Extracting prog: 34.275660993s Minimizing prog: 11m54.882123998s Simplifying prog options: 0s Extracting C: 51.668028096s Simplifying C: 11m47.092437184s extracting reproducer from 51 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, 0x0, 0x0) (fail_nth: 11) program did not crash testing program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400), 0x0) (fail_nth: 11) program did not crash extracting C reproducer testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist simplifying C reproducer testing compiled C program (duration=46.600318144s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING in nvmet_fc_alloc_ls_iodlist a never seen crash title: WARNING in nvmet_fc_alloc_ls_iodlist, ignore testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING in nvmet_fc_alloc_ls_iodlist a never seen crash title: WARNING in nvmet_fc_alloc_ls_iodlist, ignore testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING in nvmet_fc_alloc_ls_iodlist a never seen crash title: WARNING in nvmet_fc_alloc_ls_iodlist, ignore testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing compiled C program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist testing program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist validation run: crashed=true testing program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program crashed: KASAN: invalid-free in nvmet_fc_alloc_ls_iodlist validation run: crashed=true testing program (duration=46.600318144s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) (fail_nth: 11) program crashed: WARNING in nvmet_fc_alloc_ls_iodlist validation run: crashed=true reproducing took 28m38.25923282s repro crashed as (corrupted=false): __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4536 at mm/slab_common.c:904 free_large_kmalloc+0x30/0x158 mm/slab_common.c:905 Modules linked in: CPU: 1 PID: 4536 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 42400005 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x30/0x158 mm/slab_common.c:905 lr : kfree+0xf4/0x1a8 mm/slab_common.c:982 sp : ffff8000210577b0 x29: ffff8000210577b0 x28: dead000000000100 x27: dfff800000000000 x26: ffff0000d584ec38 x25: 0000000000000000 x24: ffff0000d584ec98 x23: ffff0000ef9a0000 x22: ffff0000ef9a0000 x21: 0000000000040000 x20: ffff0000ef99ff20 x19: fffffc0003be67c0 x18: 0000000000000000 x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 x14: 0000000000000001 x13: 1ffff00002ac6fce x12: 0000000000000000 x11: ff0080000808d058 x10: dead0000000000ff x9 : dead000000000100 x8 : ffff800017d5d000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 00000000ffffffff x4 : 0000000000000dc0 x3 : 0000000000000dc0 x2 : ffff0000ef9a0010 x1 : ffff0000ef99ff20 x0 : fffffc0003be67c0 Call trace: free_large_kmalloc+0x30/0x158 mm/slab_common.c:905 kfree+0xf4/0x1a8 mm/slab_common.c:982 nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec drivers/nvme/target/fc.c:574 nvmet_fc_register_targetport+0x5d0/0x818 drivers/nvme/target/fc.c:1413 fcloop_create_target_port+0x120/0x420 drivers/nvme/target/fcloop.c:1427 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 790 hardirqs last enabled at (789): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline] hardirqs last enabled at (789): [] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94 hardirqs last disabled at (790): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (784): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (784): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (731): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- object pointer: 0x00000000b337638b ================================================================== BUG: KASAN: invalid-free in kfree+0xf4/0x1a8 mm/slab_common.c:982 Free of addr ffff0000ef99ff20 by task syz.0.17/4536 CPU: 0 PID: 4536 Comm: syz.0.17 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report_invalid_free+0x98/0xe4 mm/kasan/report.c:489 ____kasan_kfree_large mm/kasan/common.c:-1 [inline] __kasan_kfree_large+0xa4/0xc0 mm/kasan/common.c:273 kasan_kfree_large include/linux/kasan.h:185 [inline] free_large_kmalloc+0x68/0x158 mm/slab_common.c:908 kfree+0xf4/0x1a8 mm/slab_common.c:982 nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec drivers/nvme/target/fc.c:574 nvmet_fc_register_targetport+0x5d0/0x818 drivers/nvme/target/fc.c:1413 fcloop_create_target_port+0x120/0x420 drivers/nvme/target/fcloop.c:1427 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the physical page: page:00000000c0cded69 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f99f flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ef99fe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000ef99fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000ef99ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000ef99ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000ef9a0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== page:00000000c0cded69 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f99f flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:780! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4536 Comm: syz.0.17 Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : put_page_testzero include/linux/mm.h:780 [inline] pc : __free_pages+0x160/0x1cc mm/page_alloc.c:5746 lr : put_page_testzero include/linux/mm.h:780 [inline] lr : __free_pages+0x160/0x1cc mm/page_alloc.c:5746 sp : ffff800021057770 x29: ffff800021057770 x28: dead000000000100 x27: dfff800000000000 x26: ffff0000d584ec38 x25: 0000000000000000 x24: ffff0000d584ec98 x23: dfff800000000000 x22: 05ffc00000000000 x21: fffffc0003be67f4 x20: 0000000000000000 x19: fffffc0003be67c0 x18: 1fffe00033e7697e x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 x14: 0000000000000001 x13: 1fffe00033e769a3 x12: 0000000000000000 x11: ff008000087c9780 x10: 0000000000000000 x9 : ffff8000087c9780 x8 : ffff0000d51a9c00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000210571b8 x4 : ffff800015464e80 x3 : ffff800008540904 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e Call trace: put_page_testzero include/linux/mm.h:780 [inline] __free_pages+0x160/0x1cc mm/page_alloc.c:5746 free_large_kmalloc+0xc8/0x158 mm/slab_common.c:913 kfree+0xf4/0x1a8 mm/slab_common.c:982 nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec drivers/nvme/target/fc.c:574 nvmet_fc_register_targetport+0x5d0/0x818 drivers/nvme/target/fc.c:1413 fcloop_create_target_port+0x120/0x420 drivers/nvme/target/fcloop.c:1427 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: d004a9c1 91328021 aa1303e0 97fdfec8 (d4210000) ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4536 at mm/slab_common.c:904 free_large_kmalloc+0x30/0x158 mm/slab_common.c:905 Modules linked in: CPU: 1 PID: 4536 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 42400005 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x30/0x158 mm/slab_common.c:905 lr : kfree+0xf4/0x1a8 mm/slab_common.c:982 sp : ffff8000210577b0 x29: ffff8000210577b0 x28: dead000000000100 x27: dfff800000000000 x26: ffff0000d584ec38 x25: 0000000000000000 x24: ffff0000d584ec98 x23: ffff0000ef9a0000 x22: ffff0000ef9a0000 x21: 0000000000040000 x20: ffff0000ef99ff20 x19: fffffc0003be67c0 x18: 0000000000000000 x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 x14: 0000000000000001 x13: 1ffff00002ac6fce x12: 0000000000000000 x11: ff0080000808d058 x10: dead0000000000ff x9 : dead000000000100 x8 : ffff800017d5d000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 00000000ffffffff x4 : 0000000000000dc0 x3 : 0000000000000dc0 x2 : ffff0000ef9a0010 x1 : ffff0000ef99ff20 x0 : fffffc0003be67c0 Call trace: free_large_kmalloc+0x30/0x158 mm/slab_common.c:905 kfree+0xf4/0x1a8 mm/slab_common.c:982 nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec drivers/nvme/target/fc.c:574 nvmet_fc_register_targetport+0x5d0/0x818 drivers/nvme/target/fc.c:1413 fcloop_create_target_port+0x120/0x420 drivers/nvme/target/fcloop.c:1427 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 790 hardirqs last enabled at (789): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline] hardirqs last enabled at (789): [] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94 hardirqs last disabled at (790): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (784): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (784): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (731): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- object pointer: 0x00000000b337638b ================================================================== BUG: KASAN: invalid-free in kfree+0xf4/0x1a8 mm/slab_common.c:982 Free of addr ffff0000ef99ff20 by task syz.0.17/4536 CPU: 0 PID: 4536 Comm: syz.0.17 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106 print_address_description+0x88/0x218 mm/kasan/report.c:316 print_report+0x50/0x68 mm/kasan/report.c:420 kasan_report_invalid_free+0x98/0xe4 mm/kasan/report.c:489 ____kasan_kfree_large mm/kasan/common.c:-1 [inline] __kasan_kfree_large+0xa4/0xc0 mm/kasan/common.c:273 kasan_kfree_large include/linux/kasan.h:185 [inline] free_large_kmalloc+0x68/0x158 mm/slab_common.c:908 kfree+0xf4/0x1a8 mm/slab_common.c:982 nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec drivers/nvme/target/fc.c:574 nvmet_fc_register_targetport+0x5d0/0x818 drivers/nvme/target/fc.c:1413 fcloop_create_target_port+0x120/0x420 drivers/nvme/target/fcloop.c:1427 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 The buggy address belongs to the physical page: page:00000000c0cded69 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f99f flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ef99fe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000ef99fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000ef99ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000ef99ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000ef9a0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== page:00000000c0cded69 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f99f flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:780! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4536 Comm: syz.0.17 Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : put_page_testzero include/linux/mm.h:780 [inline] pc : __free_pages+0x160/0x1cc mm/page_alloc.c:5746 lr : put_page_testzero include/linux/mm.h:780 [inline] lr : __free_pages+0x160/0x1cc mm/page_alloc.c:5746 sp : ffff800021057770 x29: ffff800021057770 x28: dead000000000100 x27: dfff800000000000 x26: ffff0000d584ec38 x25: 0000000000000000 x24: ffff0000d584ec98 x23: dfff800000000000 x22: 05ffc00000000000 x21: fffffc0003be67f4 x20: 0000000000000000 x19: fffffc0003be67c0 x18: 1fffe00033e7697e x17: 0000000000000000 x16: ffff800011b90080 x15: 0000000000000000 x14: 0000000000000001 x13: 1fffe00033e769a3 x12: 0000000000000000 x11: ff008000087c9780 x10: 0000000000000000 x9 : ffff8000087c9780 x8 : ffff0000d51a9c00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000210571b8 x4 : ffff800015464e80 x3 : ffff800008540904 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e Call trace: put_page_testzero include/linux/mm.h:780 [inline] __free_pages+0x160/0x1cc mm/page_alloc.c:5746 free_large_kmalloc+0xc8/0x158 mm/slab_common.c:913 kfree+0xf4/0x1a8 mm/slab_common.c:982 nvmet_fc_alloc_ls_iodlist+0x7c4/0x7ec drivers/nvme/target/fc.c:574 nvmet_fc_register_targetport+0x5d0/0x818 drivers/nvme/target/fc.c:1413 fcloop_create_target_port+0x120/0x420 drivers/nvme/target/fcloop.c:1427 dev_attr_store+0x6c/0x90 drivers/base/core.c:2388 sysfs_kf_write+0x1f8/0x274 fs/sysfs/file.c:140 kernfs_fop_write_iter+0x390/0x4b4 fs/kernfs/file.c:352 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x3c8/0x7c8 fs/read_write.c:584 ksys_write+0x12c/0x228 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Code: d004a9c1 91328021 aa1303e0 97fdfec8 (d4210000) ---[ end trace 0000000000000000 ]---