Extracting prog: 3m0.497263657s
Minimizing prog: 38m53.572328275s
Simplifying prog options: 0s
Extracting C: 1m43.995011882s
Simplifying C: 10m11.559969425s


extracting reproducer from 30 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-openat-write
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x10, 0x110, 0x1}, {0x10, 0x110, 0xe}], 0x20}, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-openat-write-openat-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
single: successfully extracted reproducer
found reproducer with 15 syscalls
minimizing guilty program
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-openat-write-openat-mkdirat
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-openat-write-openat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-openat-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-mount-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mkdirat-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r2=>0x0, &(0x7f0000001108)=<r3=>0x0, &(0x7f0000001110)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-syz_io_uring_submit-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r1=>0x0, &(0x7f0000001108)=<r2=>0x0, &(0x7f0000001110)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r1, r2, r3, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r0, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r4, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-syz_io_uring_submit-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r1=>0x0, &(0x7f0000001108)=<r2=>0x0, &(0x7f0000001110)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r4, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in corrupted
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-syz_io_uring_setup-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100), &(0x7f0000001108), &(0x7f0000001110))
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-sendmsg-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
sendmsg(r0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r0, 0xa)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
socket$rxrpc(0x21, 0x2, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in corrupted
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040), 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, 0x0, &(0x7f0000000c00), 0x0, 0x0)

program did not crash
testing program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45.199218282s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
simplifying C reproducer
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program did not crash
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program did not crash
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing compiled C program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
testing program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
validation run: crashed=true
testing program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
validation run: crashed=true
testing program (duration=45.199218282s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-mkdirat-mount$afs
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 ::1\n', 0xd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in rxrpc_kernel_abort_call
validation run: crashed=true
reproducing took 58m34.216570258s
repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address dfff800000000013
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000013] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4430 Comm: kworker/0:12 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: kafsd afs_process_async_call
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __mutex_lock_common+0xfc/0x1f3c kernel/locking/mutex.c:582
lr : __mutex_lock_common+0xd0/0x1f3c kernel/locking/mutex.c:580
sp : ffff800020f878a0
x29: ffff800020f879e0 x28: ffff7000041f0f28 x27: 0000000000000000
x26: 0000000000000000 x25: 1fffe0001e7df800 x24: 0000000000000000
x23: dfff800000000000 x22: ffff800010fd8f18 x21: ffff800020f87960
x20: 0000000000000000 x19: 0000000000000038 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082dbd3c x15: 0000000000000000
x14: 0000000000000005 x13: 1ffff000041f0f2c x12: 0000000000000000
x11: ff0080000a975dac x10: 0000000000000000 x9 : 0000000000000003
x8 : 0000000000000013 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000000 x1 : ffff800011ceedc0 x0 : 0000000000000000
Call trace:
 __mutex_lock_common+0xfc/0x1f3c kernel/locking/mutex.c:582
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 rxrpc_kernel_abort_call+0x34/0x88 net/rxrpc/sendmsg.c:853
 afs_deliver_to_call+0x4d0/0xec0 fs/afs/rxrpc.c:-1
 afs_process_async_call+0x90/0xf8 fs/afs/rxrpc.c:703
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: b9486108 35000148 91018268 d343fd08 (38776908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	b9486108 	ldr	w8, [x8, #2144]
   4:	35000148 	cbnz	w8, 0x2c
   8:	91018268 	add	x8, x19, #0x60
   c:	d343fd08 	lsr	x8, x8, #3
* 10:	38776908 	ldrb	w8, [x8, x23] <-- trapping instruction

final repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address dfff800000000013
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000013] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4430 Comm: kworker/0:12 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: kafsd afs_process_async_call
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __mutex_lock_common+0xfc/0x1f3c kernel/locking/mutex.c:582
lr : __mutex_lock_common+0xd0/0x1f3c kernel/locking/mutex.c:580
sp : ffff800020f878a0
x29: ffff800020f879e0 x28: ffff7000041f0f28 x27: 0000000000000000
x26: 0000000000000000 x25: 1fffe0001e7df800 x24: 0000000000000000
x23: dfff800000000000 x22: ffff800010fd8f18 x21: ffff800020f87960
x20: 0000000000000000 x19: 0000000000000038 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082dbd3c x15: 0000000000000000
x14: 0000000000000005 x13: 1ffff000041f0f2c x12: 0000000000000000
x11: ff0080000a975dac x10: 0000000000000000 x9 : 0000000000000003
x8 : 0000000000000013 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000000 x1 : ffff800011ceedc0 x0 : 0000000000000000
Call trace:
 __mutex_lock_common+0xfc/0x1f3c kernel/locking/mutex.c:582
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 rxrpc_kernel_abort_call+0x34/0x88 net/rxrpc/sendmsg.c:853
 afs_deliver_to_call+0x4d0/0xec0 fs/afs/rxrpc.c:-1
 afs_process_async_call+0x90/0xf8 fs/afs/rxrpc.c:703
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: b9486108 35000148 91018268 d343fd08 (38776908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	b9486108 	ldr	w8, [x8, #2144]
   4:	35000148 	cbnz	w8, 0x2c
   8:	91018268 	add	x8, x19, #0x60
   c:	d343fd08 	lsr	x8, x8, #3
* 10:	38776908 	ldrb	w8, [x8, x23] <-- trapping instruction