Extracting prog: 1m12.769115348s
Minimizing prog: 5m56.752822208s
Simplifying prog options: 0s
Extracting C: 35.180272086s
Simplifying C: 4m55.473219377s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
ioctl$DM_DEV_CREATE(0xffffffffffffffff, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r0=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(0xffffffffffffffff, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(0xffffffffffffffff, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r0}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, 0x0)
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, 0x0)
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dm_control-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD-ioctl$DM_DEV_SUSPEND
detailed listing:
executing program 0:
r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {<r1=>0x0, {'syz', 0x0, '0\x00'}}})
ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x20201, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x2000, 0x0, 0x80, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'n', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]})
ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x28410, 0x0, 0x0, @by_dev={r1}})

program crashed: BUG: unable to handle kernel paging request in snapshot_merge_next_chunks
validation run: crashed=true
reproducing took 14m58.327836227s
repro crashed as (corrupted=false):
BUG: unable to handle page fault for address: fffffffffffffff1
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7cae067 P4D 7cae067 PUD 7cb0067 PMD 0 
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 381 Comm: syz.2.17 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:snapshot_merge_next_chunks+0x270/0xcb0 drivers/md/dm-snap.c:1057
Code: 83 c3 38 48 89 d8 48 c1 e8 03 80 3c 08 00 74 08 48 89 df e8 22 f7 dd fd 4c 8b 1b 4c 89 ff 4c 89 e6 4c 89 ea 41 ba e2 90 58 c7 <45> 03 53 f1 74 02 0f 0b 41 ff d3 0f 1f 00 89 c3 bf 01 00 00 00 89
RSP: 0018:ffffc90000f3f8a0 EFLAGS: 00010246
RAX: 1ffffffff1063223 RBX: ffffffff88319118 RCX: dffffc0000000000
RDX: ffffc90000f3f940 RSI: ffffc90000f3f920 RDI: ffff888114fa9d80
RBP: ffffc90000f3fa90 R08: ffff8881152d15bf R09: 1ffff11022a5a2b7
R10: 00000000c75890e2 R11: 0000000000000000 R12: ffffc90000f3f920
R13: ffffc90000f3f940 R14: ffff8881152d15b8 R15: ffff888114fa9d80
FS:  000055556b6d9500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff1 CR3: 000000012602c000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 start_merge drivers/md/dm-snap.c:1167 [inline]
 snapshot_merge_resume+0x256/0x2b0 drivers/md/dm-snap.c:2307
 dm_table_resume_targets+0x23f/0x380 drivers/md/dm-table.c:2041
 __dm_resume+0x25/0x1b0 drivers/md/dm.c:3097
 dm_resume+0x16a/0x1f0 drivers/md/dm.c:3143
 do_resume drivers/md/dm-ioctl.c:1224 [inline]
 dev_suspend+0x3ff/0x700 drivers/md/dm-ioctl.c:1256
 ctl_ioctl drivers/md/dm-ioctl.c:2107 [inline]
 dm_ctl_ioctl+0x8f3/0xde0 drivers/md/dm-ioctl.c:2129
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0x123/0x1b0 fs/ioctl.c:892
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:892
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff116f9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffff2d9f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff117225fa0 RCX: 00007ff116f9fb19
RDX: 0000200000000740 RSI: 00000000c138fd06 RDI: 0000000000000003
RBP: 00007ff117037b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff117225fac R14: 00007ff117225fa0 R15: 00007ff117225fa0
 </TASK>
Modules linked in:
CR2: fffffffffffffff1
---[ end trace 0000000000000000 ]---
RIP: 0010:snapshot_merge_next_chunks+0x270/0xcb0 drivers/md/dm-snap.c:1057
Code: 83 c3 38 48 89 d8 48 c1 e8 03 80 3c 08 00 74 08 48 89 df e8 22 f7 dd fd 4c 8b 1b 4c 89 ff 4c 89 e6 4c 89 ea 41 ba e2 90 58 c7 <45> 03 53 f1 74 02 0f 0b 41 ff d3 0f 1f 00 89 c3 bf 01 00 00 00 89
RSP: 0018:ffffc90000f3f8a0 EFLAGS: 00010246
RAX: 1ffffffff1063223 RBX: ffffffff88319118 RCX: dffffc0000000000
RDX: ffffc90000f3f940 RSI: ffffc90000f3f920 RDI: ffff888114fa9d80
RBP: ffffc90000f3fa90 R08: ffff8881152d15bf R09: 1ffff11022a5a2b7
R10: 00000000c75890e2 R11: 0000000000000000 R12: ffffc90000f3f920
R13: ffffc90000f3f940 R14: ffff8881152d15b8 R15: ffff888114fa9d80
FS:  000055556b6d9500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff1 CR3: 000000012602c000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
   0:	83 c3 38             	add    $0x38,%ebx
   3:	48 89 d8             	mov    %rbx,%rax
   6:	48 c1 e8 03          	shr    $0x3,%rax
   a:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1)
   e:	74 08                	je     0x18
