Extracting prog: 26m46.39265041s Minimizing prog: 1h7m55.613851221s Simplifying prog options: 0s Extracting C: 1m33.568652956s Simplifying C: 29m37.263152841s extracting reproducer from 76 programs testing a last program of every proc single: executing 26 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nl802154-getpid-add_key-keyctl$KEYCTL_RESTRICT_KEYRING-keyctl$get_persistent-sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nl802154-syz_init_net_socket$nl_generic-ioctl$sock_SIOCGIFINDEX_802154-sendmsg$NL802154_CMD_SET_SEC_PARAMS-socket$kcm-sendmsg$inet-sendmsg$NL802154_CMD_SET_CHANNEL-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r4 = getpid() r5 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, r5) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002abd7000fddbdf251400000008001c00", @ANYRES32=r4, @ANYBLOB="0800010002f3ffff10000100010000000800010002000000df030792e074545ca3f2c5b73086fd838a9d584aa93172d561bf10c3fe18117a135fc9c5c77a848840f8fa26d4f13b953d"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002aa47000fedbdf252ae7000008002a000600001314002b800500020002000000000000000100000008000300", @ANYRES32=r9], 0x38}, 0x1, 0x0, 0x0, 0x20008044}, 0x4800) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000180)="5c00000014006b0300000000006c1d0010047e0c8131a6080c000af32c6e020075f800250002000f00e5aa000017d34460bc24eab556a705251e6182949a36c2d13b48dfffa600000000ecb8f6ec63c9f4d4938037e786a6d1bdd700", 0x5c}, {&(0x7f00000004c0)="fc9a745e29f82a7ceacf8cc5051f695cbf9a9981dceaf8712bf3fe4dd7e281a37385497411468a8350fde570a560ccd7a42a632412627cc6b0d167df67d135eef221083ad8c7185350527ebd357191e17049c6ce93da8c73a091811d51346188f3cad7c448ab0e7361dcda3e68b649c48e1ceeaa7ecd4b4d354aa7a1cd0ccfe04569df93e40eda81c09a92d12830bf3a275501a03e390c8273a96678f6a24f0a082bfe014c32c93dbe83d14ffb3419a8726c2bcd27f7816be3ce4271146a", 0xbe}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$NL802154_CMD_SET_CHANNEL(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, r3, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_PAGE={0x5, 0x7, 0x14}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x15}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x44}, 0x1, 0x0, 0x0, 0x4810}, 0x20008080) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a40000000090a0104000015030000000000000004080003400000007408000540000000020900020073797a310000000008000a40fffffffc0800034000710010140000000c0a010100000000000000000a0000062c0000000e0a010000000a0000000900010073797a31000000000900020073797a3100000000140000001100010000000000000000000100000a"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CHECK_EXTENSION-socket$nl_route-sendmsg$nl_route_sched-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_GET_STATS_FD_cpu-preadv-openat$kvm-ioctl$KVM_CHECK_EXTENSION-socket$nl_route-sendmsg$nl_route_sched-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_GET_STATS_FD_cpu-preadv detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x189000, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xd4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0xb, 0x3, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xe1f5}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x81}}]}, {}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x68}}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x0, 0x1000, &(0x7f0000fe6000/0x1000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000003c0)=[@text16={0x10, &(0x7f0000000280)="da1a0f38f15c00ba2000ed642e0f01c5360f01df0fc701dfdfad000f00d0baf80c0f98dbe1efbafc0c66edd9ee0f01c3", 0x30}], 0x40, 0x14, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x20040, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = ioctl$KVM_GET_STATS_FD_cpu(r7, 0xaece) preadv(r8, &(0x7f0000002600)=[{&(0x7f00000003c0)=""/83, 0x53}], 0x1, 0x2, 0x3) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x189000, 0x0) (async) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xd4) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0xb, 0x3, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xe1f5}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x81}}]}, {}, {0xc, 0xa}, {0xc, 0x9, {0xf5}}}}]}]}, 0x68}}, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x0, 0x1000, &(0x7f0000fe6000/0x1000)=nil}) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000003c0)=[@text16={0x10, &(0x7f0000000280)="da1a0f38f15c00ba2000ed642e0f01c5360f01df0fc701dfdfad000f00d0baf80c0f98dbe1efbafc0c66edd9ee0f01c3", 