Extracting prog: 1m44.114550285s
Minimizing prog: 6m48.169933512s
Simplifying prog options: 8m19.259400283s
Extracting C: 1m34.719293889s
Simplifying C: 0s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-prctl$PR_GET_TSC-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
prctl$PR_GET_TSC(0x43, &(0x7f0000000040))
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in do_notify_resume
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=40.568398888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-prctl$PR_GET_TSC
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
prctl$PR_GET_TSC(0x43, &(0x7f0000000040))

program did not crash
testing program (duration=40.568398888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in do_notify_resume
testing program (duration=40.568398888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_clone3
detailed listing:
executing program 0:
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program did not crash
testing program (duration=40.568398888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=40.568398888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
program crashed: Internal error in __rseq_handle_notify_resume
a never seen crash title: Internal error in __rseq_handle_notify_resume, ignore
simplifying guilty program options
testing program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in do_notify_resume
extracting C reproducer
testing compiled C program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
program crashed: Internal error in __rseq_handle_notify_resume
a never seen crash title: Internal error in __rseq_handle_notify_resume, ignore
testing program (duration=40.568398888s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in sys_mount
a never seen crash title: Internal error in sys_mount, ignore
testing program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in do_notify_resume
extracting C reproducer
testing compiled C program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
program crashed: Internal error in sys_mount
a never seen crash title: Internal error in sys_mount, ignore
testing program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in sys_mount
validation run: crashed=true
testing program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in do_notify_resume
validation run: crashed=true
testing program (duration=40.568398888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_clone3
detailed listing:
executing program 0:
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa)
syz_clone3(&(0x7f0000000240)={0x24000000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58)

program crashed: Internal error in do_notify_resume
validation run: crashed=true
reproducing took 22m58.62337794s
repro crashed as (corrupted=false):
Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4246 Comm: syz.0.17 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc)
pc : setup_rt_frame arch/arm64/kernel/signal.c:-1 [inline]
pc : handle_signal arch/arm64/kernel/signal.c:833 [inline]
pc : do_signal arch/arm64/kernel/signal.c:908 [inline]
pc : do_notify_resume+0x958/0x3128 arch/arm64/kernel/signal.c:946
lr : __uaccess_mask_ptr arch/arm64/include/asm/uaccess.h:244 [inline]
lr : setup_rt_frame arch/arm64/kernel/signal.c:788 [inline]
lr : handle_signal arch/arm64/kernel/signal.c:833 [inline]
lr : do_signal arch/arm64/kernel/signal.c:908 [inline]
lr : do_notify_resume+0x938/0x3128 arch/arm64/kernel/signal.c:946
sp : ffff80001fdb7be0
x29: ffff80001fdb7e00 x28: 00000000fffffff2 x27: ffff80001fdb7eb0
x26: 0000000000000001 x25: 0000ffffd2820ff0 x24: ffff80001fdb7f98
x23: 0000000000000001 x22: dfff800000000000 x21: ffff0000d8c5d1c0
x20: 0000000000000000 x19: 00ffffd2820ff000 x18: 0000000000000200
x17: 0000000000000000 x16: ffff800008041968 x15: 0000000000000002
x14: 0000000000ff0100 x13: 1ffff0000282e06b x12: 0000000000ff0100
x11: 0000000000000000 x10: 0000ffffffffffff x9 : 0000ffffd2820ff0
x8 : 0000000000000000 x7 : ffff800008750ed4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 setup_rt_frame arch/arm64/kernel/signal.c:788 [inline]
 handle_signal arch/arm64/kernel/signal.c:833 [inline]
 do_signal arch/arm64/kernel/signal.c:908 [inline]
 do_notify_resume+0x958/0x3128 arch/arm64/kernel/signal.c:946
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_ia+0x158/0x2d0 arch/arm64/kernel/entry-common.c:513
 el0t_64_sync_handler+0xc0/0xe4 arch/arm64/kernel/entry-common.c:632
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 9a9f0329 d503229f f9405fe8 f8000928 (14000003) 
---[ end trace 6b8aea85849f5b99 ]---
----------------
Code disassembly (best guess):
   0:	9a9f0329 	csel	x9, x25, xzr, eq	// eq = none
   4:	d503229f 	csdb
   8:	f9405fe8 	ldr	x8, [sp, #184]
   c:	f8000928 	sttr	x8, [x9]
* 10:	14000003 	b	0x1c <-- trapping instruction

final repro crashed as (corrupted=false):
Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4246 Comm: syz.0.17 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc)
pc : setup_rt_frame arch/arm64/kernel/signal.c:-1 [inline]
pc : handle_signal arch/arm64/kernel/signal.c:833 [inline]
pc : do_signal arch/arm64/kernel/signal.c:908 [inline]
pc : do_notify_resume+0x958/0x3128 arch/arm64/kernel/signal.c:946
lr : __uaccess_mask_ptr arch/arm64/include/asm/uaccess.h:244 [inline]
lr : setup_rt_frame arch/arm64/kernel/signal.c:788 [inline]
lr : handle_signal arch/arm64/kernel/signal.c:833 [inline]
lr : do_signal arch/arm64/kernel/signal.c:908 [inline]
lr : do_notify_resume+0x938/0x3128 arch/arm64/kernel/signal.c:946
sp : ffff80001fdb7be0
x29: ffff80001fdb7e00 x28: 00000000fffffff2 x27: ffff80001fdb7eb0
x26: 0000000000000001 x25: 0000ffffd2820ff0 x24: ffff80001fdb7f98
x23: 0000000000000001 x22: dfff800000000000 x21: ffff0000d8c5d1c0
x20: 0000000000000000 x19: 00ffffd2820ff000 x18: 0000000000000200
x17: 0000000000000000 x16: ffff800008041968 x15: 0000000000000002
x14: 0000000000ff0100 x13: 1ffff0000282e06b x12: 0000000000ff0100
x11: 0000000000000000 x10: 0000ffffffffffff x9 : 0000ffffd2820ff0
x8 : 0000000000000000 x7 : ffff800008750ed4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 setup_rt_frame arch/arm64/kernel/signal.c:788 [inline]
 handle_signal arch/arm64/kernel/signal.c:833 [inline]
 do_signal arch/arm64/kernel/signal.c:908 [inline]
 do_notify_resume+0x958/0x3128 arch/arm64/kernel/signal.c:946
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
 el0_ia+0x158/0x2d0 arch/arm64/kernel/entry-common.c:513
 el0t_64_sync_handler+0xc0/0xe4 arch/arm64/kernel/entry-common.c:632
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 9a9f0329 d503229f f9405fe8 f8000928 (14000003) 
---[ end trace 6b8aea85849f5b99 ]---
----------------
Code disassembly (best guess):
   0:	9a9f0329 	csel	x9, x25, xzr, eq	// eq = none
   4:	d503229f 	csdb
   8:	f9405fe8 	ldr	x8, [sp, #184]
   c:	f8000928 	sttr	x8, [x9]
* 10:	14000003 	b	0x1c <-- trapping instruction