Extracting prog: 8m30.5923458s Minimizing prog: 24m59.172287885s Simplifying prog options: 0s Extracting C: 1m39.361827372s Simplifying C: 9m6.090694511s 12 programs, timeouts [45s 5m0s 16m0s] extracting reproducer from 12 programs single: executing 2 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0xff07) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD_XDP-bpf$MAP_CREATE-bpf$PROG_LOAD-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$PROG_LOAD-socket$nl_route-sendmsg$nl_route-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_route-sendmsg$nl_route-read-bpf$BPF_RAW_TRACEPOINT_OPEN-timerfd_create-timerfd_settime detailed listing: executing program 0: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0}, 0x90) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_getnetconf={0x14, 0x52, 0x311}, 0x14}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000a80)='ext4_writepages\x00'}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlinkprop={0x20, 0x10, 0xf8b}, 0x20}}, 0x0) read(r3, &(0x7f0000000200)=""/4096, 0x1000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 12 programs with base timeout 45s testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 2, 6, 3, 2, 23, 3, 2, 2, 3, 2, 3] detailed listing: executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x60}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x3}) executing program 0: open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7949) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x80000000000206, 0x0) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000000)='#!', 0x2}], 0x1) write(r0, &(0x7f0000000300)="1e", 0x1) writev(r0, &(0x7f00000017c0)=[{&(0x7f00000019c0)="202060c9b56140b83bb67100419cef42206aab7b26f3fed971007eb7c6723352d946c7ea256464a1b9ac5c8000000014edb2feb29fd002f3e7090000cf4bb2a8dfc8f997644c11911adcf769cebc15eec747fd3e940a", 0x56}], 0x1) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) setsockopt$sock_int(r0, 0xffff, 0x1001, &(0x7f0000000100), 0x4) executing program 0: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 0: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32], 0x0}, 0x90) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_getnetconf={0x14, 0x52, 0x311}, 0x14}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000a80)='ext4_writepages\x00'}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlinkprop={0x20, 0x10, 0xf8b}, 0x20}}, 0x0) read(r3, &(0x7f0000000200)=""/4096, 0x1000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000001c0)={@mcast2, 0x40, r1}) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x8001000000000000, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x8, 0x3, 0x2b0, 0xf8, 0x11, 0x148, 0xf8, 0x0, 0x218, 0x2a8, 0x2a8, 0x218, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff}, {0x0, [0x4, 0x3, 0x1, 0x2, 0x5]}}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'batadv_slave_1\x00'}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@ttl={{0x28}}, @inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x310) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)=@newsa={0x144, 0x10, 0x713, 0x0, 0x0, {{@in=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in6=@empty, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x20}, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @offload={0xc}]}, 0x144}}, 0x0) executing program 1: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) write(r0, &(0x7f0000000040)="240000001a005f0214f9f507000909000a000000000000000000000004001e0000000000", 0x24) executing program 1: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r0, 0x84, 0x7b, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) executing program 1: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0xff07) program did not crash replaying the whole log did not cause a kernel crash single: executing 2 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0xff07) program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open detailed listing: executing program 0: r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r0, 0x0) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-ioctl$EXT4_IOC_MIGRATE detailed listing: executing program 0: syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0xff07) program