Extracting prog: 38.378088295s
Minimizing prog: 20m49.682265103s
Simplifying prog options: 2m30.4893294s
Extracting C: 37.664531542s
Simplifying C: 0s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-openat-fstat-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-read$FUSE-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
r11 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0)
fstat(r11, 0x0) (async)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r11, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
read$FUSE(r8, &(0x7f0000000e00)={0x2020}, 0x2020) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: UBSAN: shift-out-of-bounds in __radix_tree_lookup
single: successfully extracted reproducer
found reproducer with 26 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-openat-fstat-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-read$FUSE-execveat$binfmt
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
r11 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0)
fstat(r11, 0x0) (async)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r11, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
read$FUSE(r8, &(0x7f0000000e00)={0x2020}, 0x2020) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-openat-fstat-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-read$FUSE-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
r11 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0)
fstat(r11, 0x0) (async)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r11, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
read$FUSE(r8, &(0x7f0000000e00)={0x2020}, 0x2020) (async)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-openat-fstat-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
r11 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0)
fstat(r11, 0x0) (async)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r11, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: BUG: unable to handle kernel paging request in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-openat-fstat-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
r11 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0)
fstat(r11, 0x0) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-openat-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
r11 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r11, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: BUG: unable to handle kernel paging request in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r9 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r10 = getpid()
sched_setaffinity(r10, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r10, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: UBSAN: shift-out-of-bounds in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-ioctl$SNDRV_CTL_IOCTL_ELEM_INFO-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
r8 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r9 = getpid()
sched_setaffinity(r9, 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r8, 0xc1105511, &(0x7f00000003c0)={{0x3, 0x4, 0xa0d2, 0x101, 'syz0\x00', 0x1ec}, 0x6, 0x3, 0x4, r9, 0x3, 0x400, 'syz0\x00', &(0x7f0000000380)=['\x00', '-(/-\x00', '+%)\'%/-[&-\x00'], 0x11}) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
r9 = getpid()
sched_setaffinity(r9, 0x0, 0x0)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: KASAN: use-after-free Read in tick_nohz_handler
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-getpid-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
getpid()
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-syz_open_dev$sndctrl-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x40000) (async)
sched_setaffinity(0x0, 0x0, 0x0)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: BUG: unable to handle kernel paging request in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: general protection fault in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-mount-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mkdirat-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-ioctl$KVM_SET_MSRS-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r6 = dup(r5)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r6, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r7=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000100)={r7, 0x2}) (async)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f1, 0x0, 0x6}]}) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r8, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-ioctl$DRM_IOCTL_AGP_UNBIND-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r5 = dup(r4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r5, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, <r6=>0x0, 0x1}) (rerun: 64)
ioctl$DRM_IOCTL_AGP_UNBIND(r5, 0x40106437, &(0x7f0000000100)={r6, 0x2}) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r7, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: KASAN: use-after-free Read in tick_nohz_handler
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-ioctl$DRM_IOCTL_AGP_ALLOC-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r5 = dup(r4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r5, 0x7c1f1000) (async, rerun: 64)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x5ebf3503, 0x0, 0x1}) (rerun: 64)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r6, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: UBSAN: shift-out-of-bounds in xa_load
