Extracting prog: 24.164804093s Minimizing prog: 6m34.502304124s Simplifying prog options: 0s Extracting C: 12.044437075s Simplifying C: 1m27.138794401s extracting reproducer from 156 programs testing a last program of every proc single: executing 106 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-fgetxattr-ioctl$KDFONTOP_GET-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) fgetxattr(r1, &(0x7f0000001b80)=@random={'btrfs.', 'security.ima\x00'}, 0x0, 0x0) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f0000000040)={0x1, 0x0, 0x6, 0x1b, 0x1f4, &(0x7f0000000280)}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint single: successfully extracted reproducer found reproducer with 10 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-fgetxattr-ioctl$KDFONTOP_GET detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) fgetxattr(r1, &(0x7f0000001b80)=@random={'btrfs.', 'security.ima\x00'}, 0x0, 0x0) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f0000000040)={0x1, 0x0, 0x6, 0x1b, 0x1f4, &(0x7f0000000280)}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-fgetxattr-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) fgetxattr(r1, &(0x7f0000001b80)=@random={'btrfs.', 'security.ima\x00'}, 0x0, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-ioctl$TUNSETPERSIST-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETDEBUG-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xa9]}, 0x8, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program did not crash testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint validation run: crashed=true testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint validation run: crashed=true testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETPERSIST-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-signalfd4-ioctl$TUNSETPERSIST detailed listing: executing program 0: unshare(0x40020200) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000240)=[{0x50, 0x0, 0x0, 0x200000}, {0x6}]}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) program crashed: panic: Decrementing non-positive ref count ADDR, owned by tun.tunEndpoint validation run: crashed=true reproducing took 9m30.849240187s repro crashed as (corrupted=false): panic: Decrementing non-positive ref count 0xc0003a77c0, owned by tun.tunEndpoint goroutine 701 gp=0xc00163ac40 m=23 mp=0xc000937808 [running]: panic({0x12eb280?, 0xc0002008e0?}) GOROOT/src/runtime/panic.go:811 +0x168 fp=0xc00071d780 sp=0xc00071d6d0 pc=0x4788c8 gvisor.dev/gvisor/pkg/tcpip/link/tun.(*tunEndpointRefs).DecRef(0xc0003a77c0, 0xc000692c50?) bazel-out/k8-fastbuild/bin/pkg/tcpip/link/tun/tun_endpoint_refs.go:127 +0x154 fp=0xc00071d7e8 sp=0xc00071d780 pc=0xc8dd54 gvisor.dev/gvisor/pkg/tcpip/link/tun.(*tunEndpoint).DecRef(0xc000c3e300?, {0xc000a83b90?, 0x0?}) pkg/tcpip/link/tun/device.go:415 +0x35 fp=0xc00071d818 sp=0xc00071d7e8 pc=0xc8cc95 gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Release(0xc001582668, {0x17db610, 0xc0008b4588}) pkg/tcpip/link/tun/device.go:98 +0xcb fp=0xc00071d868 sp=0xc00071d818 pc=0xc8a8eb gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Release(0xc0003a6ff0?, {0x17db610?, 0xc0008b4588?}) pkg/sentry/devices/tundev/tundev.go:127 +0x2d fp=0xc00071d890 sp=0xc00071d868 pc=0x102520d gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef.func1() pkg/sentry/vfs/file_description.go:205 +0x3a8 fp=0xc00071d970 sp=0xc00071d890 pc=0x848d28 gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescriptionRefs).DecRef(0x17db610?, 0xc00071d9e8) bazel-out/k8-fastbuild/bin/pkg/sentry/vfs/file_description_refs.go:133 +0x75 fp=0xc00071d9d8 sp=0xc00071d970 pc=0x84fbd5 gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef(0xc000c3e2c0?, {0x17db610?, 0xc0008b4588?