Extracting prog: 4m53.256649269s Minimizing prog: 35m42.176316001s Simplifying prog options: 0s Extracting C: 1m3.209311977s Simplifying C: 6m12.173590819s extracting reproducer from 12 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash single: failed to extract reproducer bisect: bisecting 12 programs with base timeout 45s testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 5, 1, 12, 7, 3, 2, 4, 2, 3, 4] detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/tracing_on\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/available_filter_functions\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./trace/set_ftrace_filter\x00', 0x2, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/kernel/panic_on_warn\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n\x00', 0x2) close(r0) executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="210000000000000000000000010000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000"], 0x48) executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="0102030405060708090a0b0c0d0e0f10", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="00112233445566778899aabbccddeeff", 0x10}], 0x1, &(0x7f0000000300)=[@op={0x0, 0x117, 0x3, 0x1}, @iv={0x0, 0x117, 0x2, 0x8, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}, 0x0) read$alg(r1, &(0x7f0000000400)=""/16, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000500)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000600)="0102030405060708090a0b0c0d0e0f10", 0x10) r3 = accept$alg(r2, 0x0, 0x0) sendmsg$alg(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000640)="00112233445566778899aabbccddeeff", 0x10}], 0x1, &(0x7f0000000800)=[@op={0x0, 0x117, 0x3, 0x1}, @iv={0x0, 0x117, 0x2, 0x8, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}, 0x0) read$alg(r3, &(0x7f0000000900)=""/16, 0x10) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/mem_sleep\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='deep', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/mem_sleep\x00', 0x0, 0x0) read(r1, &(0x7f0000000240)=""/64, 0x40) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000300)='./debug\x00', &(0x7f0000000400)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/boot_params\x00', 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x26) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/state\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='disk\n\x00', 0x5) executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r0, 0x40043311, &(0x7f0000000100)) executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) close(r0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program crashed: Internal error in mtd_read_oob_std single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program crashed: Internal error in mtd_read_oob_std testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=3m2.920583148s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std simplifying C reproducer testing compiled C program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std testing compiled C program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std testing compiled C program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std testing compiled C program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std testing compiled C program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std testing compiled C program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: Internal error in mtd_read_oob_std testing program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program crashed: Internal error in mtd_read_oob_std validation run: crashed=true testing program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program crashed: Internal error in mtd_read_oob_std validation run: crashed=true testing program (duration=3m2.920583148s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='test,0x400000000,1Gi\x00', 0x15) program crashed: Internal error in mtd_read_oob_std validation run: crashed=true reproducing took 53m39.677154374s repro crashed as (corrupted=false): Internal error: synchronous external abort: 0000000096000010 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 3667 Comm: syz.2.17 Tainted: G M syzkaller #0 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: linux,dummy-virt (DT) pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __memcpy+0xc/0x44 arch/arm64/lib/memcpy.S:251 lr : phram_read+0x28/0x40 drivers/mtd/devices/phram.c:70 sp : ffff800086b037c0 x29: