Extracting prog: 1m49.294091096s
Minimizing prog: 22m42.69203294s
Simplifying prog options: 0s
Extracting C: 1m6.878567996s
Simplifying C: 14m15.521740703s


extracting reproducer from 31 programs
testing a last program of every proc
single: executing 6 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-ioctl$TCFLSH-ioctl$TIOCSETD-bpf$BPF_BTF_LOAD-openat$ptmx-ioctl$TIOCSETD-ioctl$TCSETS-syz_mount_image$ext4
detailed listing:
executing program 0:
sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x1)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5412, &(0x7f0000000140)=0xffffffc0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0}, 0x28)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0), 0x60081, 0x0)
ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x15)
ioctl$TCSETS(r3, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x3, 0x3ffffd, 0x14, "3eccd8000000000000000010000000040100"})
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800700, &(0x7f0000000080)={[{@data_journal}, {@acl}, {@grpid}, {@grpid}]}, 0x1, 0x46f, &(0x7f0000000bc0)="$eJzs281rHOUfAPDvTF7a/vqS/Gp9aa0aLUJQTJq0ag9eFAWRioIe6jEm2xK6baSJYmuxqYgnQQp6Fo+if4E3EUQ9CV49eZJC0V7aeorM7Ey62WYTazaZ2P18YLPPM/PszvebeXv2eXYD6FpD2Z8kYkdE/BoRA43q0gZDjafrV89P3rh6fjKJhYXX/kjydteunp8sm5av215UhtOI9MOk2MhSs2fPnZyo12tnivro3Km3RmfPnnvinVMTJ2onaqfHjxw5fGjs6afGn+xInllM1/a9P7N/74tvXHp58tilN3/8Oot3R7G+OY9OGcoS/3Mh17ru0U5vrGI7m8pJb4WBcFt6IiLbXX35+T8QPXFz5w3ECx9UGhywrrJ705b2q+cXgDtYElVHAFSjvNFnn3/LxwZ1PTaFK882PgBleV8vHo01vZEWbfpaPt920lBEHJv/6/PsEes0DgEA0Ozjyc+O9kfEeze+einrewwsrknjnvz5t/zvrmJuaDAi/h8RuyPirojYExF3R+Rt742I+9YYz639n/TyGt9yRVn/75libmtp/6/s/cVgT1HbmefflxyfrtcOFv+T4ejbktXHVtjGt8//8km7dc39v+yRbb/sCxZxXO5tGaCbmpibyDulHXDlYsS+3uXyTxZnApKI2BsR+27vrXeVhenHvtzfrtHq+a+gA/NMC19k6c1n+c9HS/6lpHl+cvqW+cnRrVGvHRwtj4pb/fTzR6+22/6a8u+AK7XGc9P+b20ymDTP1852dvv/8vhP+5PX8znd/mLZuxNzc2fGIvqTo3l9yfLxm68t62X77PgfPrD8+b+7eE2W//0RkR3ED0TEgxHxUBH7wxHxSEQcWCHHH55bPf9IK9r/FyOmlr3+LR7/Lfv/9gs9J7//pt32/9n+P5yXhosl+fVvFcuFk10uWgNcy/8OAAAA/ivS/DvwSTqyWE7TkZHG9+X3xP/S+szs3OPHZ94+PdX4rvxg9KXlSNdAMR5an67XxpL54h0b46PjxVhxOV56qBg3/rRnW14fmZypT1WcO3S77W3O/8zvPVVHB6yzbcsuHe/f8ECACrTOo6dLqxdeCRcDuFP5vTZ0r1XO/3Sj4gA2nvs/dK/lzv8LLXVzAXBncv+H7uX8hy6Vfld1BECF3P+hK63ld/3rWNi6OcKoprBZd0peiCgL6aaIR2GdClVfmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADrj7wAAAP//OwzmfQ==")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-openat-write-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-mount_setattr-bpf$MAP_LOOKUP_BATCH
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000070000008100000009"], 0x50) (rerun: 32)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380), &(0x7f0000000380), 0x2, r1}, 0x38) (async)
mount_setattr(0xffffffffffffffff, 0x0, 0x1900, &(0x7f0000000000)={0x100020, 0x1000f4, 0x20000}, 0x20)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300), 0xffffffffffffffff, 0xc6b5, r1}, 0x38)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
single: successfully extracted reproducer
found reproducer with 11 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-openat-write-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-mount_setattr
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000070000008100000009"], 0x50) (rerun: 32)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380), &(0x7f0000000380), 0x2, r1}, 0x38) (async)
