Extracting prog: 2m15.878808298s
Minimizing prog: 34m10.337467157s
Simplifying prog options: 7m11.896820701s
Extracting C: 1m45.75430456s
Simplifying C: 0s


extracting reproducer from 38 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-sendmmsg$inet-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
r1 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r1, 0x0, 0x0, 0x48000)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-sendmmsg$inet
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
r1 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet(r1, 0x0, 0x0, 0x48000)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
write(0xffffffffffffffff, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', 0x0, &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', 0x0, 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', 0x0, 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700), 0x0)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
program did not crash
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
program did not crash
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-chdir-mkdirat-mount-openat-write-socket-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0)
mount(&(0x7f0000000400)=@filename='mtd0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='jffs2\x00', 0x800000, 0x0)
chdir(&(0x7f00000004c0)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='27', 0x2)
socket(0x2, 0x80805, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./file2\x00', 0x101042, 0x15)

program crashed: KASAN: use-after-free Read in jffs2_xattr_delete_inode
validation run: crashed=true
reproducing took 53m21.230215462s
repro crashed as (corrupted=false):
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================
BUG: KASAN: use-after-free in jffs2_xattr_delete_inode+0x274/0x278 fs/jffs2/xattr.c:602
Read of size 4 at addr ffff0000f022bc28 by task syz.0.243/5050

CPU: 0 PID: 5050 Comm: syz.0.243 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 jffs2_xattr_delete_inode+0x274/0x278 fs/jffs2/xattr.c:602
 jffs2_do_clear_inode+0x58/0x348 fs/jffs2/readinode.c:1418
 jffs2_evict_inode+0x7c/0x90 fs/jffs2/fs.c:250
 evict+0x3d8/0x824 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x728/0x7e8 fs/inode.c:1860
 jffs2_new_inode+0x358/0xa54 fs/jffs2/fs.c:-1
 jffs2_create+0x88/0x288 fs/jffs2/dir.c:180
 lookup_open fs/namei.c:3533 [inline]
 open_last_lookups fs/namei.c:3601 [inline]
 path_openat+0xda8/0x27a0 fs/namei.c:3831
 do_filp_open+0x198/0x38c fs/namei.c:3861
 do_sys_openat2+0x134/0x3fc fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4702:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x430 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x234/0x310 mm/slub.c:3383
 jffs2_alloc_inode_cache+0x20/0x2c fs/jffs2/malloc.c:265
 jffs2_scan_make_ino_cache+0x8c/0x1c0 fs/jffs2/scan.c:978
 jffs2_sum_process_sum_data fs/jffs2/summary.c:467 [inline]
 jffs2_sum_scan_sumnode+0x5ec/0x20d0 fs/jffs2/summary.c:640
 jffs2_scan_eraseblock fs/jffs2/scan.c:546 [inline]
 jffs2_scan_medium+0x610/0x5bc8 fs/jffs2/scan.c:151
 jffs2_build_filesystem fs/jffs2/build.c:112 [inline]
 jffs2_do_mount_fs+0x5dc/0x1c28 fs/jffs2/build.c:416
 jffs2_do_fill_super+0x484/0xa20 fs/jffs2/fs.c:573
 jffs2_fill_super+0x258/0x28c fs/jffs2/super.c:289
 mtd_get_sb+0xc4/0x2a0 drivers/mtd/mtdsuper.c:80
 mtd_get_sb_by_nr+0x94/0xb0 drivers/mtd/mtdsuper.c:111
 get_tree_mtd+0x4bc/0x61c drivers/mtd/mtdsuper.c:164
 jffs2_get_tree+0x28/0x38 fs/jffs2/super.c:294
 vfs_get_tree+0x90/0x278 fs/super.c:1584
 do_new_mount+0x228/0x804 fs/namespace.c:3078
 path_mount+0x5ac/0xe6c fs/namespace.c:3408
 do_mount fs/namespace.c:3421 [inline]
 __do_sys_mount fs/namespace.c:3629 [inline]
 __se_sys_mount fs/namespace.c:3606 [inline]
 __arm64_sys_mount+0x4a0/0x5a0 fs/namespace.c:3606
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000f022bc00
 which belongs to the cache jffs2_inode_cache of size 48
The buggy address is located 40 bytes inside of
 48-byte region [ffff0000f022bc00, ffff0000f022bc30)

