Extracting prog: 7m19.023031828s
Minimizing prog: 3m58.549464786s
Simplifying prog options: 7m10.590422854s
Extracting C: 1m56.039909156s
Simplifying C: 0s


extracting reproducer from 24 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(&(0x7f0000000140), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi
detailed listing:
executing program 0:
syz_usb_connect$midi(0x3, 0x41, &(0x7f00000008c0)=ANY=[@ANYBLOB="120110030000002030144b4740000102030109022f00010102900009040000020103200709ff0c02080000410105250101f7090504032000080900062501"], &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x1, 0x3d, &(0x7f0000000680)=ANY=[@ANYBLOB="1201d08ea8b9a3082e0c200729d40102030109022b00010804400309046d00027854990109050308000200050907058e33974a9509050b080800080c"], &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x91, 0xb7, 0x77, 0x40, 0xeb1, 0x7007, 0x210, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0xfa, 0x40, 0xf, "", [{{0x9, 0x4, 0xc6, 0x5, 0x0, 0xb, 0xbf, 0xd9, 0x6a}}]}}]}}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
detailed listing:
executing program 3:
syz_usb_connect(0x0, 0x3d, &(0x7f0000000fc0)={{0x12, 0x1, 0x110, 0xe, 0x73, 0x1b, 0x8, 0xf11, 0x1031, 0x2f8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2b, 0x1, 0x7, 0x95, 0x70, 0x1, "", [{{0x9, 0x4, 0x6b, 0x2, 0x2, 0xd6, 0xff, 0xd0, 0x81, [], [{{0x9, 0x5, 0x80, 0x2, 0x20, 0x7f, 0x8, 0x80}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x77, 0x3, 0x3, [@generic={0x7, 0x5, "d75eef973c"}]}}]}}]}}]}}, 0x0)
executing program 0:
semctl$SETALL(0xffffffffffffffff, 0x0, 0x11, 0x0)
executing program 0:
mbind(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4006, &(0x7f0000000c00)=0x6, 0x6, 0x2)
executing program 3:
socket$kcm(0x2, 0xd, 0x2)
executing program 0:
io_setup(0xaa, &(0x7f0000000100))
executing program 3:
syz_usb_connect$uac1(0x5, 0x7d, &(0x7f0000000240)=ANY=[@ANYBLOB="120150020000000882057d0040000102030109026b0003010260070904000000010100000a240101800a000201020904010000010200000904010101010200000b240201c0043007ed9c7709f0ffffff0f0000000725010009d50a090402"], &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0})
executing program 0:
futex$unlock_wake_list32(&(0x7f0000000080)=0xfffffe00, 0x68a, 0xed, 0x0, &(0x7f0000000240)=0x8001, 0x1)
executing program 0:
syz_usb_connect(0x2, 0x36, &(0x7f0000000c80)=ANY=[@ANYBLOB="12010102e98a9940720c0c003d0e0102030109022400010103c00409045db9"], &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x0})
executing program 2:
execve(&(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x0, 0x0)
executing program 2:
io_setup(0xaa, &(0x7f0000000100))
executing program 2:
add_key$keyring(&(0x7f0000000140), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)
executing program 3:
syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @inquiry_info={{0x2, 0x1d}, {0x2, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x14}, 0x8, 0x5, 0xfd, 'hHU', 0x41b}, {@any, 0x3, 0xe, 0x3, "94eaed", 0x5}]}}}, 0x20)
executing program 1:
wait4(0xffffffffffffffff, 0x0, 0x8, 0x0)
executing program 1:
add_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="000001020200", 0x6, 0xfffffffffffffffb)
executing program 2:
syz_clone(0x12021000, 0x0, 0x0, 0x0, 0x0, 0x0)
executing program 3:
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
executing program 3:
syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x91, 0xb7, 0x77, 0x40, 0xeb1, 0x7007, 0x210, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0xfa, 0x40, 0xf, "", [{{0x9, 0x4, 0xc6, 0x5, 0x0, 0xb, 0xbf, 0xd9, 0x6a}}]}}]}}, 0x0)
executing program 2:
unshare(0x40000080)
executing program 0:
syz_usb_connect(0x1, 0x3d, &(0x7f0000000680)=ANY=[@ANYBLOB="1201d08ea8b9a3082e0c200729d40102030109022b00010804400309046d00027854990109050308000200050907058e33974a9509050b080800080c"], &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
executing program 1:
mount(&(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000300)='udf\x00', 0x200480, 0x0)
executing program 1:
prctl$PR_SET_MM_EXE_FILE(0x38, 0xd, 0xffffffffffffffff)
executing program 2:
syz_usb_connect$midi(0x3, 0x41, &(0x7f00000008c0)=ANY=[@ANYBLOB="120110030000002030144b4740000102030109022f00010102900009040000020103200709ff0c02080000410105250101f7090504032000080900062501"], &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0})
executing program 1:
add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0a01070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c64e00305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd)
executing program 1:
add_key$keyring(&(0x7f0000000140), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(&(0x7f0000000140), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program crashed: general protection fault in __bh_submit
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=1m32.251133918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program crashed: general protection fault in __bh_submit
testing program (duration=1m32.251133918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m32.251133918s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
program did not crash
simplifying guilty program options
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program crashed: general protection fault in __bh_submit
extracting C reproducer
testing compiled C program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
program did not crash
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program crashed: general protection fault in __bh_submit
validation run: crashed=true
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program crashed: general protection fault in __bh_submit
validation run: crashed=true
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
testing program (duration=1m32.251133918s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring
detailed listing:
executing program 0:
add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc)

