Extracting prog: 2m26.915108336s Minimizing prog: 24m26.797164069s Simplifying prog options: 5m13.340370487s Extracting C: 57.240240112s Simplifying C: 0s extracting reproducer from 42 programs testing a last program of every proc single: executing 7 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bpf$MAP_CREATE_TAIL_CALL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl-close_range detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000"], 0x48) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r1, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") close_range(r0, 0xffffffffffffffff, 0x0) program crashed: memory leak in path_openat single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bpf$MAP_CREATE_TAIL_CALL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000"], 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bpf$MAP_CREATE_TAIL_CALL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000"], 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bpf$MAP_CREATE_TAIL_CALL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$iommufd-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000"], 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bpf$MAP_CREATE_TAIL_CALL-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000"], 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(0xffffffffffffffff, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-bpf$MAP_CREATE_TAIL_CALL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000"], 0x48) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, 0x0) program did not crash testing program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)) program did not crash extracting C reproducer testing compiled C program (duration=1m57.287405545s, {Threaded:true Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl program did not crash simplifying guilty program options testing program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat extracting C reproducer testing compiled C program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl program did not crash testing program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program did not crash testing program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat validation run: crashed=true testing program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat validation run: crashed=true testing program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash validation run: crashed=false testing program (duration=1m57.287405545s, {Threaded:false Repeat:true RepeatTimes:0 Procs:7 Slowdown:1 Sandbox:none SandboxArg:0 Leak:true NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc}) ioctl(r0, 0x3b8f, &(0x7f00000000c0)="2800000006000000010000000400000000000000000000000010") program crashed: memory leak in path_openat validation run: crashed=true reproducing took 43m11.368166716s repro crashed as (corrupted=false): 2026/08/22 14:47:52 executed programs: 26 2026/08/22 14:47:59 executed programs: 40 2026/08/22 14:48:07 executed programs: 54 2026/08/22 14:48:14 executed programs: 68 BUG: memory leak unreferenced object 0xffff88812811f9c0 (size 176): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 00 00 00 00 19 00 08 04 40 fc a8 85 ff ff ff ff ........@....... 00 02 38 03 81 88 ff ff 80 cd 61 11 81 88 ff ff ..8.......a..... backtrace (crc 1214ee3a): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] kmem_cache_alloc_noprof+0x352/0x440 mm/slub.c:4933 alloc_empty_file+0x57/0x180 fs/file_table.c:262 path_openat+0x44/0x11f0 fs/namei.c:4986 do_file_open+0x121/0x200 fs/namei.c:5029 do_sys_openat2+0xa7/0x150 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x82/0xf0 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff8881280ec188 (size 56): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): ff ff 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2672a0c6): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] kmem_cache_alloc_noprof+0x352/0x440 mm/slub.c:4933 lsm_file_alloc security/security.c:171 [inline] security_file_alloc+0x30/0x250 security/security.c:2406 init_file+0x3e/0x160 fs/file_table.c:184 alloc_empty_file+0x75/0x180 fs/file_table.c:266 path_openat+0x44/0x11f0 fs/namei.c:4986 do_file_open+0x121/0x200 fs/namei.c:5029 do_sys_openat2+0xa7/0x150 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x82/0xf0 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88811161cd80 (size 192): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): c0 f9 11 28 81 88 ff ff 00 00 00 00 2c 00 00 01 ...