Extracting prog: 7m42.871680972s Minimizing prog: 48m14.799346707s Simplifying prog options: 0s Extracting C: 1m45.147194401s Simplifying C: 9m47.565439298s extracting reproducer from 33 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash single: failed to extract reproducer bisect: bisecting 33 programs with base timeout 45s testing program (duration=53s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 30, 3, 29, 19, 10, 10, 6, 12, 1, 7, 2, 1, 1, 13, 5, 3, 5, 6, 7, 7, 6, 6, 9, 5, 10, 12, 13, 3, 2, 13, 2, 4] detailed listing: executing program 0: r0 = openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) write$nci(r0, &(0x7f0000000000)=@NCI_OP_CORE_RESET_RSP={0x0, 0x1, 0x2, 0x0, 0xe0, {0x0, 0x1, 0x8}}, 0x6) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = openat$sw_sync_info(0xffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) sendmsg$SOCK_DIAG_BY_FAMILY(r1, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x2) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) r4 = pidfd_getfd(r3, r0, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r4, 0x5451, 0x0) r5 = openat$selinux_attr(0xffffff9c, &(0x7f00000003c0)='/proc/self/attr/sockcreate\x00', 0x2, 0x0) statx(r4, &(0x7f0000000080)='./file0\x00', 0x6400, 0x80, &(0x7f0000000240)) fcntl$dupfd(r5, 0x406, r5) r6 = openat$mixer(0xffffff9c, &(0x7f00000000c0), 0x80542, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000380)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x2d0080, 0x10) openat(r7, &(0x7f0000000100)='./file0\x00', 0x200, 0x80) r8 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) r9 = openat$cgroup_procs(r8, &(0x7f0000000040), 0x2, 0x0) write(r9, 0x0, 0x0) sendmsg$NL80211_CMD_GET_REG(r4, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022dbd7000fedbdf251f0000000400cc00060021006200000007002100616100000500920000000000050092000a000000"], 0x38}, 0x1, 0x0, 0x0, 0x4085}, 0x20000014) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) bind$unix(r11, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r11, 0x0) connect$unix(r10, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r12 = dup3(r11, r10, 0x0) r13 = accept$packet(r12, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r13, 0x5450) dup2(r6, r6) executing program 0: socket$unix(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002bc0)) sendmsg$IPSET_CMD_SWAP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x6, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x8}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x90}, 0x84850) executing program 0: r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r0, 0x6, 0x7, 0x5}) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80200, 0x0) r2 = dup(r1) ioctl$SNAPSHOT_S2RAM(r2, 0x330b) r3 = openat$binder_debug(0xffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) close(r3) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x14, &(0x7f0000000240)="ff02040000ffffffffffff00000000000800000000", 0x15) r5 = signalfd(0xffffffffffffffff, &(0x7f00000000c0), 0x8) r6 = socket(0x1d, 0x2, 0x6) r7 = openat$selinux_policy(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) socket$unix(0x1, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r7, 0x8912, &(0x7f0000000000)={'sit0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000000c0)={0x1d, r8, 0x3, {0x0, 0x1}, 0xfd}, 0x18) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='freezer.state\x00', 0x26e1, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) setsockopt$MRT6_DEL_MIF(r4, 0x29, 0xcb, &(0x7f0000000100)={0x1, 0x1, 0x4, r8, 0x8}, 0xc) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r10 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$AUTOFS_IOC_FAIL(r10, 0x5451, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) socketpair(0x28, 0x1, 0x0, &(0x7f0000000000)) write$mtd(r5, 0x0, 0x0) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) syz_open_dev$rtc(&(0x7f0000000400), 0x0, 