did not crash testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE detailed listing: executing program 0: r0 = syz_pidfd_open(0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0xff07) program did not crash extracting C reproducer testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed simplifying C reproducer testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone-syz_pidfd_open-ioctl$EXT4_IOC_MIGRATE program crashed: BUG: unable to handle kernel NULL pointer dereference in path_from_stashed reproducing took 44m15.217184918s repro crashed as (corrupted=false): 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 when read [00000008] *pgd=844c0003, *pmd=fe12e003 Internal error: Oops: 205 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 3011 Comm: syz-executor103 Not tainted 6.10.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at path_from_stashed+0x1c/0x308 fs/libfs.c:2204 LR is at open_namespace+0x44/0xbc fs/nsfs.c:102 pc : [<8053af54>] lr : [<8054d6f8>] psr: 80000013 sp : df959e80 ip : 84183000 fp : df959ec4 r10: 84183000 r9 : 00000003 r8 : 843f3300 r7 : 82caa250 r6 : 84183000 r5 : 00000000 r4 : 82625878 r3 : df959ecc r2 : 00000008 r1 : 82c95800 r0 : 00000008 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 843f1a00 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: slab kmalloc-1k start 82c95800 pointer offset 0 size 1024 Register r2 information: non-paged memory Register r3 information: 2-page vmalloc region starting at 0xdf958000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2780 Register r4 information: non-slab/vmalloc memory Register r5 information: NULL pointer Register r6 information: slab task_struct start 84183000 pointer offset 0 size 3072 Register r7 information: slab mnt_cache start 82caa240 pointer offset 16 size 184 Register r8 information: slab filp start 843f3300 pointer offset 0 size 160 Register r9 information: non-paged memory Register r10 information: slab task_struct start 84183000 pointer offset 0 size 3072 Register r11 information: 2-page vmalloc region starting at 0xdf958000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2780 Register r12 information: slab task_struct start 84183000 pointer offset 0 size 3072 Process syz-executor103 (pid: 3011, stack limit = 0xdf958000) Stack: (0xdf959e80 to 0xdf95a000) 9e80: 841b2400 00000008 df959eb4 df959e98 806e6544 804065ac 00000009 82625878 9ea0: 00000000 84183000 841b2c80 843f3300 00000003 84183000 df959ef4 df959ec8 9ec0: 8054d6f8 8053af44 df959ef4 00000000 00000000 f9244696 82625878 82625878 9ee0: 841b2400 00000008 df959f14 df959ef8 8055271c 8054d6c0 0000ff07 00000000 9f00: 843f3300 00000000 df959fa4 df959f18 8051a7f0 805525a4 000001b2 8020029c 9f20: 84183000 000001b2 df959fac df959f38 8020ba70 8042c724 83f01500 df959f80 9f40: 00000000 843f3300 00000003 82cb0800 df959f7c df959f60 805283b8 8027aebc 9f60: 83f01500 00000003 83f01500 00000003 df959fa4 f9244696 8026b8b0 00000000 9f80: 00000000 0008e058 00000036 8020029c 84183000 00000036 00000000 df959fa8 9fa0: 80200060 8051a6c8 00000000 00000000 00000003 0000ff07 00000000 00000000 9fc0: 00000000 00000000 0008e058 00000036 7ee54e0c 00000000 00000001 00000000 9fe0: 7ee54c70 7ee54c60 0001064c 0002e7a0 00000010 00000003 00000000 00000000 Call trace: [<8053af38>] (path_from_stashed) from [<8054d6f8>] (open_namespace+0x44/0xbc fs/nsfs.c:102) r10:84183000 r9:00000003 r8:843f3300 r7:841b2c80 r6:84183000 r5:00000000 r4:82625878 [<8054d6b4>] (open_namespace) from [<8055271c>] (pidfd_ioctl+0x184/0x4c4 fs/pidfs.c:196) r6:00000008 r5:841b2400 r4:82625878 [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (do_vfs_ioctl fs/ioctl.c:861 [inline]) [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (__do_sys_ioctl fs/ioctl.c:905 [inline]) [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893) r7:00000000 r6:843f3300 r5:00000000 r4:0000ff07 [<8051a6bc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdf959fa8 to 0xdf959ff0) 9fa0: 00000000 00000000 00000003 0000ff07 00000000 00000000 9fc0: 00000000 00000000 0008e058 00000036 7ee54e0c 00000000 00000001 00000000 9fe0: 7ee54c70 7ee54c60 0001064c 0002e7a0 r10:00000036 r9:84183000 r8:8020029c r7:00000036 r6:0008e058 r5:00000000 r4:00000000 Code: e24dd01c e1a07001 