Extracting prog: 2m12.435813033s
Minimizing prog: 15m35.26175219s
Simplifying prog options: 0s
Extracting C: 23.987554081s
Simplifying C: 7m25.829321546s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-mmap-madvise-socketpair$unix-setsockopt$inet6_IPV6_ADDRFORM-sendmsg$AUDIT_TTY_SET-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100))
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000180), 0x4)
sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, 0x0, 0x20028880)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-mmap-madvise-socketpair$unix-setsockopt$inet6_IPV6_ADDRFORM-sendmsg$AUDIT_TTY_SET
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100))
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000180), 0x4)
sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, 0x0, 0x20028880)

program did not crash
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-mmap-madvise-socketpair$unix-setsockopt$inet6_IPV6_ADDRFORM-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100))
setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000180), 0x4)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-mmap-madvise-socketpair$unix-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100))
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-mmap-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program did not crash
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-openat$dir-madvise-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program did not crash
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_mount_image$vfat-mmap-madvise-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program did not crash
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program did not crash
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program did not crash
testing program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(0x0, 0x10001)

program did not crash
extracting C reproducer
testing compiled C program (duration=40.295305515s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
simplifying C reproducer
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing compiled C program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
testing program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
validation run: crashed=true
testing program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
validation run: crashed=true
testing program (duration=40.295305515s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-openat$dir-mmap-madvise-truncate
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000ac0), &(0x7f0000000180)='./file0\x00', 0x802, &(0x7f0000000480)=ANY=[], 0x1, 0x2ac, &(0x7f00000004c0)="$eJzs3UFrK1UUAOAzybw0Txcp4kYRHNCFq/Lq1k2jPEHsSomgLjT4+kCS8KCFgBWMXfUXuPR/+BPcuPEfCG4Fd+2iMjKZmSYxaS01pvD6favTe++592Rum65y8uVro8GTZ0mcnP0W7XYSjb3Yi/MktqMRte8jDQDg+XGe5/FnfpvMtLH+agCATSj//5fuuhYAYDM+/vSzD7v7+48/yrJ2vNI5HfeSiBidjnvlfPdpfB3DOIhH0YmLiPxSGb//wf7jSLPCdrw5mox7Reboi1+q/bt/REzzd6MT26vzd7PSZf4LdXVZdJ8+qH/oxMur89/+Z36MJtFrxVtvzNW/E5349at4FsN4EkXuLP+73Sx7L//h7NvPi2OK/KQRva3pupm8uaErAQAAAAAAAAAAAAAAAAAAAADgHtjJsqRs3zPt31MMTfvnjHvNi+n8Tlab7+8zqfsDJfVGZX+gPKoWPZM8fqz76zzKsiyvFs7y03g19cUCAAAAAAAAAAAAAAAAAAAAUDj65njQHw4PDtcS1N0A6o/133afvbmR1+N40G9eveHWzc+a7zZQ1Hrt4kjTWNNj+bfgYVHP2nfeml3uJ1EG9cWs9ayX3i03PR70s2qqfsiDfrJw1sNYSm/XF/fT/FQr/mth+fRX4iJfvNP2ZamLWa01PY3Wiyun/srz/Gb7vPN7eUfVSDJtsXGz0x9UwcoXWATt5Xv/+SC96q/gyreM5lreeAAAAAAAAAAAAAAAAAAAgCWzD/2umDy5NrXxvxUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABs2+/7/OmhHxOLIUjCpkq9bUwWtODy645cIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPfB3AAAA//9b5UyA")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0x1e1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x6, 0x12, r0, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19)
truncate(&(0x7f0000000000)='./file1\x00', 0x10001)

