Extracting prog: 29.890673522s
Minimizing prog: 8m43.79163899s
Simplifying prog options: 2m19.703665164s
Extracting C: 26.191438292s
Simplifying C: 0s


extracting reproducer from 52 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program crashed: WARNING in aa_policy_destroy
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, 0x0, 0x0) (fail_nth: 5)

program did not crash
testing program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300), 0x0) (fail_nth: 5)

program did not crash
extracting C reproducer
testing compiled C program (duration=36.725912116s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
simplifying guilty program options
testing program (duration=36.725912116s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program crashed: WARNING in aa_policy_destroy
extracting C reproducer
testing compiled C program (duration=36.725912116s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program crashed: WARNING in aa_policy_destroy
extracting C reproducer
testing compiled C program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program crashed: WARNING in aa_policy_destroy
validation run: crashed=true
testing program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program crashed: WARNING in aa_policy_destroy
validation run: crashed=true
testing program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
validation run: crashed=false
testing program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program did not crash
validation run: crashed=false
testing program (duration=36.725912116s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./security/apparmor/.replace\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) (fail_nth: 5)

program crashed: WARNING in aa_policy_destroy
validation run: crashed=true
reproducing took 15m18.918963855s
repro crashed as (corrupted=false):
 </TASK>
------------[ cut here ]------------
AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): 
WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x78/0x1f0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5922
Modules linked in:
CPU: 0 UID: 0 PID: 5922 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:aa_policy_destroy+0x7f/0x1f0 security/apparmor/lib.c:509
Code: 00 0f 85 88 01 00 00 48 b8 22 01 00 00 00 00 ad de 48 39 43 28 74 18 e8 df 15 2f fd 48 8d 3d f8 5f 73 0c 48 c7 c6 40 2d 57 8c <67> 48 0f b9 3a e8 c7 15 2f fd 48 8d 6b 10 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc9000411f678 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88804b8f0000 RCX: 0000000000000000
RDX: ffff88802775cb00 RSI: ffffffff8c572d40 RDI: ffffffff914eb990
RBP: ffff88804b8f0020 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000dc0
FS:  0000000000000000(0000) GS:ffff88809698f000(0063) knlGS:000000005847f480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000033924008 CR3: 000000004cd4e000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 aa_free_profile security/apparmor/policy.c:334 [inline]
 aa_free_profile+0x82/0xca0 security/apparmor/policy.c:324
 aa_alloc_profile+0x3ae/0x520 security/apparmor/policy.c:416
 unpack_profile+0x3ed/0x4510 security/apparmor/policy_unpack.c:1153
 aa_unpack+0x39e/0x1240 security/apparmor/policy_unpack.c:1748
 aa_replace_profiles+0x176/0x31c0 security/apparmor/policy.c:1183
 policy_update+0x20b/0x340 security/apparmor/apparmorfs.c:505
 profile_replace+0xaa/0x1a0 security/apparmor/apparmorfs.c:540
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf705efec
Code: Unable to access opcode bytes at 0xf705efc2.
RSP: 002b:00000000ffda99dc EFLAGS: 00000292 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300
RDX: 0000000000000052 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 88 01 00 00 48    	test   %ecx,0x48000001(%rax)
   8:	b8 22 01 00 00       	mov    $0x122,%eax
   d:	00 00                	add    %al,(%rax)
   f:	ad                   	lods   %ds:(%rsi),%eax
  10:	de 48 39             	fimuls 0x39(%rax)
  13:	43 28 74 18 e8       	sub    %sil,-0x18(%r8,%r11,1)
  18:	df 15 2f fd 48 8d    	fists  -0x72b702d1(%rip)        # 0x8d48fd4d
  1e:	3d f8 5f 73 0c       	cmp    $0xc735ff8,%eax
  23:	48 c7 c6 40 2d 57 8c 	mov    $0xffffffff8c572d40,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e8 c7 15 2f fd       	call   0xfd2f15fb
  34:	48 8d 6b 10          	lea    0x10(%rbx),%rbp
  38:	48                   	rex.W
  39:	b8 00 00 00 00       	mov    $0x0,%eax
  3e:	00 fc                	add    %bh,%ah

final repro crashed as (corrupted=false):
 </TASK>
------------[ cut here ]------------
AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): 
WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x78/0x1f0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5922
Modules linked in:
CPU: 0 UID: 0 PID: 5922 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:aa_policy_destroy+0x7f/0x1f0 security/apparmor/lib.c:509
Code: 00 0f 85 88 01 00 00 48 b8 22 01 00 00 00 00 ad de 48 39 43 28 74 18 e8 df 15 2f fd 48 8d 3d f8 5f 73 0c 48 c7 c6 40 2d 57 8c <67> 48 0f b9 3a e8 c7 15 2f fd 48 8d 6b 10 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc9000411f678 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88804b8f0000 RCX: 0000000000000000
RDX: ffff88802775cb00 RSI: ffffffff8c572d40 RDI: ffffffff914eb990
RBP: ffff88804b8f0020 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000dc0
FS:  0000000000000000(0000) GS:ffff88809698f000(0063) knlGS:000000005847f480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000033924008 CR3: 000000004cd4e000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 aa_free_profile security/apparmor/policy.c:334 [inline]
 aa_free_profile+0x82/0xca0 security/apparmor/policy.c:324
 aa_alloc_profile+0x3ae/0x520 security/apparmor/policy.c:416
 unpack_profile+0x3ed/0x4510 security/apparmor/policy_unpack.c:1153
 aa_unpack+0x39e/0x1240 security/apparmor/policy_unpack.c:1748
 aa_replace_profiles+0x176/0x31c0 security/apparmor/policy.c:1183
 policy_update+0x20b/0x340 security/apparmor/apparmorfs.c:505
 profile_replace+0xaa/0x1a0 security/apparmor/apparmorfs.c:540
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf705efec
Code: Unable to access opcode bytes at 0xf705efc2.
RSP: 002b:00000000ffda99dc EFLAGS: 00000292 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300
RDX: 0000000000000052 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 88 01 00 00 48    	test   %ecx,0x48000001(%rax)
   8:	b8 22 01 00 00       	mov    $0x122,%eax
   d:	00 00                	add    %al,(%rax)
   f:	ad                   	lods   %ds:(%rsi),%eax
  10:	de 48 39             	fimuls 0x39(%rax)
  13:	43 28 74 18 e8       	sub    %sil,-0x18(%r8,%r11,1)
  18:	df 15 2f fd 48 8d    	fists  -0x72b702d1(%rip)        # 0x8d48fd4d
  1e:	3d f8 5f 73 0c       	cmp    $0xc735ff8,%eax
  23:	48 c7 c6 40 2d 57 8c 	mov    $0xffffffff8c572d40,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e8 c7 15 2f fd       	call   0xfd2f15fb
  34:	48 8d 6b 10          	lea    0x10(%rbx),%rbp
  38:	48                   	rex.W
  39:	b8 00 00 00 00       	mov    $0x0,%eax
  3e:	00 fc                	add    %bh,%ah