(........,... b2 6d b2 0e 81 88 ff ff 00 00 00 00 00 00 00 00 .m.............. backtrace (crc 6cdefeb4): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] __kmalloc_cache_noprof+0x359/0x440 mm/slub.c:5480 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] iommufd_fops_open+0x24/0xe0 drivers/iommu/iommufd/main.c:319 misc_open+0x12a/0x1f0 drivers/char/misc.c:163 chrdev_open+0x108/0x310 fs/char_dev.c:411 do_dentry_open+0x1fc/0x850 fs/open.c:996 vfs_open+0x3d/0x1b0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0xde7/0x11f0 fs/namei.c:5000 do_file_open+0x121/0x200 fs/namei.c:5029 do_sys_openat2+0xa7/0x150 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x82/0xf0 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff888127dd4000 (size 256): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 01 00 00 00 01 00 00 00 04 00 00 00 01 00 00 00 ................ 00 00 00 00 00 00 00 00 01 48 cf 0a 81 88 ff ff .........H...... backtrace (crc 98731819): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] __do_kmalloc_node mm/slub.c:5336 [inline] __kmalloc_noprof+0x3c2/0x560 mm/slub.c:5362 _kmalloc_noprof include/linux/slab.h:992 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] _iommufd_object_alloc+0x24/0x100 drivers/iommu/iommufd/main.c:41 iommufd_ioas_alloc drivers/iommu/iommufd/ioas.c:28 [inline] iommufd_ioas_alloc_ioctl+0x46/0x160 drivers/iommu/iommufd/ioas.c:47 iommufd_fops_ioctl+0x1ed/0x370 drivers/iommu/iommufd/main.c:556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88810eb26db0 (size 576): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 00 17 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 88 cd 61 11 81 88 ff ff c8 6d b2 0e 81 88 ff ff ..a......m...... backtrace (crc f41786a5): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] kmem_cache_alloc_lru_noprof+0x350/0x440 mm/slub.c:4952 xas_alloc+0xf1/0x110 lib/xarray.c:378 xas_expand lib/xarray.c:590 [inline] xas_create+0x105/0x8a0 lib/xarray.c:661 xas_store+0x7a/0xb20 lib/xarray.c:795 __xa_alloc+0xec/0x200 lib/xarray.c:2005 xa_alloc include/linux/xarray.h:878 [inline] _iommufd_object_alloc+0x9d/0x100 drivers/iommu/iommufd/main.c:56 iommufd_ioas_alloc drivers/iommu/iommufd/ioas.c:28 [inline] iommufd_ioas_alloc_ioctl+0x46/0x160 drivers/iommu/iommufd/ioas.c:47 iommufd_fops_ioctl+0x1ed/0x370 drivers/iommu/iommufd/main.c:556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88811161ccc0 (size 192): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 21b0f99b): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] __kmalloc_cache_noprof+0x359/0x440 mm/slub.c:5480 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] iopt_alloc_pages.part.0+0x2b/0x210 drivers/iommu/iommufd/pages.c:1375 iopt_alloc_pages drivers/iommu/iommufd/pages.c:1432 [inline] iopt_alloc_file_pages+0x7c/0xf0 drivers/iommu/iommufd/pages.c:1425 iopt_map_file_pages+0x184/0x1e0 drivers/iommu/iommufd/io_pagetable.c:518 iommufd_ioas_map_file+0x152/0x2f0 drivers/iommu/iommufd/ioas.c:231 iommufd_fops_ioctl+0x1ed/0x370 drivers/iommu/iommufd/main.c:556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f connection error: failed to recv *flatrpc.ExecutorMessageRawT: read tcp 127.0.0.1:41845->127.0.0.1:36772: read: connection reset by peer final repro crashed as (corrupted=false): 2026/08/22 14:47:52 executed programs: 26 2026/08/22 14:47:59 executed programs: 40 2026/08/22 14:48:07 executed programs: 54 2026/08/22 14:48:14 executed programs: 68 BUG: memory leak unreferenced object 0xffff88812811f9c0 (size 176): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 00 00 00 00 19 00 08 04 40 fc a8 85 ff ff ff ff ........@....... 