Extracting prog: 1m13.569894077s Minimizing prog: 5m23.772341102s Simplifying prog options: 0s Extracting C: 26.632395127s Simplifying C: 2m51.476408954s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program crashed: UBSAN: shift-out-of-bounds in verity_ctr single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(0xffffffffffffffff, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: ioctl$DM_DEV_CREATE(0xffffffffffffffff, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r0}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD program crashed: UBSAN: shift-out-of-bounds in verity_ctr testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program crashed: UBSAN: shift-out-of-bounds in verity_ctr validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program crashed: UBSAN: shift-out-of-bounds in verity_ctr validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-openat$dm_control-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000780)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88400, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000008c0), 0x88841, 0x0) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000900)={0x4, 0x0, 0x0, 0x298, 0x138, 0x1, 0x0, 0x25411, 0x0, 0x0, @by_dev={r1}, [@verity={0x0, 0xc48, 0x0, 0x160, 'verity\x00', {'1', 0x20, @ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x0}, 0x20, '1024', 0x20, '4096', 0x20, 0x1000200000000061, 0x20, 0xfa, 0x20, 'sha512', 0x20, @fixed='0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 0x20, @hex=@hex16=[0x34, 0x66, 0x38, 0x35, 0x39, 0x38, 0x38, 0x35, 0x37, 0x33, 0x37, 0x33, 0x33, 0x34, 0x0, 0x63, 0x31, 0x37, 0x61, 0x35, 0x66, 0x61, 0x37, 0x30, 0x62, 0x63, 0x33, 0x36, 0x38, 0x32, 0x65, 0x66], ' 2 ignore_zero_blocks check_at_most_once'}}]}) program crashed: UBSAN: shift-out-of-bounds in verity_ctr validation run: crashed=true reproducing took 11m38.765513806s repro crashed as (corrupted=false): device-mapper: verity: sha512 using shash "sha512-avx2" ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/md/dm-verity-target.c:1758:38 shift exponent 66 is too large for 64-bit type 'sector_t' (aka 'unsigned long long') CPU: 1 UID: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231 __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:468 verity_ctr+0x124c/0x1d00 drivers/md/dm-verity-target.c:1758 dm_table_add_target+0x59f/0xcb0 drivers/md/dm-table.c:760 populate_table drivers/md/dm-ioctl.c:1494 [inline] table_load+0x2eb/0x7d0 drivers/md/dm-ioctl.c:1536 ctl_ioctl drivers/md/dm-ioctl.c:2107 [inline] dm_ctl_ioctl+0x8f3/0xde0 drivers/md/dm-ioctl.c:2129 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0x123/0x1b0 fs/ioctl.c:892 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:892 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f24d879fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4ef9ad28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f24d8a25fa0 RCX: 00007f24d879fb19 RDX: 0000200000000900 RSI: 00000000c138fd09 RDI: 0000000000000004 RBP: 00007f24d8837b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f24d8a25fac R14: 00007f24d8a25fa0 R15: 00007f24d8a25fa0 ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/md/dm-verity-target.c:1759:6 shift exponent 66 is too large for 64-bit type 'sector_t' (aka 'unsigned long long') CPU: 1 UID: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231 __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:468 verity_ctr+0x128b/0x1d00 drivers/md/dm-verity-target.c:1759 dm_table_add_target+0x59f/0xcb0 drivers/md/dm-table.c:760 populate_table drivers/md/dm-ioctl.c:1494 [inline] table_load+0x2eb/0x7d0 drivers/md/dm-ioctl.c:1536 ctl_ioctl drivers/md/dm-ioctl.c:2107 [inline] dm_ctl_ioctl+0x8f3/0xde0 drivers/md/dm-ioctl.c:2129 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0x123/0x1b0 fs/ioctl.c:892 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:892 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f24d879fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4ef9ad28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f24d8a25fa0 RCX: 00007f24d879fb19 RDX: 0000200000000900 RSI: 00000000c138fd09 RDI: 0000000000000004 RBP: 00007f24d8837b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f24d8a25fac R14: 00007f24d8a25fa0 R15: 00007f24d8a25fa0 ---[ end trace ]--- device-mapper: table: 252:0: verity: Hash device is too small (-E2BIG) device-mapper: ioctl: error adding target to table final repro crashed as (corrupted=false): device-mapper: verity: sha512 using shash "sha512-avx2" ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/md/dm-verity-target.c:1758:38 shift exponent 66 is too large for 64-bit type 'sector_t' (aka 'unsigned long long') CPU: 1 UID: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231 __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:468 verity_ctr+0x124c/0x1d00 drivers/md/dm-verity-target.c:1758 dm_table_add_target+0x59f/0xcb0 drivers/md/dm-table.c:760 populate_table drivers/md/dm-ioctl.c:1494 [inline] table_load+0x2eb/0x7d0 drivers/md/dm-ioctl.c:1536 ctl_ioctl drivers/md/dm-ioctl.c:2107 [inline] dm_ctl_ioctl+0x8f3/0xde0 drivers/md/dm-ioctl.c:2129 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0x123/0x1b0 fs/ioctl.c:892 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:892 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f24d879fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4ef9ad28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f24d8a25fa0 RCX: 00007f24d879fb19 RDX: 0000200000000900 RSI: 00000000c138fd09 RDI: 0000000000000004 RBP: 00007f24d8837b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f24d8a25fac R14: 00007f24d8a25fa0 R15: 00007f24d8a25fa0 ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/md/dm-verity-target.c:1759:6 shift exponent 66 is too large for 64-bit type 'sector_t' (aka 'unsigned long long') CPU: 1 UID: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 ubsan_epilogue+0xe/0x40 lib/ubsan.c:231 __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:468 verity_ctr+0x128b/0x1d00 drivers/md/dm-verity-target.c:1759 dm_table_add_target+0x59f/0xcb0 drivers/md/dm-table.c:760 populate_table drivers/md/dm-ioctl.c:1494 [inline] table_load+0x2eb/0x7d0 drivers/md/dm-ioctl.c:1536 ctl_ioctl drivers/md/dm-ioctl.c:2107 [inline] dm_ctl_ioctl+0x8f3/0xde0 drivers/md/dm-ioctl.c:2129 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0x123/0x1b0 fs/ioctl.c:892 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:892 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f24d879fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4ef9ad28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f24d8a25fa0 RCX: 00007f24d879fb19 RDX: 0000200000000900 RSI: 00000000c138fd09 RDI: 0000000000000004 RBP: 00007f24d8837b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f24d8a25fac R14: 00007f24d8a25fa0 R15: 00007f24d8a25fa0 ---[ end trace ]--- device-mapper: table: 252:0: verity: Hash device is too small (-E2BIG) device-mapper: ioctl: error adding target to table