Extracting prog: 30.116009117s Minimizing prog: 26m27.922458011s Simplifying prog options: 0s Extracting C: 23.368231806s Simplifying C: 4m36.261675693s extracting reproducer from 40 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-sendmsg$NFT_BATCH-syz_emit_ethernet detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000740)={@dev, @link_local, @val={@val, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x67, 0x0, @remote, @remote}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0xf, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, {[@end, @timestamp={0x44, 0x24, 0xa0, 0x0, 0xc, [0xe6b, 0x6, 0xead, 0x1, 0x10000, 0xaf, 0x6, 0x4]}, @noop]}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) (async) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020000000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) (async) syz_emit_ethernet(0x66, &(0x7f0000000840)=ANY=[@ANYBLOB="0180c200000e0180c200000e88644503005800000021ff2f907864010100ac1414aa248088a80000000010000800000086dd080088be00000004100000000100000000000000080000000000000000000800655800000000"], 0x0) program crashed: WARNING in drm_syncobj_array_find single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-sendmsg$NFT_BATCH detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000740)={@dev, @link_local, @val={@val, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x67, 0x0, @remote, @remote}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0xf, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, {[@end, @timestamp={0x44, 0x24, 0xa0, 0x0, 0xc, [0xe6b, 0x6, 0xead, 0x1, 0x10000, 0xaf, 0x6, 0x4]}, @noop]}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) (async) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020000000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000740)={@dev, @link_local, @val={@val, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x67, 0x0, @remote, @remote}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0xf, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, {[@end, @timestamp={0x44, 0x24, 0xa0, 0x0, 0xc, [0xe6b, 0x6, 0xead, 0x1, 0x10000, 0xaf, 0x6, 0x4]}, @noop]}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) (async) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD_XDP detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000740)={@dev, @link_local, @val={@val, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x67, 0x0, @remote, @remote}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0xf, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, {[@end, @timestamp={0x44, 0x24, 0xa0, 0x0, 0xc, [0xe6b, 0x6, 0xead, 0x1, 0x10000, 0xaf, 0x6, 0x4]}, @noop]}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet-bpf$PROG_LOAD_XDP detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000740)={@dev, @link_local, @val={@val, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x67, 0x0, @remote, @remote}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0xf, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, {[@end, @timestamp={0x44, 0x24, 0xa0, 0x0, 0xc, [0xe6b, 0x6, 0xead, 0x1, 0x10000, 0xaf, 0x6, 0x4]}, @noop]}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000740)={@dev, @link_local, @val={@val, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x67, 0x0, @remote, @remote}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0xf, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @local, {[@end, @timestamp={0x44, 0x24, 0xa0, 0x0, 0xc, [0xe6b, 0x6, 0xead, 0x1, 0x10000, 0xaf, 0x6, 0x4]}, @noop]}}}}}}}, 0x0) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00080000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x240400c0) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg-socket$nl_netfilter detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) socket$nl_netfilter(0x10, 0x3, 0xc) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64-recvmsg detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}, 0x12140) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg-pwrite64 detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) pwrite64(r2, &(0x7f00000004c0)="e2849d4bea71c3c907e6a820ae63574323ee0b0b64fe11057a87d118e57db36b8e9733311870108f68918110a8b0d6356ebbbb04aa45dbc0b9b794230cb0c9da3f9898f91c57c0c2c4a983c5db0fc09a534f1e534e3677e0d0bb6dee61707889e7581901324266845310ef42e41d958f3d20ab32a0599616aaf50d77729439ac30", 0x81, 0xf) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-sendmmsg$alg detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, &(0x7f00000001c0)={0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r5, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r6, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r6, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r7], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r8 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r8, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r6, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r7], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r3, r3, r3, r3, r3, r7, r4, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r3], &(0x7f00000000c0), 0x1}) (async) sendmmsg$alg(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x4000801}], 0x1, 0x40c48d4) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_QUERY detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r6], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r7 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r7, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r6], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, r6, r3, 0x0], 0x0, 0x40000067}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000000)=[r2], &(0x7f00000000c0), 0x1}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r6], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r7 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r7, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r6], 0x0, 0xff, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, r6, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r3, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r4], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r5 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r5, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r3, 0xc03064ca, &(0x7f00000003c0)={&(0x7f0000000180)=[r4], 0x0, 0xff, 0x1}) (async) program did not crash testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-semctl$GETPID-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r6], &(0x7f0000000000)=[0x80000000], 0x1}) (async) r7 = semget$private(0x0, 0x4, 0x440) semctl$GETPID(r7, 0x2, 0xb, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, r6, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-semget$private-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r6], &(0x7f0000000000)=[0x80000000], 0x1}) (async) semget$private(0x0, 