mount_setattr(0xffffffffffffffff, 0x0, 0x1900, &(0x7f0000000000)={0x100020, 0x1000f4, 0x20000}, 0x20)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-openat-write-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000070000008100000009"], 0x50) (rerun: 32)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380), &(0x7f0000000380), 0x2, r1}, 0x38) (async)

program crashed: BUG: unable to handle kernel NULL pointer dereference in pskb_expand_head
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-openat-write-bpf$MAP_CREATE
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000070000008100000009"], 0x50) (rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-mprotect-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
write(0xffffffffffffffff, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$procfs-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x20002, 0x0) (async, rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0) (rerun: 32)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in pskb_expand_head
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, 0x0, 0x0) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0), 0x0) (async, rerun: 32)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in rtnl_newlink
a never seen crash title: BUG: unable to handle kernel NULL pointer dereference in rtnl_newlink, ignore
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
a never seen crash title: BUG: unable to handle kernel NULL pointer dereference in corrupted, ignore
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in pskb_expand_head
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-mprotect-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/resource0\x00', 0x20002, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dbg/netdevsim/netdevsim1/hwstats/l3/enable_ifindex\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='2', 0x1) (rerun: 32)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __alloc_skb
validation run: crashed=true
reproducing took 42m28.512363977s
repro crashed as (corrupted=false):
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010e590000
[0000000000000018] pgd=080000011cb74403, p4d=080000011cb74403, pud=080000010db0d403, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4789 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: mld mld_ifc_work
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : alloc_from_pcs mm/slub.c:4849 [inline]
pc : slab_alloc_node mm/slub.c:4984 [inline]
pc : __do_kmalloc_node mm/slub.c:5413 [inline]
pc : __kmalloc_node_track_caller_noprof+0x2ec/0x6e0 mm/slub.c:5545
lr : alloc_from_pcs mm/slub.c:4847 [inline]
lr : slab_alloc_node mm/slub.c:4984 [inline]
lr : __do_kmalloc_node mm/slub.c:5413 [inline]
lr : __kmalloc_node_track_caller_noprof+0x2d4/0x6e0 mm/slub.c:5545
sp : ffff800098b57750
x29: ffff800098b57790 x28: ffff0000da383b00 x27: ffff800088bf8000
x26: 0000000000000001 x25: 0000000000000000 x24: 00000000ffffffff
x23: ffff0000c0002000 x22: ffff800088bfa960 x21: 0000000000000800
x20: 0000000000082cc0 x19: ffff800088bb0001 x18: 0000000000000000
x17: ffff800125154000 x16: ffff80008ec30000 x15: 00000000200001c0
x14: 0000000080382b88 x13: 0000000000000000 x12: ffff800080136530
x11: 00000000ef80e65c x10: 0000000000000003 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000030 x4 : 0000000000000008 x3 : ffff80008015201c
