[syzbot] go runtime error

[syzbot] go runtime error

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    9b6de136b5f0 Merge tag 'loongarch-fixes-6.7-1' of git://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=123e51cce80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=52c9552def2a0fdd
dashboard link: https://syzkaller.appspot.com/bug?extid=b8bbc03ee7bf80fc9f78
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e0b18037dc96/disk-9b6de136.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0700a526b76e/vmlinux-9b6de136.xz
kernel image: https://storage.googleapis.com/syzbot-assets/395f90da0cd9/bzImage-9b6de136.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b8bbc03ee7bf80fc9f78@syzkaller.appspotmail.com

runtime: bad span s.state=0 s.sweepgen=32678 sweepgen=242
fatal error: non in-use span in unswept list

goroutine 3 [running]:
runtime.throw({0xafea36?, 0x7fa6ac2a6b00?})
	/usr/local/go/src/runtime/panic.go:1047 +0x5d fp=0xc000055730 sp=0xc000055700 pc=0x4363dd
runtime.sweepone()
	/usr/local/go/src/runtime/mgcsweep.go:384 +0x256 fp=0xc000055780 sp=0xc000055730 pc=0x4245d6
runtime.bgsweep(0x0?)
	/usr/local/go/src/runtime/mgcsweep.go:299 +0xff fp=0xc0000557c8 sp=0xc000055780 pc=0x42425f
runtime.gcenable.func1()
	/usr/local/go/src/runtime/mgc.go:178 +0x26 fp=0xc0000557e0 sp=0xc0000557c8 pc=0x419406
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0000557e8 sp=0xc0000557e0 pc=0x469781
created by runtime.gcenable
	/usr/local/go/src/runtime/mgc.go:178 +0x6b

goroutine 1 [select]:
runtime.gopark(0xc01e9afa00?, 0x2?, 0x20?, 0xf9?, 0xc01e9af9bc?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc01e9af7f0 sp=0xc01e9af7d0 pc=0x4390f6
runtime.selectgo(0xc01e9afa00, 0xc01e9af9b8, 0xc025372570?, 0x0, 0x0?, 0x1)
	/usr/local/go/src/runtime/select.go:327 +0x7be fp=0xc01e9af930 sp=0xc01e9af7f0 pc=0x4491fe
main.(*Fuzzer).pollLoop(0xc000222600)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:385 +0x105 fp=0xc01e9afa30 sp=0xc01e9af930 pc=0x90d4c5
main.main()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:313 +0x176c fp=0xc01e9aff80 sp=0xc01e9afa30 pc=0x90cb4c
runtime.main()
	/usr/local/go/src/runtime/proc.go:250 +0x207 fp=0xc01e9affe0 sp=0xc01e9aff80 pc=0x438cc7
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc01e9affe8 sp=0xc01e9affe0 pc=0x469781

goroutine 2 [force gc (idle), 3 minutes]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000054fb0 sp=0xc000054f90 pc=0x4390f6
runtime.goparkunlock(...)
	/usr/local/go/src/runtime/proc.go:387
runtime.forcegchelper()
	/usr/local/go/src/runtime/proc.go:305 +0xb0 fp=0xc000054fe0 sp=0xc000054fb0 pc=0x438f30
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000054fe8 sp=0xc000054fe0 pc=0x469781
created by runtime.init.6
	/usr/local/go/src/runtime/proc.go:293 +0x25

goroutine 4 [GC scavenge wait]:
runtime.gopark(0x35e32c62a8?, 0x5b459955a?, 0x0?, 0x0?, 0x0?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000055f70 sp=0xc000055f50 pc=0x4390f6
runtime.goparkunlock(...)
	/usr/local/go/src/runtime/proc.go:387
runtime.(*scavengerState).park(0x1f3afe0)
	/usr/local/go/src/runtime/mgcscavenge.go:400 +0x53 fp=0xc000055fa0 sp=0xc000055f70 pc=0x422133
runtime.bgscavenge(0x0?)
	/usr/local/go/src/runtime/mgcscavenge.go:633 +0x65 fp=0xc000055fc8 sp=0xc000055fa0 pc=0x422725
runtime.gcenable.func2()
	/usr/local/go/src/runtime/mgc.go:179 +0x26 fp=0xc000055fe0 sp=0xc000055fc8 pc=0x4193a6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000055fe8 sp=0xc000055fe0 pc=0x469781
created by runtime.gcenable
	/usr/local/go/src/runtime/mgc.go:179 +0xaa