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mmap-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
r5 = dup(r4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r5, 0x7c1f1000) (async, rerun: 64)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r6, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: BUG: unable to handle kernel paging request in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-dup-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
dup(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r5, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: general protection fault in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$nullb-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r4, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: general protection fault in kick_pool_pick
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r4, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r3, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: general protection fault in lookup_noperm_common
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-openat$kvm-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe01, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r3, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(r2)

program crashed: BUG: unable to handle kernel NULL pointer dereference in stack_depot_save_flags
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r2, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: general protection fault in __run_timers
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r1, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000000b40)='./file1\x00')
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r1, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: KASAN: use-after-free Read in timerqueue_linked_add
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d) (async, rerun: 64)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}}) (async)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: BUG: unable to handle kernel paging request in __run_timers
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: BUG: unable to handle kernel paging request in rcu_cblist_dequeue
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, 0x0, 0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240), 0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, &(0x7f0000000300)={@desc={0x1, 0x0, @auto="547cd96c7f43f3f6"}})
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: KASAN: use-after-free Write in __remove_hrtimer
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000)
close(0xffffffffffffffff)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
program crashed: general protection fault in rcu_core
a never seen crash title: general protection fault in rcu_core, ignore
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: UBSAN: shift-out-of-bounds in xa_load
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
program did not crash
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: BUG: unable to handle kernel paging request in skb_release_data
a never seen crash title: BUG: unable to handle kernel paging request in skb_release_data, ignore
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: KASAN: null-ptr-deref Read in nsim_dev_trap_report_work
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: general protection fault in cpuacct_account_field
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): close-mkdirat-mount-openat-sched_setaffinity-write-ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY-execveat$binfmt-close
detailed listing:
executing program 0:
close(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write(r0, &(0x7f0000000240)="e4b0cd06c5c81d66a430daf8eb3506e4a069c3de1af28e1803e2c6759e1a3bae6f8fc0cc4ecd08b554e2170a6e67a9f0d86cd0dc255e741093a0358b00cdd8d583590f5be7a22e857772693ce4423c6f87483b8410f2d5fe7670cd57f41c2b9fcbe1e54cd2eda241f01d1009ad03d2edc0a62424b7db8a4f01c0750935", 0x7d)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000dc0)={[], 0xf000}, 0x1000)
close(0xffffffffffffffff)

program crashed: BUG: unable to handle kernel paging request in __run_timers
validation run: crashed=true
reproducing took 27m14.060842263s
repro crashed as (corrupted=false):
BUG: unable to handle page fault for address: ffffffffffffffff
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD fd99067 P4D fd99067 PUD fd9b067 PMD 0 
Oops: Oops: 0002 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__hlist_del include/linux/list.h:1045 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:892 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1783 [inline]
RIP: 0010:__run_timers+0x68a/0xb00 kernel/time/timer.c:2375
Code: 8b 3b 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 08 03 00 00 48 8b 43 08 48 89 c2 48 c1 ea 03 42 80 3c 22 00 0f 85 db 02 00 00 <4c> 89 38 48 89 44 24 08 4d 85 ff 74 24 e8 54 50 15 00 49 8d 7f 08
RSP: 0018:ffffc90000658d48 EFLAGS: 00010046
RAX: ffffffffffffffff RBX: ffff8880456d98d8 RCX: 0000000000000102
RDX: 1fffffffffffffff RSI: ffffffff81f92b99 RDI: ffff8880456d98e0
