Extracting prog: 3m43.328484321s
Minimizing prog: 19m15.393881482s
Simplifying prog options: 0s
Extracting C: 1m15.449561025s
Simplifying C: 26m48.207536864s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_route-sendmsg$nl_route-socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_route-sendmsg$nl_route-socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: BUG: corrupted list in flow_block_cb_setup_simple
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_route-sendmsg$nl_route-socket$nl_netfilter
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

program did not crash
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_route-sendmsg$nl_route-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program did not crash
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_route-socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: KASAN: slab-use-after-free Read in flow_block_cb_setup_simple
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
socket$netlink(0x10, 0x3, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x104}}, 0x0)

program did not crash
testing program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB], 0x104}}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m31.612199558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
simplifying C reproducer
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program did not crash
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program did not crash
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program did not crash
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: KASAN: slab-use-after-free Read in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: KASAN: slab-use-after-free Read in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program did not crash
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing compiled C program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
program crashed: BUG: corrupted list in flow_block_cb_setup_simple
testing program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: BUG: corrupted list in flow_block_cb_setup_simple
validation run: crashed=true
testing program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: BUG: corrupted list in flow_block_cb_setup_simple
validation run: crashed=true
testing program (duration=1m31.612199558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x1400, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a010400000000000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c0002800800018000000001140000001100010000000000000000000500000a1a3adf5c7fcb8ada8864503ad727fc482bd79d5279fa21d895c1c7ee92dd6fb6c40e5b23c83101a70903d2246daf413bc4f929a57455b531c5c6677f694d9fac7fb6099f0023086e6ac91236b088b93de3725b0b4d1b0509480466122b01c094c321f7304207e116ceaf428d05aac0bce7f7ac5bd51664e157599091"], 0x104}}, 0x0)

program crashed: BUG: corrupted list in flow_block_cb_setup_simple
validation run: crashed=true
reproducing took 56m54.034714509s
repro crashed as (corrupted=false):
 non-slab/vmalloc memory
list_del corruption. next->prev should be ffff8880298a6d00, but was ffff8880338a3500. (next=ffffffff8faccb60)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:67!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6962 Comm: syz.0.977 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__list_del_entry_valid_or_report+0x18a/0x190 lib/list_debug.c:65
Code: 0c e3 2a fd 43 80 3c 2c 00 74 08 4c 89 ff e8 ad 31 4d fd 49 8b 56 08 48 c7 c7 c0 a5 6d 8c 48 89 de 4c 89 f1 e8 d7 16 3d fc 90 <0f> 0b cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000252e760 EFLAGS: 00010246
RAX: 000000000000006d RBX: ffff8880298a6d00 RCX: bee2768034b10500
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: 1ffff920004a5d42 R08: ffff8880b8624713 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: 1ffffffff1f5996d
R13: dffffc0000000000 R14: ffffffff8faccb60 R15: ffffffff8faccb68
FS:  00005555685ca500(0000) GS:ffff888124cce000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f76d23556c8 CR3: 0000000070c5a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:140 [inline]
 __list_del_entry include/linux/list.h:261 [inline]
 list_del include/linux/list.h:275 [inline]
 flow_block_cb_setup_simple+0x631/0x750 net/core/flow_offload.c:367
 nft_block_offload_cmd net/netfilter/nf_tables_offload.c:397 [inline]
 nft_chain_offload_cmd+0x2b1/0x650 net/netfilter/nf_tables_offload.c:451
 nft_flow_block_chain net/netfilter/nf_tables_offload.c:471 [inline]
 nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]
 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
 nft_flow_rule_offload_commit+0x17d5/0x1d40 net/netfilter/nf_tables_offload.c:620
 nf_tables_commit+0x1165/0xad60 net/netfilter/nf_tables_api.c:11000
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:574 [inline]
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
 nfnetlink_rcv+0x1caf/0x28c0 net/netfilter/nfnetlink.c:665
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2713
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1db1d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc0c683ce8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f1db2025fa0 RCX: 00007f1db1d9e159
RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f1db1e3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1db2025fac R14: 00007f1db2025fa0 R15: 00007f1db2025fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x18a/0x190 lib/list_debug.c:65
Code: 0c e3 2a fd 43 80 3c 2c 00 74 08 4c 89 ff e8 ad 31 4d fd 49 8b 56 08 48 c7 c7 c0 a5 6d 8c 48 89 de 4c 89 f1 e8 d7 16 3d fc 90 <0f> 0b cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000252e760 EFLAGS: 00010246
RAX: 000000000000006d RBX: ffff8880298a6d00 RCX: bee2768034b10500
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: 1ffff920004a5d42 R08: ffff8880b8624713 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: 1ffffffff1f5996d
R13: dffffc0000000000 R14: ffffffff8faccb60 R15: ffffffff8faccb68
FS:  00005555685ca500(0000) GS:ffff888124cce000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002d504d9b8000 CR3: 0000000070c5a000 CR4: 00000000003526f0