0x109000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) syz_clone(0x2820000, &(0x7f0000002540), 0x0, 0x0, 0x0, &(0x7f0000000000)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r1]) openat2(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x1c1041}, 0x18) sendmsg$IPSET_CMD_HEADER(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x2c, 0xc, 0x6, 0x3, 0x0, 0x0, {0x6, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x81) umount2(&(0x7f0000000380)='./file0\x00', 0x1) r4 = epoll_create1(0x0) r5 = dup2(r0, r4) r6 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x3, 0x2002) ioctl$SNDRV_PCM_IOCTL_PAUSE(r6, 0xc0844123, 0x0) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000000), 0x101800, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x0) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x6) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x5451, 0x0) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x208003, 0x0) r2 = epoll_create1(0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r2, 0x5452, &(0x7f0000000080)) r3 = openat$rfkill(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$loop_ctrl(0xffffff9c, &(0x7f0000000080), 0x10841, 0x0) close_range(r0, r3, 0x2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x400d4) executing program 32: r0 = socket$netlink(0x10, 0x3, 0x6) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x5451, 0x0) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x208003, 0x0) r2 = epoll_create1(0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r2, 0x5452, &(0x7f0000000080)) r3 = openat$rfkill(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$loop_ctrl(0xffffff9c, &(0x7f0000000080), 0x10841, 0x0) close_range(r0, r3, 0x2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x400d4) executing program 1: unshare(0x20000400) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000dcb000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x4000, 0x3}) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = gettid() process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) executing program 1: setgroups(0x0, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='environ\x00') pread64(r0, 0x0, 0x0, 0x4) executing program 1: setgroups(0x0, 0x0) executing program 33: setgroups(0x0, 0x0) executing program 2: memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x6) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) timer_create(0x3, &(0x7f0000000080)={0x0, 0x40, 0x4, @thr={0x0, 0x0}}, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000002a80)={0x1, 0x0, [{0x40000, 0x108, &(0x7f0000000300)=""/264}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, 0x0}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000180)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x8a, &(0x7f0000000500)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x54, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x15, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x2, 0x98ca}, @window={0x3, 0x3, 0xd7}, @fastopen={0x22, 0xd, "0900c7e2f68e08ddf7b278"}, @md5sig={0x13, 0x12, "8098cf093cc9cd7b8ec814f9bcfdfea9"}, @md5sig={0x13, 0x12, "6601a58c277de6a5fb0cda9e857dfed9"}]}}}}}}}}, 0x0) executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000140)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000240)=ANY=[@ANYBLOB="b70000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15afe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41000}, 0x94) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000100)={@val={0x0, 0x891f}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @val={@val={0x88a8, 0x6, 0x1, 0x2}, {0x8100, 0x3, 0x1, 0x3}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x3, 0xc, 0x28, 0x68, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @loopback}, {{0x4e21, 0x4e24, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x20, 0x2d, 0x0, 0xfff7}}}}}}}, 0x42) executing program 2: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x0, 0x0, 0x0, 0x3}, 