Extracting prog: 14m1.314967022s
Minimizing prog: 51m57.879565655s
Simplifying prog options: 9m23.014044702s
Extracting C: 2m57.567683049s
Simplifying C: 0s


extracting reproducer from 25 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/failslab/verbose\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='N\x00', 0x2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$xdp-setsockopt$XDP_UMEM_REG-setsockopt$XDP_TX_RING-setsockopt$XDP_UMEM_COMPLETION_RING-setsockopt$XDP_UMEM_FILL_RING-socketpair$unix-ioctl$sock_SIOCGIFINDEX-bind$xdp-mmap$xdp-pipe2-write-read-sendmsg$xdp
detailed listing:
executing program 0:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000100000)=""/65536, 0x10000, 0x800}, 0x20)
setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000180)=0x10, 0x4)
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000001c0)=0x10, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000200)=0x10, 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={<r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'lo\x00', <r2=>0x0})
bind$xdp(r0, &(0x7f0000000080)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10)
mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000)
pipe2(&(0x7f0000000400)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write(r4, &(0x7f0000000500)="0100"/336, 0x150)
read(r3, &(0x7f0000000000), 0x150)
sendmsg$xdp(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_NEWLINK-nanosleep-socket$inet_smc-bind$inet-listen-socket$inet_smc-connect$inet-accept$inet-nanosleep-sendmsg$RDMA_NLDEV_CMD_DELLINK-sendmsg$RDMA_NLDEV_CMD_DELLINK-sendmsg$RDMA_NLDEV_CMD_DELLINK-nanosleep
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10)
listen(r1, 0x10)
r2 = socket$inet_smc(0x2b, 0x801, 0x0)
connect$inet(r2, &(0x7f0000000500)={0x2, 0x4e21, @loopback}, 0x10)
accept$inet(r1, 0x0, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000b00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000e00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-socket$rxrpc-sendmsg-sendmsg-nanosleep
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='hello', 0x5}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='bye', 0x3}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x18, 0x110, 0x2, "0100000000000000"}], 0x30}, 0x0)
nanosleep(&(0x7f0000000400)={0x3}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rxrpc-bind$rxrpc-listen-socket$rxrpc-sendmsg-sendmsg-nanosleep
detailed listing:
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='hello', 0x5}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='bye', 0x3}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x18, 0x110, 0x2, "0100000000000000"}], 0x30}, 0x0)
nanosleep(&(0x7f0000000400)={0x3}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 18, 15, 10, 7, 7, 6, 20, 11, 3, 2, 14, 3, 9, 8, 2, 12, 8, 6, 3, 9, 4, 13, 14]
detailed listing:
executing program 0:
r0 = socket$inet(0x2, 0x1, 0x6)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4001, @loopback}, 0x10)
write(r0, &(0x7f0000000100)="00000000000000000000000000000000000000000000400100000000000000000800"/48, 0x30)
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
connect$rxrpc(r1, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
sendmsg(r1, &(0x7f0000000200)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24, &(0x7f0000000300)=[{&(0x7f0000000340)='hello\x00', 0x6}], 0x1, &(0x7f0000000400)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
recvfrom$rxrpc(r0, &(0x7f0000000500), 0x100, 0x40, &(0x7f0000000600)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
executing program 0:
r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(0x0, &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0)
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/fs/nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc/fs/nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/fs/nfsd/ports\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp 2049\n\x00', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/fs/nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1\n\x00', 0x2)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r3, &(0x7f0000000100)="000000010000000000000002000186a30000000300000000000000010000002000"/64, 0x40, 0x0, &(0x7f0000000200)={0x2, 0x7f1, @loopback}, 0x10)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
read(r4, &(0x7f0000000300)=""/100, 0x64)
sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)={0x14, 0x25, 0x301, 0x0, 0x0, {0x2}}, 0x14}}, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)={0x14, 0x25, 0x301, 0x0, 0x0, {0x2}}, 0x14}}, 0x0)
executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10)
listen(r0, 0x5)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r1, &(0x7f0000000020)={0x2, 0x0, @loopback}, 0x10)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10)
r2 = accept(r0, 0x0, 0x0)
sendmsg$inet_sctp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)='hello', 0x5}], 0x1, &(0x7f0000000300)=[@sndrcv={0x20, 0x84, 0x1, {0x0, 0x0, 0x4}}], 0x20}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
