Extracting prog: 1m26.349834311s Minimizing prog: 3m23.145662429s Simplifying prog options: 0s Extracting C: 1m5.450981995s Simplifying C: 4m14.998514818s 30 programs, 3 VMs, timeouts [15s 1m40s 6m0s] extracting reproducer from 30 programs single: executing 5 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0], 0xf4240}) program crashed: WARNING in drm_mode_create_lease_ioctl single: successfully extracted reproducer found reproducer with 2 syscalls minimizing guilty program testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri detailed listing: executing program 0: syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DRM_IOCTL_MODE_CREATE_LEASE detailed listing: executing program 0: ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0], 0xf4240}) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE detailed listing: executing program 0: r0 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[0x0], 0xf4240}) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, 0x0) program did not crash testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000040)={0x0}) program did not crash extracting C reproducer testing compiled C program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl simplifying C reproducer testing compiled C program (duration=22.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_CREATE_LEASE program crashed: WARNING in drm_mode_create_lease_ioctl reproducing took 10m9.945006112s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3965 at mm/page_alloc.c:5398 __alloc_pages+0x33c/0x674 mm/page_alloc.c:5398 Modules linked in: CPU: 0 PID: 3965 Comm: syz-executor356 Not tainted 5.15.161-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x33c/0x674 mm/page_alloc.c:5398 lr : __alloc_pages+0xc8/0x674 mm/page_alloc.c:5391 sp : ffff800018e97580 x29: ffff800018e97670 x28: ffff800018e975a0 x27: dfff800000000000 x26: ffff7000031d2eb4 x25: 0000000000000000 x24: ffff800018e975c0 x23: ffff8000184ac604 x22: 0000000000040dc0 x21: 0000000000000000 x20: ffff800018e975e0 x19: 000000000000000b x18: 0000000000000000 x17: 0000000000000000 x16: ffff8000088a10bc x15: 0000000000000005 x14: ffff0000c92e8000 x13: 0000000000ff0100 x12: 0000000000000005 x11: 1ffff000031d2ebc x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800018e97608 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff800018e975e0 Call trace: __alloc_pages+0x33c/0x674 mm/page_alloc.c:5398 alloc_pages+0x368/0x5d4 kmalloc_order+0x40/0x154 mm/slab_common.c:966 kmalloc_order_trace+0x30/0x21c mm/slab_common.c:982 kmalloc_large include/linux/slab.h:520 [inline] __kmalloc+0x35c/0x4c8 mm/slub.c:4396 kmalloc_array include/linux/slab.h:631 [inline] kcalloc include/linux/slab.h:660 [inline] fill_object_idr drivers/gpu/drm/drm_lease.c:386 [inline] drm_mode_create_lease_ioctl+0x338/0xdd8 drivers/gpu/drm/drm_lease.c:523 drm_ioctl_kernel+0x2cc/0x458 drivers/gpu/drm/drm_ioctl.c:801 drm_ioctl+0x5d0/0xa64 drivers/gpu/drm/drm_ioctl.c:904 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 19224 hardirqs last enabled at (19223): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline] hardirqs last enabled at (19223): [] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91 hardirqs last disabled at (19224): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (14364): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (14364): [] handle_softirqs+0xb88/0xdbc kernel/softirq.c:586 softirqs last disabled at (14357): [] __do_softirq kernel/softirq.c:592 [inline] softirqs last disabled at (14357): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (14357): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (14357): [] __irq_exit_rcu+0x268/0x4d8 kernel/softirq.c:641 ---[ end trace bf3780377a6e7d40 ]--- final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3965 at mm/page_alloc.c:5398 __alloc_pages+0x33c/0x674 mm/page_alloc.c:5398 Modules linked in: CPU: 0 PID: 3965 Comm: syz-executor356 Not tainted 5.15.161-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x33c/0x674 mm/page_alloc.c:5398 lr : __alloc_pages+0xc8/0x674 mm/page_alloc.c:5391 sp : ffff800018e97580 x29: ffff800018e97670 x28: ffff800018e975a0 x27: dfff800000000000 x26: ffff7000031d2eb4 x25: 0000000000000000 x24: ffff800018e975c0 x23: ffff8000184ac604 x22: 0000000000040dc0 x21: 0000000000000000 x20: ffff800018e975e0 x19: 000000000000000b x18: 0000000000000000 x17: 0000000000000000 x16: ffff8000088a10bc x15: 0000000000000005 x14: ffff0000c92e8000 x13: 0000000000ff0100 x12: 0000000000000005 x11: 1ffff000031d2ebc x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800018e97608 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff800018e975e0 Call trace: __alloc_pages+0x33c/0x674 mm/page_alloc.c:5398 alloc_pages+0x368/0x5d4 kmalloc_order+0x40/0x154 mm/slab_common.c:966 kmalloc_order_trace+0x30/0x21c mm/slab_common.c:982 kmalloc_large include/linux/slab.h:520 [inline] __kmalloc+0x35c/0x4c8 mm/slub.c:4396 kmalloc_array include/linux/slab.h:631 [inline] kcalloc include/linux/slab.h:660 [inline] fill_object_idr drivers/gpu/drm/drm_lease.c:386 [inline] drm_mode_create_lease_ioctl+0x338/0xdd8 drivers/gpu/drm/drm_lease.c:523 drm_ioctl_kernel+0x2cc/0x458 drivers/gpu/drm/drm_ioctl.c:801 drm_ioctl+0x5d0/0xa64 drivers/gpu/drm/drm_ioctl.c:904 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 19224 hardirqs last enabled at (19223): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline] hardirqs last enabled at (19223): [] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91 hardirqs last disabled at (19224): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396 softirqs last enabled at (14364): [] softirq_handle_end kernel/softirq.c:401 [inline] softirqs last enabled at (14364): [] handle_softirqs+0xb88/0xdbc kernel/softirq.c:586 softirqs last disabled at (14357): [] __do_softirq kernel/softirq.c:592 [inline] softirqs last disabled at (14357): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (14357): [] invoke_softirq kernel/softirq.c:439 [inline] softirqs last disabled at (14357): [] __irq_exit_rcu+0x268/0x4d8 kernel/softirq.c:641 ---[ end trace bf3780377a6e7d40 ]---