ffff800086b037c0 x28: f7f000000abc9000 x27: 0000000000000000 x26: 0000000000003030 x25: 0000000000002000 x24: 0000000000000000 x23: 0000000000000000 x22: 0000000000000000 x21: ffff800086b03830 x20: ffff800086b03840 x19: 0000000000000044 x18: 00000000ffffffff x17: 0000000000000000 x16: 0000000000000000 x15: fdf0000005764280 x14: fdf00000072e8080 x13: 00000000000002c6 x12: 0000001520b64b88 x11: fdf00000072e8080 x10: fff000007f8c15c0 x9 : 0000000000000000 x8 : 0000000000000000 x7 : dead000000000122 x6 : 0000000000000000 x5 : ffff8000c0000000 x4 : ffff800086b038e4 x3 : ffff800086b038e4 x2 : 0000000000000044 x1 : ffff8000c0000000 x0 : ffff800086b038e4 Call trace: __memcpy+0xc/0x44 arch/arm64/lib/memcpy.S:250 (P) mtd_read_oob_std+0x84/0x9c drivers/mtd/mtdcore.c:1702 mtd_read_oob+0x8c/0x15c drivers/mtd/mtdcore.c:1811 mtd_read+0x68/0xc4 drivers/mtd/mtdcore.c:1603 scan_header drivers/mtd/ftl.c:164 [inline] ftl_add_mtd+0xec/0x6a8 drivers/mtd/ftl.c:1017 blktrans_notify_add drivers/mtd/mtd_blkdevs.c:464 [inline] blktrans_notify_add+0x50/0x74 drivers/mtd/mtd_blkdevs.c:456 add_mtd_device+0x45c/0x7a8 drivers/mtd/mtdcore.c:828 mtd_device_parse_register+0x294/0x35c drivers/mtd/mtdcore.c:1156 register_device+0x104/0x260 drivers/mtd/devices/phram.c:162 phram_setup+0x16c/0x2a0 drivers/mtd/devices/phram.c:324 phram_param_call+0x60/0x84 drivers/mtd/devices/phram.c:349 param_attr_store+0xa4/0x100 kernel/params.c:591 module_attr_store+0x24/0x40 kernel/params.c:906 sysfs_kf_write+0x7c/0x98 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x138/0x200 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x244/0x36c fs/read_write.c:687 ksys_write+0x70/0x108 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x18/0x24 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 Code: d65f03c0 d503245f d503201f aa0003e3 (1d010443) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: d65f03c0 ret 4: d503245f bti c 8: d503201f nop c: aa0003e3 mov x3, x0 * 10: 1d010443 cpyp [x3]!, [x1]!, x2! <-- trapping instruction final repro crashed as (corrupted=false): Internal error: synchronous external abort: 0000000096000010 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 3667 Comm: syz.2.17 Tainted: G M syzkaller #0 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: linux,dummy-virt (DT) pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __memcpy+0xc/0x44 arch/arm64/lib/memcpy.S:251 lr : phram_read+0x28/0x40 drivers/mtd/devices/phram.c:70 sp : ffff800086b037c0 x29: ffff800086b037c0 x28: f7f000000abc9000 x27: 0000000000000000 x26: 0000000000003030 x25: 0000000000002000 x24: 0000000000000000 x23: 0000000000000000 x22: 0000000000000000 x21: ffff800086b03830 x20: ffff800086b03840 x19: 0000000000000044 x18: 00000000ffffffff x17: 0000000000000000 x16: 0000000000000000 x15: fdf0000005764280 x14: fdf00000072e8080 x13: 00000000000002c6 x12: 0000001520b64b88 x11: fdf00000072e8080 x10: fff000007f8c15c0 x9 : 0000000000000000 x8 : 0000000000000000 x7 : dead000000000122 x6 : 0000000000000000 x5 : ffff8000c0000000 x4 : ffff800086b038e4 x3 : ffff800086b038e4 x2 : 0000000000000044 x1 : ffff8000c0000000 x0 : ffff800086b038e4 Call trace: __memcpy+0xc/0x44 arch/arm64/lib/memcpy.S:250 (P) mtd_read_oob_std+0x84/0x9c drivers/mtd/mtdcore.c:1702 mtd_read_oob+0x8c/0x15c drivers/mtd/mtdcore.c:1811 mtd_read+0x68/0xc4 drivers/mtd/mtdcore.c:1603 scan_header drivers/mtd/ftl.c:164 [inline] ftl_add_mtd+0xec/0x6a8 drivers/mtd/ftl.c:1017 blktrans_notify_add drivers/mtd/mtd_blkdevs.c:464 [inline] blktrans_notify_add+0x50/0x74 drivers/mtd/mtd_blkdevs.c:456 add_mtd_device+0x45c/0x7a8 drivers/mtd/mtdcore.c:828 mtd_device_parse_register+0x294/0x35c drivers/mtd/mtdcore.c:1156 register_device+0x104/0x260 drivers/mtd/devices/phram.c:162 phram_setup+0x16c/0x2a0 drivers/mtd/devices/phram.c:324 phram_param_call+0x60/0x84 drivers/mtd/devices/phram.c:349 param_attr_store+0xa4/0x100 kernel/params.c:591 module_attr_store+0x24/0x40 kernel/params.c:906 sysfs_kf_write+0x7c/0x98 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x138/0x200 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x244/0x36c fs/read_write.c:687 ksys_write+0x70/0x108 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x18/0x24 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590 Code: d65f03c0 d503245f d503201f aa0003e3 (1d010443) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: d65f03c0 ret 4: d503245f bti c 8: d503201f nop c: aa0003e3 mov x3, x0 * 10: 1d010443 cpyp [x3]!, [x1]!, x2! <-- trapping instruction