Extracting prog: 6m0.567405124s
Minimizing prog: 24m34.429577944s
Simplifying prog options: 9m58.013699163s
Extracting C: 3m12.375597085s
Simplifying C: 0s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
r1 = dup(r0)
fallocate(r1, 0x10, 0x0, 0x2000000400)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
r1 = dup(r0)
fallocate(r1, 0x10, 0x0, 0x2000000400)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
r1 = dup(r0)
fallocate(r1, 0x10, 0x0, 0x2000000400)
program crashed: general protection fault in swap_reclaim_full_clusters
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
dup(r0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-fallocate
detailed listing:
executing program 0:
openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
fallocate(0xffffffffffffffff, 0x10, 0x0, 0x2000000400)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): dup-fallocate
detailed listing:
executing program 0:
r0 = dup(0xffffffffffffffff)
fallocate(r0, 0x10, 0x0, 0x2000000400)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x162e02, 0x0)
r1 = dup(r0)
fallocate(r1, 0x10, 0x0, 0x2000000400)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
program crashed: INFO: task hung in blkdev_fallocate
a never seen crash title: INFO: task hung in blkdev_fallocate, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
r1 = dup(r0)
fallocate(r1, 0x10, 0x0, 0x2000000400)
program crashed: general protection fault in swap_reclaim_full_clusters
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
program crashed: INFO: task hung in blkdev_fallocate
a never seen crash title: INFO: task hung in blkdev_fallocate, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162e02, 0x0)
r1 = dup(r0)
fallocate(r1, 0x10, 0x0, 0x2000000400)
program crashed: INFO: task hung in blkdev_fallocate
a never seen crash title: INFO: task hung in blkdev_fallocate, ignore
reproducing took 43m45.404534429s
repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 1342 Comm: kworker/0:3 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events swap_reclaim_work
RIP: 0010:__list_del_entry_valid_or_report+0x23/0x140 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 49 89 ff 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 91 f7 3a fd 49 8b 5f 08 4c 89 f8 48 c1 e8
RSP: 0000:ffffc900028afb00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8880413cd080 RCX: ffff88801ee74880
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffff8880413cd078 R08: 0000000000000003 R09: fffff52000515f64
R10: dffffc0000000000 R11: fffff52000515f64 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90000e3f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c000076f98 CR3: 00000000518c8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry_valid include/linux/list.h:124 [inline]
__list_del_entry include/linux/list.h:215 [inline]
list_move_tail include/linux/list.h:310 [inline]
swap_reclaim_full_clusters+0xf3/0x3c0 mm/swapfile.c:748
swap_reclaim_work+0x32/0x40 mm/swapfile.c:779
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x23/0x140 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 49 89 ff 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 91 f7 3a fd 49 8b 5f 08 4c 89 f8 48 c1 e8
RSP: 0000:ffffc900028afb00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8880413cd080 RCX: ffff88801ee74880
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffff8880413cd078 R08: 0000000000000003 R09: fffff52000515f64
R10: dffffc0000000000 R11: fffff52000515f64 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90000e3f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c000076f98 CR3: 00000000518c8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: f3 0f 1e fa endbr64
b: 41 57 push %r15
d: 41 56 push %r14
f: 41 54 push %r12
11: 53 push %rbx
12: 49 89 ff mov %rdi,%r15
15: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
1c: fc ff df
1f: 48 83 c7 08 add $0x8,%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 05 je 0x36
31: e8 91 f7 3a fd call 0xfd3af7c7
36: 49 8b 5f 08 mov 0x8(%r15),%rbx
3a: 4c 89 f8 mov %r15,%rax
3d: 48 rex.W
3e: c1 .byte 0xc1
3f: e8 .byte 0xe8
final repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 1342 Comm: kworker/0:3 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events swap_reclaim_work
RIP: 0010:__list_del_entry_valid_or_report+0x23/0x140 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 49 89 ff 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 91 f7 3a fd 49 8b 5f 08 4c 89 f8 48 c1 e8
RSP: 0000:ffffc900028afb00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8880413cd080 RCX: ffff88801ee74880
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffff8880413cd078 R08: 0000000000000003 R09: fffff52000515f64
R10: dffffc0000000000 R11: fffff52000515f64 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90000e3f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c000076f98 CR3: 00000000518c8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry_valid include/linux/list.h:124 [inline]
__list_del_entry include/linux/list.h:215 [inline]
list_move_tail include/linux/list.h:310 [inline]
swap_reclaim_full_clusters+0xf3/0x3c0 mm/swapfile.c:748
swap_reclaim_work+0x32/0x40 mm/swapfile.c:779
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x23/0x140 lib/list_debug.c:49
Code: 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 49 89 ff 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 91 f7 3a fd 49 8b 5f 08 4c 89 f8 48 c1 e8
RSP: 0000:ffffc900028afb00 EFLAGS: 00010202
RAX: 0000000000000001 RBX: ffff8880413cd080 RCX: ffff88801ee74880
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffff8880413cd078 R08: 0000000000000003 R09: fffff52000515f64
R10: dffffc0000000000 R11: fffff52000515f64 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffc90000e3f000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c000076f98 CR3: 00000000518c8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: f3 0f 1e fa endbr64
b: 41 57 push %r15
d: 41 56 push %r14
f: 41 54 push %r12
11: 53 push %rbx
12: 49 89 ff mov %rdi,%r15
15: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
1c: fc ff df
1f: 48 83 c7 08 add $0x8,%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 05 je 0x36
31: e8 91 f7 3a fd call 0xfd3af7c7
36: 49 8b 5f 08 mov 0x8(%r15),%rbx
3a: 4c 89 f8 mov %r15,%rax
3d: 48 rex.W
3e: c1 .byte 0xc1
3f: e8 .byte 0xe8