RBP: ffffc90000658e08 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff926ab25f R11: 0000000000000001 R12: dffffc0000000000
R13: fffff520000cb1c1 R14: ffff88806a2266c0 R15: ffffffffffffffff
FS:  0000000000000000(0000) GS:ffff8880d4675000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffff CR3: 0000000059bd9000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __run_timer_base kernel/time/timer.c:2387 [inline]
 __run_timer_base kernel/time/timer.c:2379 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2396
 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2406
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 __do_softirq kernel/softirq.c:703 [inline]
 invoke_softirq kernel/softirq.c:542 [inline]
 __irq_exit_rcu+0x178/0x220 kernel/softirq.c:786
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 67 a0 02 e9 43 61 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 6d 1c 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197e00 EFLAGS: 00000206
RAX: 000000000004ea47 RBX: ffff888020aba580 RCX: ffffffff8bef5325
RDX: 0000000000000001 RSI: ffffffff8e629989 RDI: ffffffff8c835980
RBP: ffffed10041574b0 R08: 0000000000000001 R09: ffffed100d446825
R10: ffff88806a23412b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:458
 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x158
 </TASK>
Modules linked in:
CR2: ffffffffffffffff
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	8b 3b                	mov    (%rbx),%edi
   2:	48 89 f8             	mov    %rdi,%rax
   5:	48 c1 e8 03          	shr    $0x3,%rax
   9:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
   e:	0f 85 08 03 00 00    	jne    0x31c
  14:	48 8b 43 08          	mov    0x8(%rbx),%rax
  18:	48 89 c2             	mov    %rax,%rdx
  1b:	48 c1 ea 03          	shr    $0x3,%rdx
  1f:	42 80 3c 22 00       	cmpb   $0x0,(%rdx,%r12,1)
  24:	0f 85 db 02 00 00    	jne    0x305
* 2a:	4c 89 38             	mov    %r15,(%rax) <-- trapping instruction
  2d:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  32:	4d 85 ff             	test   %r15,%r15
  35:	74 24                	je     0x5b
  37:	e8 54 50 15 00       	call   0x155090
  3c:	49 8d 7f 08          	lea    0x8(%r15),%rdi

final repro crashed as (corrupted=false):
BUG: unable to handle page fault for address: ffffffffffffffff
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD fd99067 P4D fd99067 PUD fd9b067 PMD 0 
Oops: Oops: 0002 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__hlist_del include/linux/list.h:1045 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:892 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1783 [inline]
RIP: 0010:__run_timers+0x68a/0xb00 kernel/time/timer.c:2375
Code: 8b 3b 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 08 03 00 00 48 8b 43 08 48 89 c2 48 c1 ea 03 42 80 3c 22 00 0f 85 db 02 00 00 <4c> 89 38 48 89 44 24 08 4d 85 ff 74 24 e8 54 50 15 00 49 8d 7f 08
RSP: 0018:ffffc90000658d48 EFLAGS: 00010046
RAX: ffffffffffffffff RBX: ffff8880456d98d8 RCX: 0000000000000102
RDX: 1fffffffffffffff RSI: ffffffff81f92b99 RDI: ffff8880456d98e0
RBP: ffffc90000658e08 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff926ab25f R11: 0000000000000001 R12: dffffc0000000000
R13: fffff520000cb1c1 R14: ffff88806a2266c0 R15: ffffffffffffffff
FS:  0000000000000000(0000) GS:ffff8880d4675000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffff CR3: 0000000059bd9000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __run_timer_base kernel/time/timer.c:2387 [inline]
 __run_timer_base kernel/time/timer.c:2379 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2396
 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2406
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 __do_softirq kernel/softirq.c:703 [inline]
 invoke_softirq kernel/softirq.c:542 [inline]
 __irq_exit_rcu+0x178/0x220 kernel/softirq.c:786
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 67 a0 02 e9 43 61 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 6d 1c 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197e00 EFLAGS: 00000206
RAX: 000000000004ea47 RBX: ffff888020aba580 RCX: ffffffff8bef5325
RDX: 0000000000000001 RSI: ffffffff8e629989 RDI: ffffffff8c835980
RBP: ffffed10041574b0 R08: 0000000000000001 R09: ffffed100d446825
R10: ffff88806a23412b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:458
 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x158
 </TASK>
Modules linked in:
CR2: ffffffffffffffff
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	8b 3b                	mov    (%rbx),%edi
   2:	48 89 f8             	mov    %rdi,%rax
   5:	48 c1 e8 03          	shr    $0x3,%rax
   9:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
   e:	0f 85 08 03 00 00    	jne    0x31c
  14:	48 8b 43 08          	mov    0x8(%rbx),%rax
  18:	48 89 c2             	mov    %rax,%rdx
  1b:	48 c1 ea 03          	shr    $0x3,%rdx
  1f:	42 80 3c 22 00       	cmpb   $0x0,(%rdx,%r12,1)
  24:	0f 85 db 02 00 00    	jne    0x305
* 2a:	4c 89 38             	mov    %r15,(%rax) <-- trapping instruction
  2d:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  32:	4d 85 ff             	test   %r15,%r15
  35:	74 24                	je     0x5b
  37:	e8 54 50 15 00       	call   0x155090
  3c:	49 8d 7f 08          	lea    0x8(%r15),%rdi