0x30}], 0x40, 0x14, 0x0, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x20040, 0x0) (async) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) ioctl$KVM_GET_STATS_FD_cpu(r7, 0xaece) (async) preadv(r8, &(0x7f0000002600)=[{&(0x7f00000003c0)=""/83, 0x53}], 0x1, 0x2, 0x3) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fcntl$dupfd-sendmsg$nl_route-syz_clone-syz_open_dev$usbfs-ioctl$USBDEVFS_REAPURB-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_FILTER-ioctl$DVB_DEMUX_DMX_START detailed listing: executing program 0: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$nl_route(r0, 0x0, 0x20000005) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x40000f, 0x8041) ioctl$USBDEVFS_REAPURB(r1, 0x4008550c, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x4, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x54}}, 0x0) r3 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x4, 0x5c840) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"e512864f2c63b42b1e937260904ce544", "b80b00", "98fed86df169f801002f69ff0008e800"}, 0x3ff, 0x5}) ioctl$DVB_DEMUX_DMX_START(r3, 0x6f29) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL-ioctl$BTRFS_IOC_WAIT_SYNC-bpf$PROG_LOAD-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL-ioctl$BTRFS_IOC_WAIT_SYNC detailed listing: executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xab}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit={0x95, 0x0, 0x1008}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f00000000c0)={"2bc6b55718b0887b9c0a2eaf74e49069", 0x0, 0x0, {0x4, 0x4}, {0x0, 0x1}, 0xfffffffffffffff8, [0x3ff, 0x1, 0x3f, 0x8, 0x3, 0x8000000000000000, 0x6, 0x9, 0x2, 0x4, 0x8, 0x9617, 0x7f3, 0xa, 0x5, 0x27]}) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, &(0x7f00000001c0)=r1) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xab}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit={0x95, 0x0, 0x1008}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f00000000c0)={"2bc6b55718b0887b9c0a2eaf74e49069", 0x0, 0x0, {0x4, 0x4}, {0x0, 0x1}, 0xfffffffffffffff8, [0x3ff, 0x1, 0x3f, 0x8, 0x3, 0x8000000000000000, 0x6, 0x9, 0x2, 0x4, 0x8, 0x9617, 0x7f3, 0xa, 0x5, 0x27]}) (async) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, &(0x7f00000001c0)=r1) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid-bpf$MAP_CREATE_CONST_STR-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_CREATE-bpf$PROG_LOAD-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000240)='%+9llu \x00'}, 0x20) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x1c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="1800000000000000000000000900000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000008000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000c5000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x94, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_DATA={0x54, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0xd}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x4a14}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x4000840) (async) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0) program crashed: WARNING in print_bfs_bug single: successfully extracted reproducer found reproducer with 18 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid-bpf$MAP_CREATE_CONST_STR-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_CREATE-bpf$PROG_LOAD-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000240)='%+9llu \x00'}, 0x20) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x1c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="1800000000000000000000000900000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000008000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000c5000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x94, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_DATA={0x54, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0xd}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x4a14}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x4000840) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid-bpf$MAP_CREATE_CONST_STR-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_CREATE-bpf$PROG_LOAD detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r3, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000240)='%+9llu \x00'}, 0x20) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x1c, &(0x7f0000000cc0)=ANY=[@ANYBLOB="1800000000000000000000000900000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000008000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000c5000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid-bpf$MAP_CREATE_CONST_STR-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_CREATE detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r3}, &(0x7f00000001c0), &(0x7f0000000240)='%+9llu \x00'}, 0x20) (async) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid-bpf$MAP_CREATE_CONST_STR-bpf$MAP_UPDATE_CONST_STR detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r3}, &(0x7f00000001c0), &(0x7f0000000240)='%+9llu \x00'}, 0x20) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid-bpf$MAP_CREATE_CONST_STR detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter-setresgid detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) setresgid(0xffffffffffffffff, 0xee00, 0x0) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount-socket$nl_netfilter detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6-mount detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='xfs\x00', 0x10003, 0x0) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat-bind$inet6 detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r2 = fanotify_init(0xf00, 0x0) fanotify_mark(r2, 0x1, 0x1020, r1, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$inet6(r0, 0x0, 0x3b) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark-creat detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r1 = fanotify_init(0xf00, 0x0) fanotify_mark(r1, 0x1, 0x1020, r0, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init-fanotify_mark detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) r1 = fanotify_init(0xf00, 0x0) fanotify_mark(r1, 0x1, 0x1020, r0, 0x0) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat-fanotify_init detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) fanotify_init(0xf00, 0x0) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6-openat detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount-socket$igmp6 detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod-mount detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mknod detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$mtd-mount detailed listing: executing program 0: syz_open_dev$mtd(0x0, 0xa, 0x40) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) (async) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(0x0, 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, 0x0, &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: BUG: MAX_LOCKDEP_KEYS too low! a never seen crash title: BUG: MAX_LOCKDEP_KEYS too low!, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: BUG: MAX_LOCKDEP_KEYS too low! a never seen crash title: BUG: MAX_LOCKDEP_KEYS too low!, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: BUG: MAX_LOCKDEP_KEYS too low! a never seen crash title: BUG: MAX_LOCKDEP_KEYS too low!, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: BUG: MAX_LOCKDEP_KEYS too low! a never seen crash title: BUG: MAX_LOCKDEP_KEYS too low!, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: BUG: MAX_LOCKDEP_KEYS too low! a never seen crash title: BUG: MAX_LOCKDEP_KEYS too low!, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: BUG: MAX_LOCKDEP_KEYS too low! a never seen crash title: BUG: MAX_LOCKDEP_KEYS too low!, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount program crashed: WARNING in print_bfs_bug testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program crashed: BUG: MAX_LOCKDEP_KEYS too low! validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program crashed: BUG: MAX_LOCKDEP_KEYS too low! validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-mount detailed listing: executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x400, 0x10001) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='xfs\x00', 0x0, 0x0) program crashed: WARNING in print_bfs_bug validation run: crashed=true reproducing took 2h11m2.576016426s repro crashed as (corrupted=false): Increase LOCKDEP_CIRCULAR_QUEUE_BITS to avoid this warning: ------------[ cut here ]------------ lockdep bfs error:-1 WARNING: kernel/locking/lockdep.c:2059 at print_bfs_bug+0x24/0x40 kernel/locking/lockdep.c:2059, CPU#1: syz.3.2194/19121 Modules linked in: CPU: 1 UID: 0 PID: 19121 Comm: syz.3.2194 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:print_bfs_bug+0x26/0x40 kernel/locking/lockdep.c:2059 Code: 90 90 90 90 55 53 89 fb e8 37 08 35 03 89 c5 e8 20 ff ff ff 85 ed 74 17 83 fb ff 0f 84 d8 ef 3c ff 48 8d 3d 1c d6 40 0f 89 de <67> 48 0f b9 3a 5b 5d c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ffffc9000d73f378 EFLAGS: 00010086 RAX: 000000000000003b RBX: 00000000ffffffff RCX: 0000000000000000 RDX: 000000000000003b RSI: 00000000ffffffff RDI: ffffffff9125dc10 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 6573616572636e49 R12: ffffc9000d73f3f0 R13: ffff8880590fd698 R14: ffffc9000d73f430 R15: ffff8880590fca80 FS: 0000555580098500(0000) GS:ffff8880d5ee7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb49235da08 CR3: 000000003f682000 CR4: 0000000000352ef0 Call Trace: check_irq_usage+0x332/0x810 kernel/locking/lockdep.c:2816 check_prev_add+0xfe/0xe60 kernel/locking/lockdep.c:3169 check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825 seqcount_lockdep_reader_access include/linux/seqlock.h:73 [inline] ktime_expiry_to_cycles+0x9b/0x2c0 kernel/time/timekeeping.c:910 clockevent_set_next_coupled kernel/time/clockevents.c:314 [inline] clockevents_program_event+0x1bf/0x820 kernel/time/clockevents.c:360 tick_program_event+0xa9/0x140 kernel/time/tick-oneshot.c:48 hrtimer_rearm_event kernel/time/hrtimer.c:707 [inline] hrtimer_rearm kernel/time/hrtimer.c:2141 [inline] __hrtimer_rearm_deferred+0x234/0x720 kernel/time/hrtimer.c:2161 hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:53 [inline] hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:62 [inline] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:505 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline] irqentry_exit+0x5f3/0xa00 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872 Code: 05 fb 1d 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 46 d1 3c 0f 0f 82 ac 02 00 00 8b 35 0e 05 3d 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d 1d 7e 12 0f 85 ec 02 00 00 48 83 c4 RSP: 0018:ffffc9000d73f8e8 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff8e17ea39 RDI: ffffffff8c401280 RBP: ffff8880229dd140 R08: 00000000002b1c98 R09: ffffffff9745ee28 R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 touch_wq_lockdep_map+0xad/0x1c0 kernel/workqueue.c:4037 __flush_workqueue+0x131/0x1200 kernel/workqueue.c:4079 drain_workqueue+0x175/0x3b0 kernel/workqueue.c:4243 destroy_workqueue+0xc3/0xa30 kernel/workqueue.c:6068 xfs_destroy_mount_workqueues+0x65/0x150 fs/xfs/xfs_super.c:654 xfs_fs_fill_super+0x98f/0x1f40 fs/xfs/xfs_super.c:1972 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634 vfs_get_tree+0x92/0x320 fs/super.c:1694 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3765 [inline] do_new_mount fs/namespace.c:3841 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4161 do_mount fs/namespace.c:4174 [inline] __do_sys_mount fs/namespace.c:4390 [inline] __se_sys_mount fs/namespace.c:4367 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4367 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8b6b39de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd599af578 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f8b6b625fa0 RCX: 00007f8b6b39de99 RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000200000000040 RBP: 00007f8b6b433eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8b6b625fac R14: 00007f8b6b625fa0 R15: 00007f8b6b625fa0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 55 push %rbp 5: 53 push %rbx 6: 89 fb mov %edi,%ebx 8: e8 37 08 35 03 call 0x3350844 d: 89 c5 mov %eax,%ebp f: e8 20 ff ff ff call 0xffffff34 14: 85 ed test %ebp,%ebp 16: 74 17 je 0x2f 18: 83 fb ff cmp $0xffffffff,%ebx 1b: 0f 84 d8 ef 3c ff je 0xff3ceff9 21: 48 8d 3d 1c d6 40 0f lea 0xf40d61c(%rip),%rdi # 0xf40d644 28: 89 de mov %ebx,%esi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 5b pop %rbx 30: 5d pop %rbp 31: c3 ret 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: 66 data16 37: 66 data16 38: 2e cs 39: 0f .byte 0xf 3a: 1f (bad) 3b: 84 00 test %al,(%rax) 3d: 00 00 add %al,(%rax) final repro crashed as (corrupted=false): Increase LOCKDEP_CIRCULAR_QUEUE_BITS to avoid this warning: ------------[ cut here ]------------ lockdep bfs error:-1 WARNING: kernel/locking/lockdep.c:2059 at print_bfs_bug+0x24/0x40 kernel/locking/lockdep.c:2059, CPU#1: syz.3.2194/19121 Modules linked in: CPU: 1 UID: 0 PID: 19121 Comm: syz.3.2194 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:print_bfs_bug+0x26/0x40 kernel/locking/lockdep.c:2059 Code: 90 90 90 90 55 53 89 fb e8 37 08 35 03 89 c5 e8 20 ff ff ff 85 ed 74 17 83 fb ff 0f 84 d8 ef 3c ff 48 8d 3d 1c d6 40 0f 89 de <67> 48 0f b9 3a 5b 5d c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ffffc9000d73f378 EFLAGS: 00010086 RAX: 000000000000003b RBX: 00000000ffffffff RCX: 0000000000000000 RDX: 000000000000003b RSI: 00000000ffffffff RDI: ffffffff9125dc10 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 6573616572636e49 R12: ffffc9000d73f3f0 R13: ffff8880590fd698 R14: ffffc9000d73f430 R15: ffff8880590fca80 FS: 0000555580098500(0000) GS:ffff8880d5ee7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb49235da08 CR3: 000000003f682000 CR4: 0000000000352ef0 Call Trace: check_irq_usage+0x332/0x810 kernel/locking/lockdep.c:2816 check_prev_add+0xfe/0xe60 kernel/locking/lockdep.c:3169 check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825 seqcount_lockdep_reader_access include/linux/seqlock.h:73 [inline] ktime_expiry_to_cycles+0x9b/0x2c0 kernel/time/timekeeping.c:910 clockevent_set_next_coupled kernel/time/clockevents.c:314 [inline] clockevents_program_event+0x1bf/0x820 kernel/time/clockevents.c:360 tick_program_event+0xa9/0x140 kernel/time/tick-oneshot.c:48 hrtimer_rearm_event kernel/time/hrtimer.c:707 [inline] hrtimer_rearm kernel/time/hrtimer.c:2141 [inline] __hrtimer_rearm_deferred+0x234/0x720 kernel/time/hrtimer.c:2161 hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:53 [inline] hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:62 [inline] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:505 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline] irqentry_exit+0x5f3/0xa00 kernel/entry/common.c:167 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872 Code: 05 fb 1d 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 46 d1 3c 0f 0f 82 ac 02 00 00 8b 35 0e 05 3d 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d 1d 7e 12 0f 85 ec 02 00 00 48 83 c4 RSP: 0018:ffffc9000d73f8e8 EFLAGS: 00000206 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff8e17ea39 RDI: ffffffff8c401280 RBP: ffff8880229dd140 R08: 00000000002b1c98 R09: ffffffff9745ee28 R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 touch_wq_lockdep_map+0xad/0x1c0 kernel/workqueue.c:4037 __flush_workqueue+0x131/0x1200 kernel/workqueue.c:4079 drain_workqueue+0x175/0x3b0 kernel/workqueue.c:4243 destroy_workqueue+0xc3/0xa30 kernel/workqueue.c:6068 xfs_destroy_mount_workqueues+0x65/0x150 fs/xfs/xfs_super.c:654 xfs_fs_fill_super+0x98f/0x1f40 fs/xfs/xfs_super.c:1972 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1634 vfs_get_tree+0x92/0x320 fs/super.c:1694 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3765 [inline] do_new_mount fs/namespace.c:3841 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4161 do_mount fs/namespace.c:4174 [inline] __do_sys_mount fs/namespace.c:4390 [inline] __se_sys_mount fs/namespace.c:4367 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4367 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8b6b39de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd599af578 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f8b6b625fa0 RCX: 00007f8b6b39de99 RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000200000000040 RBP: 00007f8b6b433eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8b6b625fac R14: 00007f8b6b625fa0 R15: 00007f8b6b625fa0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 55 push %rbp 5: 53 push %rbx 6: 89 fb mov %edi,%ebx 8: e8 37 08 35 03 call 0x3350844 d: 89 c5 mov %eax,%ebp f: e8 20 ff ff ff call 0xffffff34 14: 85 ed test %ebp,%ebp 16: 74 17 je 0x2f 18: 83 fb ff cmp $0xffffffff,%ebx 1b: 0f 84 d8 ef 3c ff je 0xff3ceff9 21: 48 8d 3d 1c d6 40 0f lea 0xf40d61c(%rip),%rdi # 0xf40d644 28: 89 de mov %ebx,%esi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 5b pop %rbx 30: 5d pop %rbp 31: c3 ret 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: 66 data16 37: 66 data16 38: 2e cs 39: 0f .byte 0xf 3a: 1f (bad) 3b: 84 00 test %al,(%rax) 3d: 00 00 add %al,(%rax)