Extracting prog: 2m35.332446122s Minimizing prog: 19m28.778390961s Simplifying prog options: 0s Extracting C: 56.496982768s Simplifying C: 4m35.231303753s 12 programs, 3 VMs, timeouts [45s 5m0s 16m0s] extracting reproducer from 12 programs single: executing 2 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan single: successfully extracted reproducer found reproducer with 12 syscalls minimizing guilty program testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-syz_open_procfs$pagemap detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) program did not crash testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program did not crash testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: r0 = syz_open_procfs$pagemap(0x0, 0x0) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{}], 0x1000000000000000}) program did not crash testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, 0x0) program did not crash testing program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN detailed listing: executing program 0: r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000165000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=1m7.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan simplifying C reproducer testing compiled C program (duration=1m7.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing compiled C program (duration=1m7.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing compiled C program (duration=1m7.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing compiled C program (duration=1m7.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing compiled C program (duration=1m7.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan testing compiled C program (duration=1m7.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs$pagemap-ioctl$PAGEMAP_SCAN program crashed: BUG: unable to handle kernel NULL pointer dereference in do_pagemap_scan reproducing took 27m35.839148404s repro crashed as (corrupted=false): 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write [00000018] *pgd=84374003, *pmd=fe515003 Internal error: Oops: a05 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 3005 Comm: syz-executor196 Not tainted 6.10.0-rc4-syzkaller #0 Hardware name: ARM-Versatile Express PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2414 [inline] PC is at do_pagemap_scan+0x2ac/0x6f8 fs/proc/task_mmu.c:2460 LR is at kmalloc_noprof include/linux/slab.h:664 [inline] LR is at kmalloc_array_noprof include/linux/slab.h:699 [inline] LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2409 [inline] LR is at do_pagemap_scan+0x278/0x6f8 fs/proc/task_mmu.c:2460 pc : [<805a74c4>] lr : [<805a7490>] psr: 20000013 sp : df961e18 ip : df961e18 fp : df961f04 r10: 00000000 r9 : 00000000 r8 : 00000000 r7 : df961e50 r6 : 83708c00 r5 : 20165000 r4 : 83eb3c00 r3 : 20ffb000 r2 : 00000000 r1 : 00000000 r0 : 00000010 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 8437a280 DAC: 00000000 Register r0 information: zero-size pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: slab mm_struct start 83eb3c00 pointer offset 0 size 712 Register r5 information: non-paged memory Register r6 information: slab task_struct start 83708c00 pointer offset 0 size 3072 Register r7 information: 2-page vmalloc region starting at 0xdf960000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797 Register r8 information: NULL pointer Register r9 information: NULL pointer Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdf960000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797 Register r12 information: 2-page vmalloc region starting at 0xdf960000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797 Process syz-executor196 (pid: 3005, stack limit = 0xdf960000) Stack: (0xdf961e18 to 0xdf962000) 1e00: 00000000 00000000 1e20: 00000000 00000000 200004c0 00000001 20165000 00000000 00000000 00000000 1e40: 00000000 00000000 00000000 00000000 00000060 00000000 00000000 00000000 1e60: 20165000 00000000 20ffb000 00000000 00000000 00000000 20000000 00000000 1e80: 00000000 10000000 ffffffff 00000000 00000000 00000000 00000000 00000000 1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000010 00000000 1ec0: 00000000 00000000 20000000 00000000 c0606610 9aa5d9ce df961ef4 c0606610 1ee0: 00000000 83fe76c0 200004c0 83fe76c0 00000003 83708c00 df961f14 df961f08 1f00: 805a7938 805a7224 df961fa4 df961f18 8051a27c 805a791c 804fe064 8050f77c 1f20: 00000002 00000000 00000006 00000100 00000001 9aa5d9ce ffffff9c 7e981c18 1f40: 00000000 00000142 df961fa4 df961f58 804fe480 804fdfc8 00000002 00000000 1f60: 00000000 00000000 00000000 00000000 00000002 9aa5d9ce 00000000 ffffffff 1f80: 00000000 00000000 00000036 8020029c 83708c00 00000036 00000000 df961fa8 1fa0: 80200060 8051a154 ffffffff 00000000 00000003 c0606610 200004c0 00000000 1fc0: ffffffff 00000000 00000000 00000036 7e981e0c 00000000 000f4240 00000000 1fe0: 7e981bf8 7e981be8 000106b8 0002e820 00000010 00000003 00000000 00000000 Call trace: [<805a7218>] (do_pagemap_scan) from [<805a7938>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2527) r10:83708c00 r9:00000003 r8:83fe76c0 r7:200004c0 