0x94) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={0xffffffffffffffff}, 0x4) executing program 34: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x0, 0x0, 0x0, 0x3}, 0x94) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={0xffffffffffffffff}, 0x4) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = eventfd2(0x1, 0x80001) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r1}) executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='ns\x00') r1 = fanotify_init(0x4, 0x1) fanotify_mark(r1, 0x1, 0x40001019, r0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r2, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) connect$inet6(0xffffffffffffffff, 0x0, 0x0) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000ac0000000010900020073797a31000000000900010073797a3000000000080005400000"], 0xf0}}, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05000000020000000400000009"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000002300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r1}, 0xc) executing program 3: r0 = syz_pidfd_open(0x0, 0x0) setns(r0, 0x24020000) mount$bind(0x0, 0x0, 0x0, 0x101020, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') executing program 3: fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) openat(0xffffffffffffff9c, 0x0, 0x42, 0x100) timerfd_gettime(0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) rseq(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) executing program 4: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) unshare(0x22000600) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x10, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0xc800) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000004900010028bd7000fbdbdf250a008000"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20044044) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) wait4(r2, 0x0, 0x8, 0x0) ptrace$getregset(0x4204, r2, 0x202, &(0x7f0000000180)={0x0, 0x500}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCADDDLCI(r3, 0x8980, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b26, &(0x7f0000001200)={'wlan1\x00'}) executing program 4: timerfd_create(0x0, 0x800) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r0, &(0x7f0000000100), 0xfe1d) executing program 4: capset(&(0x7f0000000500)={0x20071026}, &(0x7f0000000200)={0x200002, 0x200003, 0x4000801, 0x4, 0x4}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002ac0)={0x1a, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000}}, &(0x7f0000000400)='GPL\x00', 0x0, 0xfffffee0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2ab4d, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x80) executing program 4: writev(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, 0x0, 0x4) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x9, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d5}, 0xc010) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) executing program 4: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000002c0)={0x1, &(0x7f0000001380)=[{0x6, 0x26, 0x9, 0x7fff0004}]}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80800) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program crashed: WARNING: zero-size vmalloc in trace_suspend_resume single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=3m53.503866944s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume simplifying C reproducer testing compiled C program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume testing compiled C program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume testing compiled C program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume testing compiled C program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume testing compiled C program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume testing compiled C program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: WARNING: zero-size vmalloc in trace_suspend_resume testing program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program