recvfrom(r2, &(0x7f0000000500), 0x100, 0x0, 0x0, 0x0)
executing program 0:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='hello', 0x5}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='bye', 0x3}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x18, 0x110, 0x2, "0100000000000000"}], 0x30}, 0x0)
nanosleep(&(0x7f0000000400)={0x3}, 0x0)
executing program 32:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='hello', 0x5}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='bye', 0x3}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x18, 0x110, 0x2, "0100000000000000"}], 0x30}, 0x0)
nanosleep(&(0x7f0000000400)={0x3}, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syz_tun\x00', 0x1000})
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
bind(r1, &(0x7f0000000200)=@in={0x2, 0x4e23, @dev={0xc0, 0xa8, 0x1, 0x1}}, 0x10)
listen(r1, 0x5)
write(r0, &(0x7f0000000300)="00000800450000540000400040840000c0a80102c0a8010110e24e230000000000000000010000380102030400010000000a000a00000000800200240102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20", 0x58)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/sctp/no_checksums\x00', 0x1, 0x0)
write(r1, &(0x7f0000000100)='1\n', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/sctp/addip_enable\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/sctp/addip_noauth_enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='1\n', 0x2)
close(r3)
bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
listen(r0, 0x5)
r4 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r4, &(0x7f0000000280)={0x2, 0x0, @loopback}, 0x10)
connect$inet(r4, &(0x7f00000002c0)={0x2, 0x4e21, @loopback}, 0x10)
accept(r0, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000300)=[@in={0x2, 0x0, @loopback}], 0x10)
sendto$inet(r4, &(0x7f0000000400)="00004e211234567800000000a10000140000000000a1000800010000", 0x1c, 0x0, &(0x7f00000002c0)={0x2, 0x4e21, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='1\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000100)='0\x00', 0x2)
close(r2)
executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="200000003f00010001000000000000000101000000000000080001006f7673300800020000000000"], 0x20}], 0x1}, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=ANY=[@ANYBLOB="440000004100010001000000000000000101000000000000240001001000040001020304050606050403020106000600080000000800030004000000"], 0x44}], 0x1}, 0x0)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="1000000000000000"], 0x10}}, 0x0)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10)
listen(r1, 0x10)
r2 = socket$inet_smc(0x2b, 0x801, 0x0)
connect$inet(r2, &(0x7f0000000500)={0x2, 0x4e21, @loopback}, 0x10)
accept$inet(r1, 0x0, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000b00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000e00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newsa={0x154, 0x10, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0x1234, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x64, 0x12, {{'pcrypt(rfc4106(gcm(aes)))\x00'}, 0xc0, 0x80, '\x00'/24}}]}, 0x154}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@newpolicy={0xfc, 0x13, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@loopback, 0x1234, 0x32}, 0x2, @in=@loopback}]}]}, 0xfc}}, 0x0)
executing program 1:
r0 = socket$inet(0x2, 0x1, 0x6)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x808, @loopback}, 0x10)
listen(r0, 0x5)
syz_clone(0x10000, &(0x7f0000001000), 0x0, &(0x7f0000000100), &(0x7f0000000104), &(0x7f0000000200))
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff)
mount$nfs(&(0x7f0000000080)='127.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,nolock,timeo=10,retrans=1\x00'}]})
r1 = accept$inet(r0, 0x0, 0x0)
read(r1, &(0x7f0000000300), 0x80)
write(r1, &(0x7f0000000400)="80000018000000000000000100"/28, 0x1c)
executing program 2:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
connect$rxrpc(r1, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
sendmsg(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)='hello\x00', 0x6}], 0x1, &(0x7f0000000400)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0)
recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000520)=[{&(0x7f0000000540), 0x100}], 0x1, &(0x7f0000000560), 0x100}, 0x40)
executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$netlink(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4800000041000506010000000000000001010000000000002c00010010000200112233445566778899aabbcc06000600080000001000040001020304050607080600000104000300"], 0x48}], 0x1}, 0x0)
executing program 2:
syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
write(r0, &(0x7f0000000100)="3c0000001000010001000000000000003801000025001c0044454641554c54554549443030303030303030303030303030303000", 0x3c)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x1403, 0x5, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
