
a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
e: 74 08 je 0x18
10: 4c 89 e7 mov %r12,%rdi
13: e8 d0 3b 9c fe call 0xfe9c3be8
18: 4d 8b 2c 24 mov (%r12),%r13
1c: 4d 8d a5 d0 00 00 00 lea 0xd0(%r13),%r12
23: 4c 89 e0 mov %r12,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 dd 02 00 00 jne 0x313
36: 41 0f b6 1c 24 movzbl (%r12),%ebx
3b: 89 de mov %ebx,%esi
3d: 83 e6 01 and $0x1,%esi