Extracting prog: 3m42.22789142s
Minimizing prog: 7m45.540953195s
Simplifying prog options: 0s
Extracting C: 1m18.424245587s
Simplifying C: 8m20.875812873s


extracting reproducer from 31 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nfc-sendmsg$NFC_CMD_ENABLE_SE
detailed listing:
executing program 0:
syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000780), r0)
sendmsg$NFC_CMD_ENABLE_SE(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)={0x24, r1, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@NFC_ATTR_SE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x24}}, 0x810)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_vhci
detailed listing:
executing program 0:
syz_emit_vhci(0x0, 0x7)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-syz_usb_connect$uac3-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
syz_usb_connect$uac3(0x2, 0x80, 0x0, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-syz_usb_connect$uac3
detailed listing:
executing program 0:
openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
syz_usb_connect$uac3(0x2, 0x80, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): writev
detailed listing:
executing program 0:
writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{0x0}], 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{}], 0x1)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program crashed: BUG: unable to handle kernel paging request in ext4_mb_load_buddy_gfp
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysctl-writev
detailed listing:
executing program 0:
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000026c80)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)='3', 0x1}], 0x1)

program did not crash
validation run: crashed=false
reproducing took 32m23.353027285s
repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: writeback wb_workfn (flush-259:0)
pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : PageTail include/linux/page-flags.h:292 [inline]
pc : folio_flags include/linux/page-flags.h:319 [inline]
pc : folio_test_uptodate include/linux/page-flags.h:719 [inline]
pc : ext4_mb_load_buddy_gfp+0x21c/0xec0 fs/ext4/mballoc.c:1536
lr : ext4_mb_load_buddy_gfp+0x1e8/0xec0 fs/ext4/mballoc.c:1535
sp : ffff80001dbd6680
x29: ffff80001dbd66e0 x28: 1ffff00003b7ad14 x27: dfff800000000000
x26: 0000000000000008 x25: 0000000000000004 x24: ffff0000c04996f0
x23: ffff0000c04996c0 x22: 0000000000000000 x21: 0000000000000001
x20: 1ffff00003b7ad14 x19: ffff80001dbd6890 x18: 000000003d84a546
x17: 00000000d82bfa26 x16: ffff800011ba16d0 x15: 0000000000000000
x14: 0000000000000406 x13: 0000000000ff0100 x12: ffff800016647a88
x11: ff008000086f8b74 x10: 0000000000000000 x9 : 2c67f678318c2500
x8 : 2c67f678318c2500 x7 : ffff800008704dd0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 PageTail include/linux/page-flags.h:-1 [inline]
 folio_flags include/linux/page-flags.h:319 [inline]
 folio_test_uptodate include/linux/page-flags.h:719 [inline]
 ext4_mb_load_buddy_gfp+0x21c/0xec0 fs/ext4/mballoc.c:1536
 ext4_mb_load_buddy fs/ext4/mballoc.c:1641 [inline]
 ext4_mb_regular_allocator+0xfb4/0x2b60 fs/ext4/mballoc.c:2798
 ext4_mb_new_blocks+0xb78/0x4244 fs/ext4/mballoc.c:5793
 ext4_ext_map_blocks+0x12bc/0x5680 fs/ext4/extents.c:4369
 ext4_map_blocks+0x7b0/0x160c fs/ext4/inode.c:681
 mpage_map_one_extent fs/ext4/inode.c:2437 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2490 [inline]
 ext4_writepages+0x10a4/0x29f0 fs/ext4/inode.c:2859
 do_writepages+0x2c4/0x50c mm/page-writeback.c:2491
 __writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1688
 writeback_sb_inodes+0x870/0x1470 fs/fs-writeback.c:1979
 __writeback_inodes_wb+0x104/0x370 fs/fs-writeback.c:2050
 wb_writeback+0x420/0xfdc fs/fs-writeback.c:2155
 wb_check_old_data_flush fs/fs-writeback.c:2255 [inline]
 wb_do_writeback fs/fs-writeback.c:2308 [inline]
 wb_workfn+0xab4/0xe18 fs/fs-writeback.c:2336
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: aa0003f6 d343ff55 f9000ff4 aa1c03f4 (387b6aa8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa0003f6 	mov	x22, x0
   4:	d343ff55 	lsr	x21, x26, #3
   8:	f9000ff4 	str	x20, [sp, #24]
   c:	aa1c03f4 	mov	x20, x28
* 10:	387b6aa8 	ldrb	w8, [x21, x27] <-- trapping instruction

final repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: writeback wb_workfn (flush-259:0)
pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : PageTail include/linux/page-flags.h:292 [inline]
pc : folio_flags include/linux/page-flags.h:319 [inline]
pc : folio_test_uptodate include/linux/page-flags.h:719 [inline]
pc : ext4_mb_load_buddy_gfp+0x21c/0xec0 fs/ext4/mballoc.c:1536
lr : ext4_mb_load_buddy_gfp+0x1e8/0xec0 fs/ext4/mballoc.c:1535
sp : ffff80001dbd6680
x29: ffff80001dbd66e0 x28: 1ffff00003b7ad14 x27: dfff800000000000
x26: 0000000000000008 x25: 0000000000000004 x24: ffff0000c04996f0
x23: ffff0000c04996c0 x22: 0000000000000000 x21: 0000000000000001
x20: 1ffff00003b7ad14 x19: ffff80001dbd6890 x18: 000000003d84a546
x17: 00000000d82bfa26 x16: ffff800011ba16d0 x15: 0000000000000000
x14: 0000000000000406 x13: 0000000000ff0100 x12: ffff800016647a88
x11: ff008000086f8b74 x10: 0000000000000000 x9 : 2c67f678318c2500
x8 : 2c67f678318c2500 x7 : ffff800008704dd0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 PageTail include/linux/page-flags.h:-1 [inline]
 folio_flags include/linux/page-flags.h:319 [inline]
 folio_test_uptodate include/linux/page-flags.h:719 [inline]
 ext4_mb_load_buddy_gfp+0x21c/0xec0 fs/ext4/mballoc.c:1536
 ext4_mb_load_buddy fs/ext4/mballoc.c:1641 [inline]
 ext4_mb_regular_allocator+0xfb4/0x2b60 fs/ext4/mballoc.c:2798
 ext4_mb_new_blocks+0xb78/0x4244 fs/ext4/mballoc.c:5793
 ext4_ext_map_blocks+0x12bc/0x5680 fs/ext4/extents.c:4369
 ext4_map_blocks+0x7b0/0x160c fs/ext4/inode.c:681
 mpage_map_one_extent fs/ext4/inode.c:2437 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2490 [inline]
 ext4_writepages+0x10a4/0x29f0 fs/ext4/inode.c:2859
 do_writepages+0x2c4/0x50c mm/page-writeback.c:2491
 __writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1688
 writeback_sb_inodes+0x870/0x1470 fs/fs-writeback.c:1979
 __writeback_inodes_wb+0x104/0x370 fs/fs-writeback.c:2050
 wb_writeback+0x420/0xfdc fs/fs-writeback.c:2155
 wb_check_old_data_flush fs/fs-writeback.c:2255 [inline]
 wb_do_writeback fs/fs-writeback.c:2308 [inline]
 wb_workfn+0xab4/0xe18 fs/fs-writeback.c:2336
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: aa0003f6 d343ff55 f9000ff4 aa1c03f4 (387b6aa8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa0003f6 	mov	x22, x0
   4:	d343ff55 	lsr	x21, x26, #3
   8:	f9000ff4 	str	x20, [sp, #24]
   c:	aa1c03f4 	mov	x20, x28
* 10:	387b6aa8 	ldrb	w8, [x21, x27] <-- trapping instruction