bind(r2, &(0x7f0000000500)=@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xaa}}, 0x10)
r3 = socket$inet_smc(0x2b, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000600)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xaa}}, 0x10)
close(r2)
executing program 1:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind(r0, &(0x7f0000000000)=@in={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x5)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
bind(r1, &(0x7f0000000040)=@in={0x2, 0x4e21, @loopback}, 0x10)
connect(r1, &(0x7f0000000080)=@in={0x2, 0x4e20, @loopback}, 0x10)
r2 = accept(r0, 0x0, 0x0)
sendmsg$inet_sctp(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)="00010004", 0x4}], 0x1, &(0x7f0000000280)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0x4}}], 0x30}, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r0)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0)
sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x1, 0x1000001}}}, 0x20}}, 0x0)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000003c0)={0x28, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0)
executing program 2:
r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x2}, 0x10)
connect$llc(r0, &(0x7f0000000100)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x2, @remote}, 0x10)
executing program 2:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x24)
connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)='hello\x00', 0x6}], 0x1, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)=""/256, 0x100}], 0x1, &(0x7f0000000400)=""/256, 0x100}, 0x40)
executing program 1:
unshare(0x4000000)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r0, &(0x7f0000000100)="000000010000000100000001000000010000000101050000000002bc68656c6c6f", 0x21, 0x0, &(0x7f0000000200)={0x2, 0x1b59, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000100000)=""/65536, 0x10000, 0x800}, 0x20)
setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000180)=0x10, 0x4)
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000001c0)=0x10, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000200)=0x10, 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={<r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'lo\x00', <r2=>0x0})
bind$xdp(r0, &(0x7f0000000080)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10)
mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000)
pipe2(&(0x7f0000000400)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write(r4, &(0x7f0000000500)="0100"/336, 0x150)
read(r3, &(0x7f0000000000), 0x150)
sendmsg$xdp(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/failslab/verbose\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='N\x00', 0x2)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 5 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/failslab/verbose\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='N\x00', 0x2)

program crashed: WARNING in mas_nomem
single: successfully extracted reproducer
found reproducer with 14 syscalls
minimizing guilty program
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/failslab/verbose\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='0\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/failslab/ignore-gfp-wait\x00', 0x1, 0x0)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/failslab/verbose\x00', 0x1, 0x0)
write(r4, &(0x7f0000000300)='0\x00', 0x2)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/failslab/verbose\x00', 0x1, 0x0)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='0\x00', 0x2)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./debug/failslab/space\x00', 0x1, 0x0)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/failslab/interval\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000100)='100\x00', 0x4)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, 0x0, &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100), 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)

program did not crash
testing program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m59.882692419s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program crashed: WARNING in __cfg80211_ibss_joined
a never seen crash title: WARNING in __cfg80211_ibss_joined, ignore
simplifying guilty program options
testing program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
extracting C reproducer
testing compiled C program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program did not crash
testing program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
extracting C reproducer
testing compiled C program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
program did not crash
testing program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
validation run: crashed=true
testing program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
validation run: crashed=true
testing program (duration=1m59.882692419s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/failslab/probability\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='100\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug/failslab/times\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='-1\x00', 0x3)