  10:	48 89 df             	mov    %rbx,%rdi
  13:	e8 22 f7 dd fd       	call   0xfdddf73a
  18:	4c 8b 1b             	mov    (%rbx),%r11
  1b:	4c 89 ff             	mov    %r15,%rdi
  1e:	4c 89 e6             	mov    %r12,%rsi
  21:	4c 89 ea             	mov    %r13,%rdx
  24:	41 ba e2 90 58 c7    	mov    $0xc75890e2,%r10d
* 2a:	45 03 53 f1          	add    -0xf(%r11),%r10d <-- trapping instruction
  2e:	74 02                	je     0x32
  30:	0f 0b                	ud2
  32:	41 ff d3             	call   *%r11
  35:	0f 1f 00             	nopl   (%rax)
  38:	89 c3                	mov    %eax,%ebx
  3a:	bf 01 00 00 00       	mov    $0x1,%edi
  3f:	89                   	.byte 0x89

final repro crashed as (corrupted=false):
BUG: unable to handle page fault for address: fffffffffffffff1
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7cae067 P4D 7cae067 PUD 7cb0067 PMD 0 
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 381 Comm: syz.2.17 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:snapshot_merge_next_chunks+0x270/0xcb0 drivers/md/dm-snap.c:1057
Code: 83 c3 38 48 89 d8 48 c1 e8 03 80 3c 08 00 74 08 48 89 df e8 22 f7 dd fd 4c 8b 1b 4c 89 ff 4c 89 e6 4c 89 ea 41 ba e2 90 58 c7 <45> 03 53 f1 74 02 0f 0b 41 ff d3 0f 1f 00 89 c3 bf 01 00 00 00 89
RSP: 0018:ffffc90000f3f8a0 EFLAGS: 00010246
RAX: 1ffffffff1063223 RBX: ffffffff88319118 RCX: dffffc0000000000
RDX: ffffc90000f3f940 RSI: ffffc90000f3f920 RDI: ffff888114fa9d80
RBP: ffffc90000f3fa90 R08: ffff8881152d15bf R09: 1ffff11022a5a2b7
R10: 00000000c75890e2 R11: 0000000000000000 R12: ffffc90000f3f920
R13: ffffc90000f3f940 R14: ffff8881152d15b8 R15: ffff888114fa9d80
FS:  000055556b6d9500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff1 CR3: 000000012602c000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 start_merge drivers/md/dm-snap.c:1167 [inline]
 snapshot_merge_resume+0x256/0x2b0 drivers/md/dm-snap.c:2307
 dm_table_resume_targets+0x23f/0x380 drivers/md/dm-table.c:2041
 __dm_resume+0x25/0x1b0 drivers/md/dm.c:3097
 dm_resume+0x16a/0x1f0 drivers/md/dm.c:3143
 do_resume drivers/md/dm-ioctl.c:1224 [inline]
 dev_suspend+0x3ff/0x700 drivers/md/dm-ioctl.c:1256
 ctl_ioctl drivers/md/dm-ioctl.c:2107 [inline]
 dm_ctl_ioctl+0x8f3/0xde0 drivers/md/dm-ioctl.c:2129
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0x123/0x1b0 fs/ioctl.c:892
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:892
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff116f9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffff2d9f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff117225fa0 RCX: 00007ff116f9fb19
RDX: 0000200000000740 RSI: 00000000c138fd06 RDI: 0000000000000003
RBP: 00007ff117037b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff117225fac R14: 00007ff117225fa0 R15: 00007ff117225fa0
 </TASK>
Modules linked in:
CR2: fffffffffffffff1
---[ end trace 0000000000000000 ]---
RIP: 0010:snapshot_merge_next_chunks+0x270/0xcb0 drivers/md/dm-snap.c:1057
Code: 83 c3 38 48 89 d8 48 c1 e8 03 80 3c 08 00 74 08 48 89 df e8 22 f7 dd fd 4c 8b 1b 4c 89 ff 4c 89 e6 4c 89 ea 41 ba e2 90 58 c7 <45> 03 53 f1 74 02 0f 0b 41 ff d3 0f 1f 00 89 c3 bf 01 00 00 00 89
RSP: 0018:ffffc90000f3f8a0 EFLAGS: 00010246
RAX: 1ffffffff1063223 RBX: ffffffff88319118 RCX: dffffc0000000000
RDX: ffffc90000f3f940 RSI: ffffc90000f3f920 RDI: ffff888114fa9d80
RBP: ffffc90000f3fa90 R08: ffff8881152d15bf R09: 1ffff11022a5a2b7
R10: 00000000c75890e2 R11: 0000000000000000 R12: ffffc90000f3f920
R13: ffffc90000f3f940 R14: ffff8881152d15b8 R15: ffff888114fa9d80
FS:  000055556b6d9500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff1 CR3: 000000012602c000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
   0:	83 c3 38             	add    $0x38,%ebx
   3:	48 89 d8             	mov    %rbx,%rax
   6:	48 c1 e8 03          	shr    $0x3,%rax
   a:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1)
   e:	74 08                	je     0x18
  10:	48 89 df             	mov    %rbx,%rdi
  13:	e8 22 f7 dd fd       	call   0xfdddf73a
  18:	4c 8b 1b             	mov    (%rbx),%r11
  1b:	4c 89 ff             	mov    %r15,%rdi
  1e:	4c 89 e6             	mov    %r12,%rsi
  21:	4c 89 ea             	mov    %r13,%rdx
  24:	41 ba e2 90 58 c7    	mov    $0xc75890e2,%r10d
* 2a:	45 03 53 f1          	add    -0xf(%r11),%r10d <-- trapping instruction
  2e:	74 02                	je     0x32
  30:	0f 0b                	ud2
  32:	41 ff d3             	call   *%r11
  35:	0f 1f 00             	nopl   (%rax)
  38:	89 c3                	mov    %eax,%ebx
  3a:	bf 01 00 00 00       	mov    $0x1,%edi
  3f:	89                   	.byte 0x89