Extracting prog: 4m40.847466743s Minimizing prog: 21m14.395994978s Simplifying prog options: 5m52.028887009s Extracting C: 1m0.611247469s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program crashed: WARNING in __cancel_work single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket(0x14, 0x2, 0x4) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX program crashed: WARNING: ODEBUG bug in corrupted a never seen crash title: WARNING: ODEBUG bug in corrupted, ignore simplifying guilty program options testing program (duration=2m32.622157062s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program crashed: WARNING: ODEBUG bug in lane_ioctl validation run: crashed=true testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program did not crash validation run: crashed=false testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program crashed: WARNING: ODEBUG bug in corrupted validation run: crashed=true testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program crashed: WARNING: ODEBUG bug in corrupted validation run: crashed=true reproducing took 39m53.88397694s repro crashed as (corrupted=true): ------------[ cut here ]------------ ODEBUG: init active (active state 0) object: ffff88807d9b0f38 object type: timer_list hint: lec_arp_check_expire+0x0/0xc90 net/atm/lec.c:-1 WARNING: lib/debugobjects.c:643 at debug_print_object lib/debugobjects.c:640 [inline], CPU#1: syz.2.39/6205 WARNING: lib/debugobjects.c:643 at __debug_object_init+0x2b1/0x4e0 lib/debugobjects.c:791, CPU#1: syz.2.39/6205 Modules linked in: CPU: 1 UID: 0 PID: 6205 Comm: syz.2.39 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:debug_print_object lib/debugobjects.c:640 [inline] RIP: 0010:__debug_object_init+0x30f/0x4e0 lib/debugobjects.c:791 Code: 3c 38 00 74 08 4c 89 ef e8 0e e2 6b fd 4d 8b 4d 00 4c 89 f7 48 c7 c6 c0 96 4a 8c 4c 89 e2 8b 4c 24 08 4c 8b 04 24 ff 74 24 10 <67> 48 0f b9 3a 48 83 c4 08 ff 05 ce 66 90 0b 83 fd 03 75 3f 4c 8b ---------------- Code disassembly (best guess): 0: 3c 38 cmp $0x38,%al 2: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1) 6: 89 ef mov %ebp,%edi 8: e8 0e e2 6b fd call 0xfd6be21b d: 4d 8b 4d 00 mov 0x0(%r13),%r9 11: 4c 89 f7 mov %r14,%rdi 14: 48 c7 c6 c0 96 4a 8c mov $0xffffffff8c4a96c0,%rsi 1b: 4c 89 e2 mov %r12,%rdx 1e: 8b 4c 24 08 mov 0x8(%rsp),%ecx 22: 4c 8b 04 24 mov (%rsp),%r8 26: ff 74 24 10 push 0x10(%rsp) * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 48 83 c4 08 add $0x8,%rsp 33: ff 05 ce 66 90 0b incl 0xb9066ce(%rip) # 0xb906707 39: 83 fd 03 cmp $0x3,%ebp 3c: 75 3f jne 0x7d 3e: 4c rex.WR 3f: 8b .byte 0x8b report is corrupted, running repro again testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program crashed: WARNING: ODEBUG bug in corrupted report is corrupted, running repro again testing program (duration=2m32.622157062s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) program crashed: WARNING: ODEBUG bug in lane_ioctl final repro crashed as (corrupted=false): ------------[ cut here ]------------ ODEBUG: init active (active state 0) object: ffff888033718f38 object type: timer_list hint: lec_arp_check_expire+0x0/0xc90 net/atm/lec.c:-1 WARNING: lib/debugobjects.c:643 at debug_print_object lib/debugobjects.c:640 [inline], CPU#1: syz.0.256/7326 WARNING: lib/debugobjects.c:643 at __debug_object_init+0x2b1/0x4e0 lib/debugobjects.c:791, CPU#1: syz.0.256/7326 Modules linked in: CPU: 1 UID: 0 PID: 7326 Comm: syz.0.256 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:debug_print_object lib/debugobjects.c:640 [inline] RIP: 0010:__debug_object_init+0x30f/0x4e0 lib/debugobjects.c:791 Code: 3c 38 00 74 08 4c 89 ef e8 0e e2 6b fd 4d 8b 4d 00 4c 89 f7 48 c7 c6 c0 96 4a 8c 4c 89 e2 8b 4c 24 08 4c 8b 04 24 ff 74 24 10 <67> 48 0f b9 3a 48 83 c4 08 ff 05 ce 66 90 0b 83 fd 03 75 3f 4c 8b RSP: 0018:ffffc900066978f8 EFLAGS: 00010246 RAX: 1ffffffff17de8a4 RBX: ffff888033718f38 RCX: 0000000000000000 RDX: ffffffff8c4a9ac0 RSI: ffffffff8c4a96c0 RDI: ffffffff905f2a70 RBP: 0000000000000003 R08: ffff888033718f38 R09: ffffffff8bef5880 R10: dffffc0000000000 R11: ffffffff81b30200 R12: ffffffff8c4a9ac0 R13: ffffffff8bef4520 R14: ffffffff905f2a70 R15: dffffc0000000000 FS: 00007f15f72136c0(0000) GS:ffff8881250f2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1d64bad400 CR3: 000000003642e000 CR4: 00000000003526f0 Call Trace: debug_timer_init kernel/time/timer.c:788 [inline] debug_init kernel/time/timer.c:836 [inline] timer_init_key+0x41/0x2c0 kernel/time/timer.c:880 lec_arp_init net/atm/lec.c:1274 [inline] lecd_attach net/atm/lec.c:781 [inline] lane_ioctl+0x1579/0x2220 net/atm/lec.c:1037 do_vcc_ioctl+0x36d/0x9d0 net/atm/ioctl.c:159 svc_ioctl+0x1f6/0x7d0 net/atm/svc.c:611 sock_do_ioctl+0x101/0x320 net/socket.c:1312 sock_ioctl+0x5c6/0x7f0 net/socket.c:1433 ---------------- Code disassembly (best guess): 0: 3c 38 cmp $0x38,%al 2: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1) 6: 89 ef mov %ebp,%edi 8: e8 0e e2 6b fd call 0xfd6be21b d: 4d 8b 4d 00 mov 0x0(%r13),%r9 11: 4c 89 f7 mov %r14,%rdi 14: 48 c7 c6 c0 96 4a 8c mov $0xffffffff8c4a96c0,%rsi 1b: 4c 89 e2 mov %r12,%rdx 1e: 8b 4c 24 08 mov 0x8(%rsp),%ecx 22: 4c 8b 04 24 mov (%rsp),%r8 26: ff 74 24 10 push 0x10(%rsp) * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 48 83 c4 08 add $0x8,%rsp 33: ff 05 ce 66 90 0b incl 0xb9066ce(%rip) # 0xb906707 39: 83 fd 03 cmp $0x3,%ebp 3c: 75 3f jne 0x7d 3e: 4c rex.WR 3f: 8b .byte 0x8b