0x4, 0x440) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, r6, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r5, 0xc01864cd, &(0x7f0000000340)={&(0x7f00000001c0)=[r6], &(0x7f0000000000)=[0x80000000], 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, r6, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, r6, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, 0x0, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_QUERY-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r4, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000040)=[0x0], &(0x7f0000000080), 0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, 0x0, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r4, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, 0x0, r3, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, 0x0, r3, 0x0], 0x0, 0x40000067}) (async) program did not crash testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r3, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[r2, r2, r2, r2, r2, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000040), 0x20, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) accept$alg(r0, 0x0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-bind$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r1, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-socket$alg-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-sendmmsg$unix-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$TCXONC-syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) (async) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(0x0, 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) program did not crash testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, 0x0) program did not crash testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={0x0, 0x0}) program did not crash testing program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280), 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=33.847752034s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find simplifying C reproducer testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing compiled C program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL program crashed: WARNING in drm_syncobj_array_find testing program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) program crashed: WARNING in drm_syncobj_array_find validation run: crashed=true testing program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) program crashed: WARNING in drm_syncobj_array_find validation run: crashed=true testing program (duration=33.847752034s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000002c0)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x40000067}) program crashed: WARNING in drm_syncobj_array_find validation run: crashed=true reproducing took 34m0.027355773s repro crashed as (corrupted=false): WARNING: mm/page_alloc.c:5186 at __alloc_frozen_pages_noprof+0x309/0x2430 mm/page_alloc.c:5186, CPU#1: syz.0.17/6098 Modules linked in: CPU: 1 UID: 0 PID: 6098 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__alloc_frozen_pages_noprof+0x309/0x2430 mm/page_alloc.c:5186 Code: f0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 fe 0a 0f 86 0c fe ff ff 80 3d 39 53 56 0e 00 75 0b c6 05 30 53 56 0e 01 90 <0f> 0b 90 45 31 f6 eb 81 4d 85 f6 74 22 44 89 fa 89 ee 4c 89 f7 e8 RSP: 0018:ffffc90003f4f7a8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000015 RDI: 0000000000040cc0 RBP: 0000000000000015 R08: 0000000000000005 R09: 0000000000000009 R10: 0000000000000015 R11: ffff888025168b30 R12: 0000000000040cc0 R13: 1ffff920007e9f0b R14: ffffffff9ac42ac4 R15: 0000000000000015 FS: 0000555558bad500(0000) GS:ffff8880d69f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2ed63fff CR3: 00000000316cf000 CR4: 0000000000352ef0 Call Trace: alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486 ___kmalloc_large_node+0x10c/0x150 mm/slub.c:5598 __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:5629 __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof.cold+0xc/0x62 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kmalloc_array_noprof include/linux/slab.h:1003 [inline] drm_syncobj_array_find+0x35/0x3c0 drivers/gpu/drm/drm_syncobj.c:1297 drm_syncobj_timeline_signal_ioctl+0x226/0x870 drivers/gpu/drm/drm_syncobj.c:1624 drm_ioctl_kernel+0x1f4/0x3e0 drivers/gpu/drm/drm_ioctl.c:804 drm_ioctl+0x5c9/0xc30 drivers/gpu/drm/drm_ioctl.c:901 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcd9af8f7c9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffed7bc88d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcd9b1e5fa0 RCX: 00007fcd9af8f7c9 RDX: 00002000000002c0 RSI: 00000000c01864cd RDI: 0000000000000003 RBP: 00007fcd9b013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fcd9b1e5fa0 R14: 00007fcd9b1e5fa0 R15: 0000000000000003 final repro crashed as (corrupted=false): WARNING: mm/page_alloc.c:5186 at __alloc_frozen_pages_noprof+0x309/0x2430 mm/page_alloc.c:5186, CPU#1: syz.0.17/6098 Modules linked in: CPU: 1 UID: 0 PID: 6098 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__alloc_frozen_pages_noprof+0x309/0x2430 mm/page_alloc.c:5186 Code: f0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 fe 0a 0f 86 0c fe ff ff 80 3d 39 53 56 0e 00 75 0b c6 05 30 53 56 0e 01 90 <0f> 0b 90 45 31 f6 eb 81 4d 85 f6 74 22 44 89 fa 89 ee 4c 89 f7 e8 RSP: 0018:ffffc90003f4f7a8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000015 RDI: 0000000000040cc0 RBP: 0000000000000015 R08: 0000000000000005 R09: 0000000000000009 R10: 0000000000000015 R11: ffff888025168b30 R12: 0000000000040cc0 R13: 1ffff920007e9f0b R14: ffffffff9ac42ac4 R15: 0000000000000015 FS: 0000555558bad500(0000) GS:ffff8880d69f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2ed63fff CR3: 00000000316cf000 CR4: 0000000000352ef0 Call Trace: alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486 ___kmalloc_large_node+0x10c/0x150 mm/slub.c:5598 __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:5629 __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof.cold+0xc/0x62 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kmalloc_array_noprof include/linux/slab.h:1003 [inline] drm_syncobj_array_find+0x35/0x3c0 drivers/gpu/drm/drm_syncobj.c:1297 drm_syncobj_timeline_signal_ioctl+0x226/0x870 drivers/gpu/drm/drm_syncobj.c:1624 drm_ioctl_kernel+0x1f4/0x3e0 drivers/gpu/drm/drm_ioctl.c:804 drm_ioctl+0x5c9/0xc30 drivers/gpu/drm/drm_ioctl.c:901 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcd9af8f7c9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffed7bc88d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcd9b1e5fa0 RCX: 00007fcd9af8f7c9 RDX: 00002000000002c0 RSI: 00000000c01864cd RDI: 0000000000000003 RBP: 00007fcd9b013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fcd9b1e5fa0 R14: 00007fcd9b1e5fa0 R15: 0000000000000003