Extracting prog: 7m16.288231448s
Minimizing prog: 34m48.97764274s
Simplifying prog options: 0s
Extracting C: 27.097220943s
Simplifying C: 11m39.203085359s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-syz_io_uring_setup-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
r0 = syz_io_uring_setup(0x5169, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000000))
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-syz_io_uring_setup-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
r0 = syz_io_uring_setup(0x5169, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000000))
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-syz_io_uring_setup-dup-syz_open_procfs
detailed listing:
executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
r0 = syz_io_uring_setup(0x5169, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000000))
dup(r0)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program crashed: kernel BUG in may_open
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-syz_io_uring_setup-dup
detailed listing:
executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
r0 = syz_io_uring_setup(0x5169, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000000))
dup(r0)

program did not crash
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-syz_io_uring_setup-syz_open_procfs
detailed listing:
executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
syz_io_uring_setup(0x5169, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program crashed: kernel BUG in may_open
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-syz_open_procfs
detailed listing:
executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program did not crash
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
detailed listing:
executing program 0:
syz_io_uring_setup(0x5169, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program crashed: kernel BUG in may_open
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
detailed listing:
executing program 0:
syz_io_uring_setup(0x5169, 0x0, &(0x7f0000000080), &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program did not crash
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
detailed listing:
executing program 0:
syz_io_uring_setup(0x5169, &(0x7f0000000200), 0x0, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program crashed: kernel BUG in may_open
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
detailed listing:
executing program 0:
syz_io_uring_setup(0x5169, &(0x7f0000000200), 0x0, 0x0)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program crashed: kernel BUG in may_open
testing program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
detailed listing:
executing program 0:
syz_io_uring_setup(0x5169, &(0x7f0000000200), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m14.550963081s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
simplifying C reproducer
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m14.550963081s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_open_procfs
program crashed: kernel BUG in may_open
reproducing took 54m11.566203589s
repro crashed as (corrupted=false):
VFS_BUG_ON_INODE(1) encountered for inode ffff0000dd761e30
------------[ cut here ]------------
kernel BUG at fs/namei.c:3467!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6525 Comm: syz-executor206 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : may_open+0x3c0/0x3c4 fs/namei.c:3467
lr : may_open+0x3c0/0x3c4 fs/namei.c:3467
sp : ffff8000a3b577b0
x29: ffff8000a3b577b0 x28: 1fffe00018c5c408 x27: ffff80008f6578e0
x26: 0000000000280000 x25: dfff800000000000 x24: 00000000000fffff
x23: ffff8000a3b57aa0 x22: 0000000000000006 x21: ffff0000dd761e30
x20: 0000000000020002 x19: ffff80008f6578e0 x18: 00000000ffffffff
x17: ffff800092f39000 x16: ffff80008adbe9e4 x15: 0000000000000001
x14: 1ffff0001476ae5c x13: 0000000000000000 x12: 0000000000000000
x11: ffff70001476ae5d x10: 0000000000ff0100 x9 : 352f2731d4614800
x8 : 352f2731d4614800 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000a3b57118 x4 : ffff80008f415ba0 x3 : ffff800082fbf044
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003a
Call trace:
 may_open+0x3c0/0x3c4 fs/namei.c:3467 (P)
 do_open fs/namei.c:3878 [inline]
 path_openat+0x22f4/0x2c40 fs/namei.c:4039
 do_filp_open+0x18c/0x36c fs/namei.c:4066
 do_sys_openat2+0x11c/0x1b4 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __arm64_sys_openat+0x120/0x158 fs/open.c:1455
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Code: f0051061 91100021 aa1503e0 97cf135e (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
VFS_BUG_ON_INODE(1) encountered for inode ffff0000dd761e30
------------[ cut here ]------------
kernel BUG at fs/namei.c:3467!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6525 Comm: syz-executor206 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : may_open+0x3c0/0x3c4 fs/namei.c:3467
lr : may_open+0x3c0/0x3c4 fs/namei.c:3467
sp : ffff8000a3b577b0
x29: ffff8000a3b577b0 x28: 1fffe00018c5c408 x27: ffff80008f6578e0
x26: 0000000000280000 x25: dfff800000000000 x24: 00000000000fffff
x23: ffff8000a3b57aa0 x22: 0000000000000006 x21: ffff0000dd761e30
x20: 0000000000020002 x19: ffff80008f6578e0 x18: 00000000ffffffff
x17: ffff800092f39000 x16: ffff80008adbe9e4 x15: 0000000000000001
x14: 1ffff0001476ae5c x13: 0000000000000000 x12: 0000000000000000
x11: ffff70001476ae5d x10: 0000000000ff0100 x9 : 352f2731d4614800
x8 : 352f2731d4614800 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000a3b57118 x4 : ffff80008f415ba0 x3 : ffff800082fbf044
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003a
Call trace:
 may_open+0x3c0/0x3c4 fs/namei.c:3467 (P)
 do_open fs/namei.c:3878 [inline]
 path_openat+0x22f4/0x2c40 fs/namei.c:4039
 do_filp_open+0x18c/0x36c fs/namei.c:4066
 do_sys_openat2+0x11c/0x1b4 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __arm64_sys_openat+0x120/0x158 fs/open.c:1455
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Code: f0051061 91100021 aa1503e0 97cf135e (d4210000) 
---[ end trace 0000000000000000 ]---