Extracting prog: 1m7.948013436s Minimizing prog: 3m57.892654841s Simplifying prog options: 5m49.685523275s Extracting C: 1m11.18902142s Simplifying C: 0s extracting reproducer from 52 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program crashed: WARNING in init_timer_key single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=40.575063658s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket detailed listing: executing program 0: setns(0xc9, 0x0) socket(0x8, 0x5, 0x5) program did not crash testing program (duration=40.575063658s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x61d0, 0x0) program did not crash testing program (duration=40.575063658s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=40.575063658s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ program did not crash simplifying guilty program options testing program (duration=40.575063658s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program crashed: WARNING in init_timer_key extracting C reproducer testing compiled C program (duration=40.575063658s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ program did not crash testing program (duration=40.575063658s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program did not crash testing program (duration=40.575063658s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program did not crash testing program (duration=40.575063658s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program crashed: WARNING in init_timer_key validation run: crashed=true testing program (duration=40.575063658s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program crashed: WARNING in init_timer_key validation run: crashed=true testing program (duration=40.575063658s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-ioctl$sock_inet6_tcp_SIOCINQ detailed listing: executing program 0: setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x61d0, 0x0) program crashed: WARNING in init_timer_key validation run: crashed=true reproducing took 16m31.211128199s repro crashed as (corrupted=false): ------------[ cut here ]------------ ODEBUG: init active (active state 0) object type: timer_list hint: lec_arp_check_expire+0x0/0xa84 net/atm/lec.c:-1 WARNING: CPU: 1 PID: 4526 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline] WARNING: CPU: 1 PID: 4526 at lib/debugobjects.c:518 __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 Modules linked in: CPU: 1 PID: 4526 Comm: syz.0.22 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : debug_print_object lib/debugobjects.c:515 [inline] pc : __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 lr : debug_print_object lib/debugobjects.c:515 [inline] lr : __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 sp : ffff8000217f7840 x29: ffff8000217f7840 x28: dfff800000000000 x27: ffff0000d3a10528 x26: ffff0000f051edb8 x25: 0000000000000000 x24: 0000000000000003 x23: ffff800011d0b280 x22: ffff8000121e2a80 x21: ffff800011018fcc x20: ffff800011d0b280 x19: ffff0000f051edb8 x18: 1fffe00033e7697e x17: 6e6968207473696c x16: ffff800011b90080 x15: 6570797420746365 x14: 0000000000000001 x13: 1fffe00033e769a3 x12: 0000000000000000 x11: ff00800008195f70 x10: 0000000000000000 x9 : 8e4d30662443b500 x8 : 8e4d30662443b500 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000217f72d8 x4 : ffff800015464e80 x3 : ffff800008540904 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: debug_print_object lib/debugobjects.c:515 [inline] __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 debug_object_init+0x20/0x2c lib/debugobjects.c:708 debug_timer_init kernel/time/timer.c:777 [inline] debug_init kernel/time/timer.c:825 [inline] init_timer_key+0x54/0x4a8 kernel/time/timer.c:869 lec_arp_init net/atm/lec.c:1274 [inline] lecd_attach net/atm/lec.c:781 [inline] lane_ioctl+0x1214/0x1cd8 net/atm/lec.c:1037 do_vcc_ioctl+0x300/0xe54 net/atm/ioctl.c:159 vcc_ioctl+0x38/0x4c net/atm/ioctl.c:220 sock_do_ioctl+0x100/0x258 net/socket.c:1202 sock_ioctl+0x234/0x828 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 1452 hardirqs last enabled at (1451): [] __up_console_sem+0xb4/0xfc kernel/printk/printk.c:261 hardirqs last disabled at (1452): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (1370): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (1368): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- lec:lec_atm_close: lec0: Shut down! final repro crashed as (corrupted=false): ------------[ cut here ]------------ ODEBUG: init active (active state 0) object type: timer_list hint: lec_arp_check_expire+0x0/0xa84 net/atm/lec.c:-1 WARNING: CPU: 1 PID: 4526 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline] WARNING: CPU: 1 PID: 4526 at lib/debugobjects.c:518 __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 Modules linked in: CPU: 1 PID: 4526 Comm: syz.0.22 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : debug_print_object lib/debugobjects.c:515 [inline] pc : __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 lr : debug_print_object lib/debugobjects.c:515 [inline] lr : __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 sp : ffff8000217f7840 x29: ffff8000217f7840 x28: dfff800000000000 x27: ffff0000d3a10528 x26: ffff0000f051edb8 x25: 0000000000000000 x24: 0000000000000003 x23: ffff800011d0b280 x22: ffff8000121e2a80 x21: ffff800011018fcc x20: ffff800011d0b280 x19: ffff0000f051edb8 x18: 1fffe00033e7697e x17: 6e6968207473696c x16: ffff800011b90080 x15: 6570797420746365 x14: 0000000000000001 x13: 1fffe00033e769a3 x12: 0000000000000000 x11: ff00800008195f70 x10: 0000000000000000 x9 : 8e4d30662443b500 x8 : 8e4d30662443b500 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000217f72d8 x4 : ffff800015464e80 x3 : ffff800008540904 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: debug_print_object lib/debugobjects.c:515 [inline] __debug_object_init+0x2c8/0x434 lib/debugobjects.c:692 debug_object_init+0x20/0x2c lib/debugobjects.c:708 debug_timer_init kernel/time/timer.c:777 [inline] debug_init kernel/time/timer.c:825 [inline] init_timer_key+0x54/0x4a8 kernel/time/timer.c:869 lec_arp_init net/atm/lec.c:1274 [inline] lecd_attach net/atm/lec.c:781 [inline] lane_ioctl+0x1214/0x1cd8 net/atm/lec.c:1037 do_vcc_ioctl+0x300/0xe54 net/atm/ioctl.c:159 vcc_ioctl+0x38/0x4c net/atm/ioctl.c:220 sock_do_ioctl+0x100/0x258 net/socket.c:1202 sock_ioctl+0x234/0x828 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 1452 hardirqs last enabled at (1451): [] __up_console_sem+0xb4/0xfc kernel/printk/printk.c:261 hardirqs last disabled at (1452): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (1370): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (1368): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- lec:lec_atm_close: lec0: Shut down!