final repro crashed as (corrupted=false):
 non-slab/vmalloc memory
list_del corruption. next->prev should be ffff8880298a6d00, but was ffff8880338a3500. (next=ffffffff8faccb60)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:67!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6962 Comm: syz.0.977 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__list_del_entry_valid_or_report+0x18a/0x190 lib/list_debug.c:65
Code: 0c e3 2a fd 43 80 3c 2c 00 74 08 4c 89 ff e8 ad 31 4d fd 49 8b 56 08 48 c7 c7 c0 a5 6d 8c 48 89 de 4c 89 f1 e8 d7 16 3d fc 90 <0f> 0b cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000252e760 EFLAGS: 00010246
RAX: 000000000000006d RBX: ffff8880298a6d00 RCX: bee2768034b10500
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: 1ffff920004a5d42 R08: ffff8880b8624713 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: 1ffffffff1f5996d
R13: dffffc0000000000 R14: ffffffff8faccb60 R15: ffffffff8faccb68
FS:  00005555685ca500(0000) GS:ffff888124cce000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f76d23556c8 CR3: 0000000070c5a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __list_del_entry_valid include/linux/list.h:140 [inline]
 __list_del_entry include/linux/list.h:261 [inline]
 list_del include/linux/list.h:275 [inline]
 flow_block_cb_setup_simple+0x631/0x750 net/core/flow_offload.c:367
 nft_block_offload_cmd net/netfilter/nf_tables_offload.c:397 [inline]
 nft_chain_offload_cmd+0x2b1/0x650 net/netfilter/nf_tables_offload.c:451
 nft_flow_block_chain net/netfilter/nf_tables_offload.c:471 [inline]
 nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]
 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline]
 nft_flow_rule_offload_commit+0x17d5/0x1d40 net/netfilter/nf_tables_offload.c:620
 nf_tables_commit+0x1165/0xad60 net/netfilter/nf_tables_api.c:11000
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:574 [inline]
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
 nfnetlink_rcv+0x1caf/0x28c0 net/netfilter/nfnetlink.c:665
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2713
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1db1d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc0c683ce8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f1db2025fa0 RCX: 00007f1db1d9e159
RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f1db1e3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1db2025fac R14: 00007f1db2025fa0 R15: 00007f1db2025fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x18a/0x190 lib/list_debug.c:65
Code: 0c e3 2a fd 43 80 3c 2c 00 74 08 4c 89 ff e8 ad 31 4d fd 49 8b 56 08 48 c7 c7 c0 a5 6d 8c 48 89 de 4c 89 f1 e8 d7 16 3d fc 90 <0f> 0b cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000252e760 EFLAGS: 00010246
RAX: 000000000000006d RBX: ffff8880298a6d00 RCX: bee2768034b10500
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: 1ffff920004a5d42 R08: ffff8880b8624713 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: 1ffffffff1f5996d
R13: dffffc0000000000 R14: ffffffff8faccb60 R15: ffffffff8faccb68
FS:  00005555685ca500(0000) GS:ffff888124cce000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002d504d9b8000 CR3: 0000000070c5a000 CR4: 00000000003526f0