}) pkg/sentry/vfs/file_description.go:161 +0x49 fp=0xc00071da18 sp=0xc00071d9d8 pc=0x848949 gvisor.dev/gvisor/pkg/sentry/syscalls/linux.CloseRange(0xc0008b4588, 0x49f519?, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/syscalls/linux/sys_file.go:504 +0x268 fp=0xc00071da80 sp=0xc00071da18 pc=0xcfc568 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc0008b4588, 0x1b4, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/kernel/task_syscall.go:143 +0x809 fp=0xc00071dcb0 sp=0xc00071da80 pc=0xb488c9 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc0008b4588, 0x1b4, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/kernel/task_syscall.go:323 +0x4e fp=0xc00071dd08 sp=0xc00071dcb0 pc=0xb49eae gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc0008b4588, 0x1b4, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/kernel/task_syscall.go:283 +0x7d fp=0xc00071dd58 sp=0xc00071dd08 pc=0xb49a3d gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc0016ab380?) pkg/sentry/kernel/task_syscall.go:258 +0x349 fp=0xc00071de30 sp=0xc00071dd58 pc=0xb49709 gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc001722000?, 0xc0008b4588) pkg/sentry/kernel/task_run.go:269 +0x12cb fp=0xc00071df38 sp=0xc00071de30 pc=0xb3d22b gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0008b4588, 0x4d) pkg/sentry/kernel/task_run.go:97 +0x27d fp=0xc00071dfc0 sp=0xc00071df38 pc=0xb3b89d gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1() pkg/sentry/kernel/task_start.go:416 +0x25 fp=0xc00071dfe0 sp=0xc00071dfc0 pc=0xb46e45 runtime.goexit({}) src/runtime/asm_amd64.s:1700 +0x1 fp=0xc00071dfe8 sp=0xc00071dfe0 pc=0x4816e1 created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 574 pkg/sentry/kernel/task_start.go:416 +0xd8 final repro crashed as (corrupted=false): panic: Decrementing non-positive ref count 0xc0003a77c0, owned by tun.tunEndpoint goroutine 701 gp=0xc00163ac40 m=23 mp=0xc000937808 [running]: panic({0x12eb280?, 0xc0002008e0?}) GOROOT/src/runtime/panic.go:811 +0x168 fp=0xc00071d780 sp=0xc00071d6d0 pc=0x4788c8 gvisor.dev/gvisor/pkg/tcpip/link/tun.(*tunEndpointRefs).DecRef(0xc0003a77c0, 0xc000692c50?) bazel-out/k8-fastbuild/bin/pkg/tcpip/link/tun/tun_endpoint_refs.go:127 +0x154 fp=0xc00071d7e8 sp=0xc00071d780 pc=0xc8dd54 gvisor.dev/gvisor/pkg/tcpip/link/tun.(*tunEndpoint).DecRef(0xc000c3e300?, {0xc000a83b90?, 0x0?}) pkg/tcpip/link/tun/device.go:415 +0x35 fp=0xc00071d818 sp=0xc00071d7e8 pc=0xc8cc95 gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Release(0xc001582668, {0x17db610, 0xc0008b4588}) pkg/tcpip/link/tun/device.go:98 +0xcb fp=0xc00071d868 sp=0xc00071d818 pc=0xc8a8eb gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Release(0xc0003a6ff0?, {0x17db610?, 0xc0008b4588?}) pkg/sentry/devices/tundev/tundev.go:127 +0x2d fp=0xc00071d890 sp=0xc00071d868 pc=0x102520d gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef.func1() pkg/sentry/vfs/file_description.go:205 +0x3a8 fp=0xc00071d970 sp=0xc00071d890 pc=0x848d28 gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescriptionRefs).DecRef(0x17db610?, 0xc00071d9e8) bazel-out/k8-fastbuild/bin/pkg/sentry/vfs/file_description_refs.go:133 +0x75 fp=0xc00071d9d8 sp=0xc00071d970 pc=0x84fbd5 gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef(0xc000c3e2c0?, {0x17db610?, 0xc0008b4588?}) pkg/sentry/vfs/file_description.go:161 +0x49 fp=0xc00071da18 sp=0xc00071d9d8 pc=0x848949 gvisor.dev/gvisor/pkg/sentry/syscalls/linux.CloseRange(0xc0008b4588, 0x49f519?, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/syscalls/linux/sys_file.go:504 +0x268 fp=0xc00071da80 sp=0xc00071da18 pc=0xcfc568 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc0008b4588, 0x1b4, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/kernel/task_syscall.go:143 +0x809 fp=0xc00071dcb0 sp=0xc00071da80 pc=0xb488c9 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc0008b4588, 0x1b4, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/kernel/task_syscall.go:323 +0x4e fp=0xc00071dd08 sp=0xc00071dcb0 pc=0xb49eae gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc0008b4588, 0x1b4, {{0x3}, {0x1e}, {0x0}, {0x55e7b21d7cb0}, {0x0}, {0x70cf2e9ef}}) pkg/sentry/kernel/task_syscall.go:283 +0x7d fp=0xc00071dd58 sp=0xc00071dd08 pc=0xb49a3d gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc0016ab380?) pkg/sentry/kernel/task_syscall.go:258 +0x349 fp=0xc00071de30 sp=0xc00071dd58 pc=0xb49709 gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc001722000?, 0xc0008b4588) pkg/sentry/kernel/task_run.go:269 +0x12cb fp=0xc00071df38 sp=0xc00071de30 pc=0xb3d22b gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc0008b4588, 0x4d) pkg/sentry/kernel/task_run.go:97 +0x27d fp=0xc00071dfc0 sp=0xc00071df38 pc=0xb3b89d gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1() pkg/sentry/kernel/task_start.go:416 +0x25 fp=0xc00071dfe0 sp=0xc00071dfc0 pc=0xb46e45 runtime.goexit({}) src/runtime/asm_amd64.s:1700 +0x1 fp=0xc00071dfe8 sp=0xc00071dfe0 pc=0x4816e1 created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 574 pkg/sentry/kernel/task_start.go:416 +0xd8