r6:83fe76c0 r5:00000000 r4:c0606610 [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (do_vfs_ioctl fs/ioctl.c:861 [inline]) [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (__do_sys_ioctl fs/ioctl.c:905 [inline]) [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893) [<8051a148>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdf961fa8 to 0xdf961ff0) 1fa0: ffffffff 00000000 00000003 c0606610 200004c0 00000000 1fc0: ffffffff 00000000 00000000 00000036 7e981e0c 00000000 000f4240 00000000 1fe0: 7e981bf8 7e981be8 000106b8 0002e820 r10:00000036 r9:83708c00 r8:8020029c r7:00000036 r6:00000000 r5:00000000 r4:ffffffff Code: e51b309c e51b108c e50b103c e3a01000 (e1c080f8) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e51b309c ldr r3, [fp, #-156] @ 0xffffff64 4: e51b108c ldr r1, [fp, #-140] @ 0xffffff74 8: e50b103c str r1, [fp, #-60] @ 0xffffffc4 c: e3a01000 mov r1, #0 * 10: e1c080f8 strd r8, [r0, #8] <-- trapping instruction final repro crashed as (corrupted=false): 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write [00000018] *pgd=84374003, *pmd=fe515003 Internal error: Oops: a05 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 3005 Comm: syz-executor196 Not tainted 6.10.0-rc4-syzkaller #0 Hardware name: ARM-Versatile Express PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2414 [inline] PC is at do_pagemap_scan+0x2ac/0x6f8 fs/proc/task_mmu.c:2460 LR is at kmalloc_noprof include/linux/slab.h:664 [inline] LR is at kmalloc_array_noprof include/linux/slab.h:699 [inline] LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2409 [inline] LR is at do_pagemap_scan+0x278/0x6f8 fs/proc/task_mmu.c:2460 pc : [<805a74c4>] lr : [<805a7490>] psr: 20000013 sp : df961e18 ip : df961e18 fp : df961f04 r10: 00000000 r9 : 00000000 r8 : 00000000 r7 : df961e50 r6 : 83708c00 r5 : 20165000 r4 : 83eb3c00 r3 : 20ffb000 r2 : 00000000 r1 : 00000000 r0 : 00000010 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 8437a280 DAC: 00000000 Register r0 information: zero-size pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: slab mm_struct start 83eb3c00 pointer offset 0 size 712 Register r5 information: non-paged memory Register r6 information: slab task_struct start 83708c00 pointer offset 0 size 3072 Register r7 information: 2-page vmalloc region starting at 0xdf960000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797 Register r8 information: NULL pointer Register r9 information: NULL pointer Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdf960000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797 Register r12 information: 2-page vmalloc region starting at 0xdf960000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797 Process syz-executor196 (pid: 3005, stack limit = 0xdf960000) Stack: (0xdf961e18 to 0xdf962000) 1e00: 00000000 00000000 1e20: 00000000 00000000 200004c0 00000001 20165000 00000000 00000000 00000000 1e40: 00000000 00000000 00000000 00000000 00000060 00000000 00000000 00000000 1e60: 20165000 00000000 20ffb000 00000000 00000000 00000000 20000000 00000000 1e80: 00000000 10000000 ffffffff 00000000 00000000 00000000 00000000 00000000 1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000010 00000000 1ec0: 00000000 00000000 20000000 00000000 c0606610 9aa5d9ce df961ef4 c0606610 1ee0: 00000000 83fe76c0 200004c0 83fe76c0 00000003 83708c00 df961f14 df961f08 1f00: 805a7938 805a7224 df961fa4 df961f18 8051a27c 805a791c 804fe064 8050f77c 1f20: 00000002 00000000 00000006 00000100 00000001 9aa5d9ce ffffff9c 7e981c18 1f40: 00000000 00000142 df961fa4 df961f58 804fe480 804fdfc8 00000002 00000000 1f60: 00000000 00000000 00000000 00000000 00000002 9aa5d9ce 00000000 ffffffff 1f80: 00000000 00000000 00000036 8020029c 83708c00 00000036 00000000 df961fa8 1fa0: 80200060 8051a154 ffffffff 00000000 00000003 c0606610 200004c0 00000000 1fc0: ffffffff 00000000 00000000 00000036 7e981e0c 00000000 000f4240 00000000 1fe0: 7e981bf8 7e981be8 000106b8 0002e820 00000010 00000003 00000000 00000000 Call trace: [<805a7218>] (do_pagemap_scan) from [<805a7938>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2527) r10:83708c00 r9:00000003 r8:83fe76c0 r7:200004c0 r6:83fe76c0 r5:00000000 r4:c0606610 [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (do_vfs_ioctl fs/ioctl.c:861 [inline]) [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (__do_sys_ioctl fs/ioctl.c:905 [inline]) [<805a7910>] (do_pagemap_cmd) from [<8051a27c>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893) [<8051a148>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdf961fa8 to 0xdf961ff0) 1fa0: ffffffff 00000000 00000003 c0606610 200004c0 00000000 1fc0: ffffffff 00000000 00000000 00000036 7e981e0c 00000000 000f4240 00000000 1fe0: 7e981bf8 7e981be8 000106b8 0002e820 r10:00000036 r9:83708c00 r8:8020029c r7:00000036 r6:00000000 r5:00000000 r4:ffffffff Code: e51b309c e51b108c e50b103c e3a01000 (e1c080f8) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e51b309c ldr r3, [fp, #-156] @ 0xffffff64 4: e51b108c ldr r1, [fp, #-140] @ 0xffffff74 8: e50b103c str r1, [fp, #-60] @ 0xffffffc4 c: e3a01000 mov r1, #0 * 10: e1c080f8 strd r8, [r0, #8] <-- trapping instruction