The buggy address belongs to the physical page:
page:00000000e2ebaa61 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000f022bfc0 pfn:0x13022b
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 fffffc0003a4bcc8 fffffc0003b81f48 ffff0000c4cb7b00
raw: ffff0000f022bfc0 0000000000400001 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f022bb00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
 ffff0000f022bb80: fa fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
>ffff0000f022bc00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
                                  ^
 ffff0000f022bc80: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
 ffff0000f022bd00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
==================================================================

final repro crashed as (corrupted=false):
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================
BUG: KASAN: use-after-free in jffs2_xattr_delete_inode+0x274/0x278 fs/jffs2/xattr.c:602
Read of size 4 at addr ffff0000f022bc28 by task syz.0.243/5050

CPU: 0 PID: 5050 Comm: syz.0.243 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load4_noabort+0x2c/0x38 mm/kasan/report_generic.c:350
 jffs2_xattr_delete_inode+0x274/0x278 fs/jffs2/xattr.c:602
 jffs2_do_clear_inode+0x58/0x348 fs/jffs2/readinode.c:1418
 jffs2_evict_inode+0x7c/0x90 fs/jffs2/fs.c:250
 evict+0x3d8/0x824 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x728/0x7e8 fs/inode.c:1860
 jffs2_new_inode+0x358/0xa54 fs/jffs2/fs.c:-1
 jffs2_create+0x88/0x288 fs/jffs2/dir.c:180
 lookup_open fs/namei.c:3533 [inline]
 open_last_lookups fs/namei.c:3601 [inline]
 path_openat+0xda8/0x27a0 fs/namei.c:3831
 do_filp_open+0x198/0x38c fs/namei.c:3861
 do_sys_openat2+0x134/0x3fc fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4702:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x430 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x234/0x310 mm/slub.c:3383
 jffs2_alloc_inode_cache+0x20/0x2c fs/jffs2/malloc.c:265
 jffs2_scan_make_ino_cache+0x8c/0x1c0 fs/jffs2/scan.c:978
 jffs2_sum_process_sum_data fs/jffs2/summary.c:467 [inline]
 jffs2_sum_scan_sumnode+0x5ec/0x20d0 fs/jffs2/summary.c:640
 jffs2_scan_eraseblock fs/jffs2/scan.c:546 [inline]
 jffs2_scan_medium+0x610/0x5bc8 fs/jffs2/scan.c:151
 jffs2_build_filesystem fs/jffs2/build.c:112 [inline]
 jffs2_do_mount_fs+0x5dc/0x1c28 fs/jffs2/build.c:416
 jffs2_do_fill_super+0x484/0xa20 fs/jffs2/fs.c:573
 jffs2_fill_super+0x258/0x28c fs/jffs2/super.c:289
 mtd_get_sb+0xc4/0x2a0 drivers/mtd/mtdsuper.c:80
 mtd_get_sb_by_nr+0x94/0xb0 drivers/mtd/mtdsuper.c:111
 get_tree_mtd+0x4bc/0x61c drivers/mtd/mtdsuper.c:164
 jffs2_get_tree+0x28/0x38 fs/jffs2/super.c:294
 vfs_get_tree+0x90/0x278 fs/super.c:1584
 do_new_mount+0x228/0x804 fs/namespace.c:3078
 path_mount+0x5ac/0xe6c fs/namespace.c:3408
 do_mount fs/namespace.c:3421 [inline]
 __do_sys_mount fs/namespace.c:3629 [inline]
 __se_sys_mount fs/namespace.c:3606 [inline]
 __arm64_sys_mount+0x4a0/0x5a0 fs/namespace.c:3606
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000f022bc00
 which belongs to the cache jffs2_inode_cache of size 48
The buggy address is located 40 bytes inside of
 48-byte region [ffff0000f022bc00, ffff0000f022bc30)

The buggy address belongs to the physical page:
page:00000000e2ebaa61 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000f022bfc0 pfn:0x13022b
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 fffffc0003a4bcc8 fffffc0003b81f48 ffff0000c4cb7b00
raw: ffff0000f022bfc0 0000000000400001 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f022bb00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
 ffff0000f022bb80: fa fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
>ffff0000f022bc00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
                                  ^
 ffff0000f022bc80: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
 ffff0000f022bd00: fb fb fb fb fb fb fc fc fb fb fb fb fb fb fc fc
==================================================================