program did not crash
validation run: crashed=false
reproducing took 37m39.796016082s
repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 4945 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_dropbehind include/linux/page-flags.h:601 [inline]
RIP: 0010:__bh_submit+0x22d/0x8d0 fs/buffer.c:1109
Code: c1 e8 03 48 89 44 24 18 42 80 3c 20 00 74 08 48 89 df e8 56 d6 d7 ff 48 89 5c 24 28 48 8b 1b 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 34 d6 d7 ff 4d 8b 3f 4c 89 fe 48
RSP: 0018:ffffc9000f237868 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff84b9a0d9
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88806b0377a0
RBP: 0000000000009801 R08: ffff88806b0377ff R09: 1ffff1100d606eff
R10: dffffc0000000000 R11: ffffed100d606f00 R12: dffffc0000000000
R13: ffff88806b037780 R14: ffff8880245a7c40 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff888124866000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f62835ed158 CR3: 0000000034b80000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 jbd2_journal_commit_transaction+0x22a9/0x5cd0 fs/jbd2/commit.c:751
 kjournald2+0x3bc/0x750 fs/jbd2/journal.c:200
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_dropbehind include/linux/page-flags.h:601 [inline]
RIP: 0010:__bh_submit+0x22d/0x8d0 fs/buffer.c:1109
Code: c1 e8 03 48 89 44 24 18 42 80 3c 20 00 74 08 48 89 df e8 56 d6 d7 ff 48 89 5c 24 28 48 8b 1b 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 34 d6 d7 ff 4d 8b 3f 4c 89 fe 48
RSP: 0018:ffffc9000f237868 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff84b9a0d9
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88806b0377a0
RBP: 0000000000009801 R08: ffff88806b0377ff R09: 1ffff1100d606eff
R10: dffffc0000000000 R11: ffffed100d606f00 R12: dffffc0000000000
R13: ffff88806b037780 R14: ffff8880245a7c40 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff888124866000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc9576fec0 CR3: 0000000071b28000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	c1 e8 03             	shr    $0x3,%eax
   3:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
   8:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
   d:	74 08                	je     0x17
   f:	48 89 df             	mov    %rbx,%rdi
  12:	e8 56 d6 d7 ff       	call   0xffd7d66d
  17:	48 89 5c 24 28       	mov    %rbx,0x28(%rsp)
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	4c 8d 7b 08          	lea    0x8(%rbx),%r15
  23:	4c 89 f8             	mov    %r15,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 ff             	mov    %r15,%rdi
  34:	e8 34 d6 d7 ff       	call   0xffd7d66d
  39:	4d 8b 3f             	mov    (%r15),%r15
  3c:	4c 89 fe             	mov    %r15,%rsi
  3f:	48                   	rex.W

final repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 4945 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_dropbehind include/linux/page-flags.h:601 [inline]
RIP: 0010:__bh_submit+0x22d/0x8d0 fs/buffer.c:1109
Code: c1 e8 03 48 89 44 24 18 42 80 3c 20 00 74 08 48 89 df e8 56 d6 d7 ff 48 89 5c 24 28 48 8b 1b 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 34 d6 d7 ff 4d 8b 3f 4c 89 fe 48
RSP: 0018:ffffc9000f237868 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff84b9a0d9
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88806b0377a0
RBP: 0000000000009801 R08: ffff88806b0377ff R09: 1ffff1100d606eff
R10: dffffc0000000000 R11: ffffed100d606f00 R12: dffffc0000000000
R13: ffff88806b037780 R14: ffff8880245a7c40 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff888124866000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f62835ed158 CR3: 0000000034b80000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 jbd2_journal_commit_transaction+0x22a9/0x5cd0 fs/jbd2/commit.c:751
 kjournald2+0x3bc/0x750 fs/jbd2/journal.c:200
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:const_folio_flags include/linux/page-flags.h:345 [inline]
RIP: 0010:folio_test_dropbehind include/linux/page-flags.h:601 [inline]
RIP: 0010:__bh_submit+0x22d/0x8d0 fs/buffer.c:1109
Code: c1 e8 03 48 89 44 24 18 42 80 3c 20 00 74 08 48 89 df e8 56 d6 d7 ff 48 89 5c 24 28 48 8b 1b 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 34 d6 d7 ff 4d 8b 3f 4c 89 fe 48
RSP: 0018:ffffc9000f237868 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff84b9a0d9
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff88806b0377a0
RBP: 0000000000009801 R08: ffff88806b0377ff R09: 1ffff1100d606eff
R10: dffffc0000000000 R11: ffffed100d606f00 R12: dffffc0000000000
R13: ffff88806b037780 R14: ffff8880245a7c40 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff888124866000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc9576fec0 CR3: 0000000071b28000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	c1 e8 03             	shr    $0x3,%eax
   3:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
   8:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
   d:	74 08                	je     0x17
   f:	48 89 df             	mov    %rbx,%rdi
  12:	e8 56 d6 d7 ff       	call   0xffd7d66d
  17:	48 89 5c 24 28       	mov    %rbx,0x28(%rsp)
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	4c 8d 7b 08          	lea    0x8(%rbx),%r15
  23:	4c 89 f8             	mov    %r15,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 ff             	mov    %r15,%rdi
  34:	e8 34 d6 d7 ff       	call   0xffd7d66d
  39:	4d 8b 3f             	mov    (%r15),%r15
  3c:	4c 89 fe             	mov    %r15,%rsi
  3f:	48                   	rex.W