x2 : 0000000000000000 x1 : ffff0001add04001 x0 : 0000000000000000
Call trace:
 alloc_from_pcs mm/slub.c:4849 [inline] (P)
 slab_alloc_node mm/slub.c:4984 [inline] (P)
 __do_kmalloc_node mm/slub.c:5413 [inline] (P)
 __kmalloc_node_track_caller_noprof+0x2ec/0x6e0 mm/slub.c:5545 (P)
 kmalloc_reserve+0x118/0x214 net/core/skbuff.c:637
 __alloc_skb+0x230/0x610 net/core/skbuff.c:715
 alloc_skb include/linux/skbuff.h:1384 [inline]
 mld_newpack+0x13c/0x7b4 net/ipv6/mcast.c:1790
 add_grhead+0x6c/0x260 net/ipv6/mcast.c:1901
 add_grec+0xf9c/0x1214 net/ipv6/mcast.c:2040
 mld_send_cr net/ipv6/mcast.c:2165 [inline]
 mld_ifc_work+0x620/0x9e4 net/ipv6/mcast.c:2711
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 54001a22 f8797ac8 8b130101 f9401c28 (b9401909) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	54001a22 	b.cs	0x344  // b.hs, b.nlast
   4:	f8797ac8 	ldr	x8, [x22, x25, lsl #3]
   8:	8b130101 	add	x1, x8, x19
   c:	f9401c28 	ldr	x8, [x1, #56]
* 10:	b9401909 	ldr	w9, [x8, #24] <-- trapping instruction

final repro crashed as (corrupted=false):
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010e590000
[0000000000000018] pgd=080000011cb74403, p4d=080000011cb74403, pud=080000010db0d403, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4789 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: mld mld_ifc_work
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : alloc_from_pcs mm/slub.c:4849 [inline]
pc : slab_alloc_node mm/slub.c:4984 [inline]
pc : __do_kmalloc_node mm/slub.c:5413 [inline]
pc : __kmalloc_node_track_caller_noprof+0x2ec/0x6e0 mm/slub.c:5545
lr : alloc_from_pcs mm/slub.c:4847 [inline]
lr : slab_alloc_node mm/slub.c:4984 [inline]
lr : __do_kmalloc_node mm/slub.c:5413 [inline]
lr : __kmalloc_node_track_caller_noprof+0x2d4/0x6e0 mm/slub.c:5545
sp : ffff800098b57750
x29: ffff800098b57790 x28: ffff0000da383b00 x27: ffff800088bf8000
x26: 0000000000000001 x25: 0000000000000000 x24: 00000000ffffffff
x23: ffff0000c0002000 x22: ffff800088bfa960 x21: 0000000000000800
x20: 0000000000082cc0 x19: ffff800088bb0001 x18: 0000000000000000
x17: ffff800125154000 x16: ffff80008ec30000 x15: 00000000200001c0
x14: 0000000080382b88 x13: 0000000000000000 x12: ffff800080136530
x11: 00000000ef80e65c x10: 0000000000000003 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000030 x4 : 0000000000000008 x3 : ffff80008015201c
x2 : 0000000000000000 x1 : ffff0001add04001 x0 : 0000000000000000
Call trace:
 alloc_from_pcs mm/slub.c:4849 [inline] (P)
 slab_alloc_node mm/slub.c:4984 [inline] (P)
 __do_kmalloc_node mm/slub.c:5413 [inline] (P)
 __kmalloc_node_track_caller_noprof+0x2ec/0x6e0 mm/slub.c:5545 (P)
 kmalloc_reserve+0x118/0x214 net/core/skbuff.c:637
 __alloc_skb+0x230/0x610 net/core/skbuff.c:715
 alloc_skb include/linux/skbuff.h:1384 [inline]
 mld_newpack+0x13c/0x7b4 net/ipv6/mcast.c:1790
 add_grhead+0x6c/0x260 net/ipv6/mcast.c:1901
 add_grec+0xf9c/0x1214 net/ipv6/mcast.c:2040
 mld_send_cr net/ipv6/mcast.c:2165 [inline]
 mld_ifc_work+0x620/0x9e4 net/ipv6/mcast.c:2711
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 54001a22 f8797ac8 8b130101 f9401c28 (b9401909) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	54001a22 	b.cs	0x344  // b.hs, b.nlast
   4:	f8797ac8 	ldr	x8, [x22, x25, lsl #3]
   8:	8b130101 	add	x1, x8, x19
   c:	f9401c28 	ldr	x8, [x1, #56]
* 10:	b9401909 	ldr	w9, [x8, #24] <-- trapping instruction