crashed: WARNING: zero-size vmalloc in trace_suspend_resume validation run: crashed=true testing program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program crashed: WARNING: zero-size vmalloc in trace_suspend_resume validation run: crashed=true testing program (duration=3m53.503866944s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1E', 0x2) program crashed: WARNING: zero-size vmalloc in trace_suspend_resume validation run: crashed=true reproducing took 1h16m41.49099529s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: mm/vmalloc.c:4037 at __vmalloc_node_range_noprof+0x610/0x6a4 mm/vmalloc.c:4037, CPU#0: syz.2.17/4039 Modules linked in: Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 0 UID: 0 PID: 4039 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201998>] (dump_backtrace) from [<80201a8c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:82a20f78 r6:00000000 r5:82336570 r4:00000001 [<80201a74>] (show_stack) from [<8021ec68>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201a74>] (show_stack) from [<8021ec68>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120) [<8021ec0c>] (dump_stack_lvl) from [<8021ec94>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r7:82a20f78 r6:00000000 r5:8398ee40 r4:82c85d40 [<8021ec7c>] (dump_stack) from [<80202590>] (vpanic+0x114/0x320 kernel/panic.c:651) [<8020247c>] (vpanic) from [<802027d0>] (trace_suspend_resume+0x0/0x100 kernel/panic.c:788) r7:805241d4 [<8020279c>] (panic) from [<80251b50>] (check_panic_on_warn kernel/panic.c:525 [inline]) [<8020279c>] (panic) from [<80251b50>] (get_taint+0x0/0x1c kernel/panic.c:520) r3:82a0b144 r2:00000001 r1:8231c298 r0:82323c10 [<80251ad8>] (check_panic_on_warn) from [<80251ccc>] (__warn+0x98/0x1a4 kernel/panic.c:1104) [<80251c34>] (__warn) from [<80251f50>] (warn_slowpath_fmt+0x178/0x1f4 kernel/panic.c:1136) r8:00000009 r7:82352930 r6:dfbd5d4c r5:8398ee40 r4:00000000 [<80251ddc>] (warn_slowpath_fmt) from [<805241d4>] (__vmalloc_node_range_noprof+0x610/0x6a4 mm/vmalloc.c:4037) r10:ffffffff r9:ff800000 r8:00000dc0 r7:00000002 r6:10000000 r5:df800000 r4:00000000 [<80523bc4>] (__vmalloc_node_range_noprof) from [<805244d0>] (__vmalloc_node_noprof mm/vmalloc.c:4165 [inline]) [<80523bc4>] (__vmalloc_node_range_noprof) from [<805244d0>] (vzalloc_noprof+0x6c/0x74 mm/vmalloc.c:4243) r10:85791610 r9:00000000 r8:842999e4 r7:00000002 r6:10000000 r5:842999c0 r4:00000000 [<80524464>] (vzalloc_noprof) from [<80c2086c>] (zram_meta_alloc drivers/block/zram/zram_drv.c:1990 [inline]) [<80524464>] (vzalloc_noprof) from [<80c2086c>] (disksize_store+0x80/0x1dc drivers/block/zram/zram_drv.c:2880) r4:00000000 [<80c207ec>] (disksize_store) from [<80bd68c0>] (dev_attr_store+0x1c/0x28 drivers/base/core.c:2505) r10:85791610 r9:00000000 r8:83487478 r7:861187c0 r6:81d5b598 r5:80bd68a4 r4:80c207ec r3:00000002 [<80bd68a4>] (dev_attr_store) from [<8067e3b4>] (sysfs_kf_write+0x70/0x7c fs/sysfs/file.c:145) r5:80bd68a4 r4:00000002 [<8067e344>] (sysfs_kf_write) from [<8067c450>] (kernfs_fop_write_iter+0x134/0x214 fs/kernfs/file.c:345) r9:00000000 r8:00000000 r7:dfbd5f08 r6:85791600 r5:00000002 r4:861187c0 [<8067c31c>] (kernfs_fop_write_iter) from [<805a1390>] (new_sync_write fs/read_write.c:595 [inline]) [<8067c31c>] (kernfs_fop_write_iter) from [<805a1390>] (vfs_write fs/read_write.c:687 [inline]) [<8067c31c>] (kernfs_fop_write_iter) from [<805a1390>] (vfs_write+0x27c/0x42c fs/read_write.c:667) r10:81c2d60c r9:8398ee40 r8:8067c31c r7:dfbd5f68 r6:20000140 r5:86498800 r4:00000002 [<805a1114>] (vfs_write) from [<805a16b4>] (ksys_write+0x74/0xec fs/read_write.c:739) r10:00000004 r9:8398ee40 r8:8020029c r7:00000000 r6:00000000 r5:86498800 r4:86498800 [<805a1640>] (ksys_write) from [<805a173c>] (__do_sys_write fs/read_write.c:750 [inline]) [<805a1640>] (ksys_write) from [<805a173c>] (sys_write+0x10/0x14 fs/read_write.c:747) r7:00000004 r6:00356310 r5:00000000 r4:00000000 [<805a172c>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfbd5fa8 to 0xdfbd5ff0) 5fa0: 00000000 00000000 00000003 20000140 00000002 00000000 5fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000008 00000000 5fe0: 7e9507a0 7e950790 00018fa0 00130a50 Rebooting in 86400 seconds.. final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: mm/vmalloc.c:4037 at __vmalloc_node_range_noprof+0x610/0x6a4 mm/vmalloc.c:4037, CPU#0: syz.2.17/4039 Modules linked in: Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 0 UID: 0 PID: 4039 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201998>] (dump_backtrace) from [<80201a8c>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:82a20f78 r6:00000000 r5:82336570 r4:00000001 [<80201a74>] (show_stack) from [<8021ec68>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201a74>] (show_stack) from [<8021ec68>] (dump_stack_lvl+0x5c/0x70 lib/dump_stack.c:120) [<8021ec0c>] (dump_stack_lvl) from [<8021ec94>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r7:82a20f78 r6:00000000 r5:8398ee40 r4:82c85d40 [<8021ec7c>] (dump_stack) from [<80202590>] (vpanic+0x114/0x320 kernel/panic.c:651) [<8020247c>] (vpanic) from [<802027d0>] (trace_suspend_resume+0x0/0x100 kernel/panic.c:788) r7:805241d4 [<8020279c>] (panic) from [<80251b50>] (check_panic_on_warn kernel/panic.c:525 [inline]) [<8020279c>] (panic) from [<80251b50>] (get_taint+0x0/0x1c kernel/panic.c:520) r3:82a0b144 r2:00000001 r1:8231c298 r0:82323c10 [<80251ad8>] (check_panic_on_warn) from [<80251ccc>] (__warn+0x98/0x1a4 kernel/panic.c:1104) [<80251c34>] (__warn) from [<80251f50>] (warn_slowpath_fmt+0x178/0x1f4 kernel/panic.c:1136) r8:00000009 r7:82352930 r6:dfbd5d4c r5:8398ee40 r4:00000000 [<80251ddc>] (warn_slowpath_fmt) from [<805241d4>] (__vmalloc_node_range_noprof+0x610/0x6a4 mm/vmalloc.c:4037) r10:ffffffff r9:ff800000 r8:00000dc0 r7:00000002 r6:10000000 r5:df800000 r4:00000000 [<80523bc4>] (__vmalloc_node_range_noprof) from [<805244d0>] (__vmalloc_node_noprof mm/vmalloc.c:4165 [inline]) [<80523bc4>] (__vmalloc_node_range_noprof) from [<805244d0>] (vzalloc_noprof+0x6c/0x74 mm/vmalloc.c:4243) r10:85791610 r9:00000000 r8:842999e4 r7:00000002 r6:10000000 r5:842999c0 r4:00000000 [<80524464>] (vzalloc_noprof) from [<80c2086c>] (zram_meta_alloc drivers/block/zram/zram_drv.c:1990 [inline]) [<80524464>] (vzalloc_noprof) from [<80c2086c>] (disksize_store+0x80/0x1dc drivers/block/zram/zram_drv.c:2880) r4:00000000 [<80c207ec>] (disksize_store) from [<80bd68c0>] (dev_attr_store+0x1c/0x28 drivers/base/core.c:2505) r10:85791610 r9:00000000 r8:83487478 r7:861187c0 r6:81d5b598 r5:80bd68a4 r4:80c207ec r3:00000002 [<80bd68a4>] (dev_attr_store) from [<8067e3b4>] (sysfs_kf_write+0x70/0x7c fs/sysfs/file.c:145) r5:80bd68a4 r4:00000002 [<8067e344>] (sysfs_kf_write) from [<8067c450>] (kernfs_fop_write_iter+0x134/0x214 fs/kernfs/file.c:345) r9:00000000 r8:00000000 r7:dfbd5f08 r6:85791600 r5:00000002 r4:861187c0 [<8067c31c>] (kernfs_fop_write_iter) from [<805a1390>] (new_sync_write fs/read_write.c:595 [inline]) [<8067c31c>] (kernfs_fop_write_iter) from [<805a1390>] (vfs_write fs/read_write.c:687 [inline]) [<8067c31c>] (kernfs_fop_write_iter) from [<805a1390>] (vfs_write+0x27c/0x42c fs/read_write.c:667) r10:81c2d60c r9:8398ee40 r8:8067c31c r7:dfbd5f68 r6:20000140 r5:86498800 r4:00000002 [<805a1114>] (vfs_write) from [<805a16b4>] (ksys_write+0x74/0xec fs/read_write.c:739) r10:00000004 r9:8398ee40 r8:8020029c r7:00000000 r6:00000000 r5:86498800 r4:86498800 [<805a1640>] (ksys_write) from [<805a173c>] (__do_sys_write fs/read_write.c:750 [inline]) [<805a1640>] (ksys_write) from [<805a173c>] (sys_write+0x10/0x14 fs/read_write.c:747) r7:00000004 r6:00356310 r5:00000000 r4:00000000 [<805a172c>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfbd5fa8 to 0xdfbd5ff0) 5fa0: 00000000 00000000 00000003 20000140 00000002 00000000 5fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 00000008 00000000 5fe0: 7e9507a0 7e950790 00018fa0 00130a50 Rebooting in 86400 seconds..