00 02 38 03 81 88 ff ff 80 cd 61 11 81 88 ff ff ..8.......a..... backtrace (crc 1214ee3a): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] kmem_cache_alloc_noprof+0x352/0x440 mm/slub.c:4933 alloc_empty_file+0x57/0x180 fs/file_table.c:262 path_openat+0x44/0x11f0 fs/namei.c:4986 do_file_open+0x121/0x200 fs/namei.c:5029 do_sys_openat2+0xa7/0x150 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x82/0xf0 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff8881280ec188 (size 56): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): ff ff 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2672a0c6): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] kmem_cache_alloc_noprof+0x352/0x440 mm/slub.c:4933 lsm_file_alloc security/security.c:171 [inline] security_file_alloc+0x30/0x250 security/security.c:2406 init_file+0x3e/0x160 fs/file_table.c:184 alloc_empty_file+0x75/0x180 fs/file_table.c:266 path_openat+0x44/0x11f0 fs/namei.c:4986 do_file_open+0x121/0x200 fs/namei.c:5029 do_sys_openat2+0xa7/0x150 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x82/0xf0 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88811161cd80 (size 192): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): c0 f9 11 28 81 88 ff ff 00 00 00 00 2c 00 00 01 ...(........,... b2 6d b2 0e 81 88 ff ff 00 00 00 00 00 00 00 00 .m.............. backtrace (crc 6cdefeb4): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] __kmalloc_cache_noprof+0x359/0x440 mm/slub.c:5480 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] iommufd_fops_open+0x24/0xe0 drivers/iommu/iommufd/main.c:319 misc_open+0x12a/0x1f0 drivers/char/misc.c:163 chrdev_open+0x108/0x310 fs/char_dev.c:411 do_dentry_open+0x1fc/0x850 fs/open.c:996 vfs_open+0x3d/0x1b0 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0xde7/0x11f0 fs/namei.c:5000 do_file_open+0x121/0x200 fs/namei.c:5029 do_sys_openat2+0xa7/0x150 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x82/0xf0 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff888127dd4000 (size 256): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 01 00 00 00 01 00 00 00 04 00 00 00 01 00 00 00 ................ 00 00 00 00 00 00 00 00 01 48 cf 0a 81 88 ff ff .........H...... backtrace (crc 98731819): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] __do_kmalloc_node mm/slub.c:5336 [inline] __kmalloc_noprof+0x3c2/0x560 mm/slub.c:5362 _kmalloc_noprof include/linux/slab.h:992 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] _iommufd_object_alloc+0x24/0x100 drivers/iommu/iommufd/main.c:41 iommufd_ioas_alloc drivers/iommu/iommufd/ioas.c:28 [inline] iommufd_ioas_alloc_ioctl+0x46/0x160 drivers/iommu/iommufd/ioas.c:47 iommufd_fops_ioctl+0x1ed/0x370 drivers/iommu/iommufd/main.c:556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88810eb26db0 (size 576): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 00 17 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 88 cd 61 11 81 88 ff ff c8 6d b2 0e 81 88 ff ff ..a......m...... backtrace (crc f41786a5): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] kmem_cache_alloc_lru_noprof+0x350/0x440 mm/slub.c:4952 xas_alloc+0xf1/0x110 lib/xarray.c:378 xas_expand lib/xarray.c:590 [inline] xas_create+0x105/0x8a0 lib/xarray.c:661 xas_store+0x7a/0xb20 lib/xarray.c:795 __xa_alloc+0xec/0x200 lib/xarray.c:2005 xa_alloc include/linux/xarray.h:878 [inline] _iommufd_object_alloc+0x9d/0x100 drivers/iommu/iommufd/main.c:56 iommufd_ioas_alloc drivers/iommu/iommufd/ioas.c:28 [inline] iommufd_ioas_alloc_ioctl+0x46/0x160 drivers/iommu/iommufd/ioas.c:47 iommufd_fops_ioctl+0x1ed/0x370 drivers/iommu/iommufd/main.c:556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88811161ccc0 (size 192): comm "syz.0.25", pid 6047, jiffies 4294943865 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 21b0f99b): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4599 [inline] slab_alloc_node mm/slub.c:4919 [inline] __kmalloc_cache_noprof+0x359/0x440 mm/slub.c:5480 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] iopt_alloc_pages.part.0+0x2b/0x210 drivers/iommu/iommufd/pages.c:1375 iopt_alloc_pages drivers/iommu/iommufd/pages.c:1432 [inline] iopt_alloc_file_pages+0x7c/0xf0 drivers/iommu/iommufd/pages.c:1425 iopt_map_file_pages+0x184/0x1e0 drivers/iommu/iommufd/io_pagetable.c:518 iommufd_ioas_map_file+0x152/0x2f0 drivers/iommu/iommufd/ioas.c:231 iommufd_fops_ioctl+0x1ed/0x370 drivers/iommu/iommufd/main.c:556 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f connection error: failed to recv *flatrpc.ExecutorMessageRawT: read tcp 127.0.0.1:41845->127.0.0.1:36772: read: connection reset by peer