program crashed: WARNING in mas_nomem
validation run: crashed=true
reproducing took 1h21m44.470109231s
repro crashed as (corrupted=false):
RAX: ffffffffffffffda RBX: 000055613605dbf0 RCX: 00007f7b82435097
RDX: 0000000000000000 RSI: 00000000009480e8 RDI: 00007f7b81987000
RBP: 000055613605d910 R08: 0000556136070140 R09: 0000000000000006
R10: 0000000000001010 R11: 0000000000000206 R12: 000055610d8b0588
R13: 00007fff54255440 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
------------[ cut here ]------------
!mas->sheaf && !mas->alloc
WARNING: lib/maple_tree.c:5751 at mas_nomem+0x1cc/0x210 lib/maple_tree.c:5751, CPU#0: udevd/5635
Modules linked in:
CPU: 0 UID: 0 PID: 5635 Comm: udevd Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:mas_nomem+0x1cc/0x210 lib/maple_tree.c:5751
Code: 4c 89 ff e8 d6 85 ea f6 49 c7 07 00 00 00 00 b0 01 e9 95 fe ff ff e8 f3 2d 7e f6 90 0f 0b 90 e9 2b ff ff ff e8 e5 2d 7e f6 90 <0f> 0b 90 e9 77 fe ff ff 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c ce fe
RSP: 0018:ffffc900051b78f0 EFLAGS: 00010293
RAX: ffffffff8b4775cb RBX: 1ffff92000a36fbf RCX: ffff888034169f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000cc0 R08: 00000000ffffffff R09: 1ffffffff1ca1a86
R10: dffffc0000000000 R11: fffffbfff1ca1a87 R12: dffffc0000000000
R13: ffffc900051b7e18 R14: ffffc900051b7de0 R15: ffffc900051b7df8
FS:  00007f7b822d0880(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556136088568 CR3: 000000002ce0c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 mas_store_gfp+0x37a/0x820 lib/maple_tree.c:4987
 vma_iter_clear_gfp include/linux/mm.h:1674 [inline]
 do_vmi_align_munmap+0x30c/0x4d0 mm/vma.c:1644
 do_vmi_munmap+0x252/0x2d0 mm/vma.c:1697
 __vm_munmap+0x241/0x3e0 mm/vma.c:3347
 __do_sys_munmap mm/mmap.c:1079 [inline]
 __se_sys_munmap mm/mmap.c:1076 [inline]
 __x64_sys_munmap+0x60/0x70 mm/mmap.c:1076
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b82435097
Code: 73 01 c3 48 8b 0d 61 2d 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 31 2d 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007fff542553b8 EFLAGS: 00000206 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 000055613605dbf0 RCX: 00007f7b82435097
RDX: 0000000000000000 RSI: 00000000009480e8 RDI: 00007f7b81987000
RBP: 000055613605d910 R08: 0000556136070140 R09: 0000000000000006
R10: 0000000000001010 R11: 0000000000000206 R12: 000055610d8b0588
R13: 00007fff54255440 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

final repro crashed as (corrupted=false):
RAX: ffffffffffffffda RBX: 000055613605dbf0 RCX: 00007f7b82435097
RDX: 0000000000000000 RSI: 00000000009480e8 RDI: 00007f7b81987000
RBP: 000055613605d910 R08: 0000556136070140 R09: 0000000000000006
R10: 0000000000001010 R11: 0000000000000206 R12: 000055610d8b0588
R13: 00007fff54255440 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
------------[ cut here ]------------
!mas->sheaf && !mas->alloc
WARNING: lib/maple_tree.c:5751 at mas_nomem+0x1cc/0x210 lib/maple_tree.c:5751, CPU#0: udevd/5635
Modules linked in:
CPU: 0 UID: 0 PID: 5635 Comm: udevd Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:mas_nomem+0x1cc/0x210 lib/maple_tree.c:5751
Code: 4c 89 ff e8 d6 85 ea f6 49 c7 07 00 00 00 00 b0 01 e9 95 fe ff ff e8 f3 2d 7e f6 90 0f 0b 90 e9 2b ff ff ff e8 e5 2d 7e f6 90 <0f> 0b 90 e9 77 fe ff ff 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c ce fe
RSP: 0018:ffffc900051b78f0 EFLAGS: 00010293
RAX: ffffffff8b4775cb RBX: 1ffff92000a36fbf RCX: ffff888034169f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000cc0 R08: 00000000ffffffff R09: 1ffffffff1ca1a86
R10: dffffc0000000000 R11: fffffbfff1ca1a87 R12: dffffc0000000000
R13: ffffc900051b7e18 R14: ffffc900051b7de0 R15: ffffc900051b7df8
FS:  00007f7b822d0880(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556136088568 CR3: 000000002ce0c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 mas_store_gfp+0x37a/0x820 lib/maple_tree.c:4987
 vma_iter_clear_gfp include/linux/mm.h:1674 [inline]
 do_vmi_align_munmap+0x30c/0x4d0 mm/vma.c:1644
 do_vmi_munmap+0x252/0x2d0 mm/vma.c:1697
 __vm_munmap+0x241/0x3e0 mm/vma.c:3347
 __do_sys_munmap mm/mmap.c:1079 [inline]
 __se_sys_munmap mm/mmap.c:1076 [inline]
 __x64_sys_munmap+0x60/0x70 mm/mmap.c:1076
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b82435097
Code: 73 01 c3 48 8b 0d 61 2d 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 31 2d 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007fff542553b8 EFLAGS: 00000206 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 000055613605dbf0 RCX: 00007f7b82435097
RDX: 0000000000000000 RSI: 00000000009480e8 RDI: 00007f7b81987000
RBP: 000055613605d910 R08: 0000556136070140 R09: 0000000000000006
R10: 0000000000001010 R11: 0000000000000206 R12: 000055610d8b0588
R13: 00007fff54255440 R14: 0000000000000000 R15: 0000000000000000
 </TASK>