program crashed: BUG: unable to handle kernel paging request in create_empty_buffers
validation run: crashed=true
reproducing took 29m13.28997641s
repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 256
Unable to handle kernel paging request at virtual address fbd52000000000bd
KASAN: maybe wild-memory-access in range [0xdead0000000005e8-0xdead0000000005ef]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[fbd52000000000bd] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4498 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026
pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __lock_acquire+0xf4/0x6800 kernel/locking/lockdep.c:4919
lr : lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
sp : ffff8000215b75c0
x29: ffff8000215b77c0 x28: 0000000000000000 x27: 0000000000000001
x26: dead0000000005e8 x25: 1ffff00002a42070 x24: 0000000000000000
x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000
x20: ffff800008a90b9c x19: 0000000000000000 x18: 0000000000000000
x17: ffff800018349000 x16: ffff80000804309c x15: 0000000000000000
x14: 0000000000000002 x13: 1fffe0001c45ecdc x12: 0000000000ff0100
x11: ff0080000a8db964 x10: ffff7000042b6ed8 x9 : ffff0000df44b780
x8 : 1bd5a000000000bd x7 : ffff800008a90b9c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : dead0000000005e8
Call trace:
 __lock_acquire+0xf4/0x6800 kernel/locking/lockdep.c:4919
 lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 create_empty_buffers+0xe4/0x5b8 fs/buffer.c:1552
 block_truncate_page+0x174/0x778 fs/buffer.c:2554
 fat_block_truncate_page+0x50/0x60 fs/fat/inode.c:341
 fat_setattr+0x9cc/0xe84 fs/fat/file.c:546
 notify_change+0xb0c/0xdcc fs/attr.c:499
 do_truncate+0x188/0x20c fs/open.c:65
 vfs_truncate+0x23c/0x2b0 fs/open.c:111
 do_sys_truncate+0xec/0x1b4 fs/open.c:134
 __do_sys_truncate fs/open.c:146 [inline]
 __se_sys_truncate fs/open.c:144 [inline]
 __arm64_sys_truncate+0x5c/0x70 fs/open.c:144
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: d0067ec8 b94bc108 340001c8 d343ff48 (38776908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d0067ec8 	adrp	x8, 0xcfda000
   4:	b94bc108 	ldr	w8, [x8, #3008]
   8:	340001c8 	cbz	w8, 0x40
   c:	d343ff48 	lsr	x8, x26, #3
* 10:	38776908 	ldrb	w8, [x8, x23] <-- trapping instruction

final repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 256
Unable to handle kernel paging request at virtual address fbd52000000000bd
KASAN: maybe wild-memory-access in range [0xdead0000000005e8-0xdead0000000005ef]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[fbd52000000000bd] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4498 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026
pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __lock_acquire+0xf4/0x6800 kernel/locking/lockdep.c:4919
lr : lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
sp : ffff8000215b75c0
x29: ffff8000215b77c0 x28: 0000000000000000 x27: 0000000000000001
x26: dead0000000005e8 x25: 1ffff00002a42070 x24: 0000000000000000
x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000000
x20: ffff800008a90b9c x19: 0000000000000000 x18: 0000000000000000
x17: ffff800018349000 x16: ffff80000804309c x15: 0000000000000000
x14: 0000000000000002 x13: 1fffe0001c45ecdc x12: 0000000000ff0100
x11: ff0080000a8db964 x10: ffff7000042b6ed8 x9 : ffff0000df44b780
x8 : 1bd5a000000000bd x7 : ffff800008a90b9c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : dead0000000005e8
Call trace:
 __lock_acquire+0xf4/0x6800 kernel/locking/lockdep.c:4919
 lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 create_empty_buffers+0xe4/0x5b8 fs/buffer.c:1552
 block_truncate_page+0x174/0x778 fs/buffer.c:2554
 fat_block_truncate_page+0x50/0x60 fs/fat/inode.c:341
 fat_setattr+0x9cc/0xe84 fs/fat/file.c:546
 notify_change+0xb0c/0xdcc fs/attr.c:499
 do_truncate+0x188/0x20c fs/open.c:65
 vfs_truncate+0x23c/0x2b0 fs/open.c:111
 do_sys_truncate+0xec/0x1b4 fs/open.c:134
 __do_sys_truncate fs/open.c:146 [inline]
 __se_sys_truncate fs/open.c:144 [inline]
 __arm64_sys_truncate+0x5c/0x70 fs/open.c:144
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: d0067ec8 b94bc108 340001c8 d343ff48 (38776908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d0067ec8 	adrp	x8, 0xcfda000
   4:	b94bc108 	ldr	w8, [x8, #3008]
   8:	340001c8 	cbz	w8, 0x40
   c:	d343ff48 	lsr	x8, x26, #3
* 10:	38776908 	ldrb	w8, [x8, x23] <-- trapping instruction