e5911004 ee1dcf70 (e5905000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e24dd01c sub sp, sp, #28 4: e1a07001 mov r7, r1 8: e5911004 ldr r1, [r1, #4] c: ee1dcf70 mrc 15, 0, ip, cr13, cr0, {3} * 10: e5905000 ldr r5, [r0] <-- trapping instruction final repro crashed as (corrupted=false): 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 when read [00000008] *pgd=844c0003, *pmd=fe12e003 Internal error: Oops: 205 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 3011 Comm: syz-executor103 Not tainted 6.10.0-syzkaller #0 Hardware name: ARM-Versatile Express PC is at path_from_stashed+0x1c/0x308 fs/libfs.c:2204 LR is at open_namespace+0x44/0xbc fs/nsfs.c:102 pc : [<8053af54>] lr : [<8054d6f8>] psr: 80000013 sp : df959e80 ip : 84183000 fp : df959ec4 r10: 84183000 r9 : 00000003 r8 : 843f3300 r7 : 82caa250 r6 : 84183000 r5 : 00000000 r4 : 82625878 r3 : df959ecc r2 : 00000008 r1 : 82c95800 r0 : 00000008 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 843f1a00 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: slab kmalloc-1k start 82c95800 pointer offset 0 size 1024 Register r2 information: non-paged memory Register r3 information: 2-page vmalloc region starting at 0xdf958000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2780 Register r4 information: non-slab/vmalloc memory Register r5 information: NULL pointer Register r6 information: slab task_struct start 84183000 pointer offset 0 size 3072 Register r7 information: slab mnt_cache start 82caa240 pointer offset 16 size 184 Register r8 information: slab filp start 843f3300 pointer offset 0 size 160 Register r9 information: non-paged memory Register r10 information: slab task_struct start 84183000 pointer offset 0 size 3072 Register r11 information: 2-page vmalloc region starting at 0xdf958000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2780 Register r12 information: slab task_struct start 84183000 pointer offset 0 size 3072 Process syz-executor103 (pid: 3011, stack limit = 0xdf958000) Stack: (0xdf959e80 to 0xdf95a000) 9e80: 841b2400 00000008 df959eb4 df959e98 806e6544 804065ac 00000009 82625878 9ea0: 00000000 84183000 841b2c80 843f3300 00000003 84183000 df959ef4 df959ec8 9ec0: 8054d6f8 8053af44 df959ef4 00000000 00000000 f9244696 82625878 82625878 9ee0: 841b2400 00000008 df959f14 df959ef8 8055271c 8054d6c0 0000ff07 00000000 9f00: 843f3300 00000000 df959fa4 df959f18 8051a7f0 805525a4 000001b2 8020029c 9f20: 84183000 000001b2 df959fac df959f38 8020ba70 8042c724 83f01500 df959f80 9f40: 00000000 843f3300 00000003 82cb0800 df959f7c df959f60 805283b8 8027aebc 9f60: 83f01500 00000003 83f01500 00000003 df959fa4 f9244696 8026b8b0 00000000 9f80: 00000000 0008e058 00000036 8020029c 84183000 00000036 00000000 df959fa8 9fa0: 80200060 8051a6c8 00000000 00000000 00000003 0000ff07 00000000 00000000 9fc0: 00000000 00000000 0008e058 00000036 7ee54e0c 00000000 00000001 00000000 9fe0: 7ee54c70 7ee54c60 0001064c 0002e7a0 00000010 00000003 00000000 00000000 Call trace: [<8053af38>] (path_from_stashed) from [<8054d6f8>] (open_namespace+0x44/0xbc fs/nsfs.c:102) r10:84183000 r9:00000003 r8:843f3300 r7:841b2c80 r6:84183000 r5:00000000 r4:82625878 [<8054d6b4>] (open_namespace) from [<8055271c>] (pidfd_ioctl+0x184/0x4c4 fs/pidfs.c:196) r6:00000008 r5:841b2400 r4:82625878 [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (do_vfs_ioctl fs/ioctl.c:861 [inline]) [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (__do_sys_ioctl fs/ioctl.c:905 [inline]) [<80552598>] (pidfd_ioctl) from [<8051a7f0>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893) r7:00000000 r6:843f3300 r5:00000000 r4:0000ff07 [<8051a6bc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdf959fa8 to 0xdf959ff0) 9fa0: 00000000 00000000 00000003 0000ff07 00000000 00000000 9fc0: 00000000 00000000 0008e058 00000036 7ee54e0c 00000000 00000001 00000000 9fe0: 7ee54c70 7ee54c60 0001064c 0002e7a0 r10:00000036 r9:84183000 r8:8020029c r7:00000036 r6:0008e058 r5:00000000 r4:00000000 Code: e24dd01c e1a07001 e5911004 ee1dcf70 (e5905000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e24dd01c sub sp, sp, #28 4: e1a07001 mov r7, r1 8: e5911004 ldr r1, [r1, #4] c: ee1dcf70 mrc 15, 0, ip, cr13, cr0, {3} * 10: e5905000 ldr r5, [r0] <-- trapping instruction