goroutine 17 [finalizer wait]:
runtime.gopark(0x0?, 0xc1dfd0?, 0x40?, 0xc6?, 0x2000000020?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000054628 sp=0xc000054608 pc=0x4390f6
runtime.runfinq()
	/usr/local/go/src/runtime/mfinal.go:193 +0x107 fp=0xc0000547e0 sp=0xc000054628 pc=0x418447
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0000547e8 sp=0xc0000547e0 pc=0x469781
created by runtime.createfing
	/usr/local/go/src/runtime/mfinal.go:163 +0x45

goroutine 18 [select]:
runtime.gopark(0xc000050788?, 0x3?, 0x90?, 0x0?, 0xc000050772?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc0000505f8 sp=0xc0000505d8 pc=0x4390f6
runtime.selectgo(0xc000050788, 0xc00005076c, 0xc0000edc00?, 0x0, 0x0?, 0x1)
	/usr/local/go/src/runtime/select.go:327 +0x7be fp=0xc000050738 sp=0xc0000505f8 pc=0x4491fe
go.opencensus.io/stats/view.(*worker).start(0xc0000edc00)
	/syzkaller/gopath/src/github.com/google/syzkaller/vendor/go.opencensus.io/stats/view/worker.go:292 +0xad fp=0xc0000507c8 sp=0xc000050738 pc=0x8ceaad
go.opencensus.io/stats/view.init.0.func1()
	/syzkaller/gopath/src/github.com/google/syzkaller/vendor/go.opencensus.io/stats/view/worker.go:34 +0x26 fp=0xc0000507e0 sp=0xc0000507c8 pc=0x8cdce6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0000507e8 sp=0xc0000507e0 pc=0x469781
created by go.opencensus.io/stats/view.init.0
	/syzkaller/gopath/src/github.com/google/syzkaller/vendor/go.opencensus.io/stats/view/worker.go:34 +0x96

goroutine 19 [GC worker (idle)]:
runtime.gopark(0x3c2f3aed6b?, 0x2?, 0xa6?, 0xd0?, 0x0?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000050f50 sp=0xc000050f30 pc=0x4390f6
runtime.gcBgMarkWorker()
	/usr/local/go/src/runtime/mgc.go:1275 +0xf1 fp=0xc000050fe0 sp=0xc000050f50 pc=0x41b171
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000050fe8 sp=0xc000050fe0 pc=0x469781
created by runtime.gcBgMarkStartWorkers
	/usr/local/go/src/runtime/mgc.go:1199 +0x25

goroutine 5 [GC worker (idle)]:
runtime.gopark(0xc1e1c8?, 0xc00003c040?, 0x1a?, 0x14?, 0x0?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000056750 sp=0xc000056730 pc=0x4390f6
runtime.gcBgMarkWorker()
	/usr/local/go/src/runtime/mgc.go:1275 +0xf1 fp=0xc0000567e0 sp=0xc000056750 pc=0x41b171
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0000567e8 sp=0xc0000567e0 pc=0x469781
created by runtime.gcBgMarkStartWorkers
	/usr/local/go/src/runtime/mgc.go:1199 +0x25

goroutine 20 [chan receive, 3 minutes]:
runtime.gopark(0xc000057688?, 0xc0000576e0?, 0xb3?, 0xc4?, 0xc0000576e0?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc0000576b0 sp=0xc000057690 pc=0x4390f6
runtime.chanrecv(0xc00009e1e0, 0x0, 0x1)
	/usr/local/go/src/runtime/chan.go:583 +0x49d fp=0xc000057740 sp=0xc0000576b0 pc=0x406f5d
runtime.chanrecv1(0xc00009e1e0?, 0xc0000577b0?)
	/usr/local/go/src/runtime/chan.go:442 +0x18 fp=0xc000057768 sp=0xc000057740 pc=0x406a98
github.com/google/syzkaller/pkg/osutil.HandleInterrupts.func1()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/osutil/osutil_unix.go:78 +0x8a fp=0xc0000577e0 sp=0xc000057768 pc=0x52ddaa
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0000577e8 sp=0xc0000577e0 pc=0x469781
created by github.com/google/syzkaller/pkg/osutil.HandleInterrupts
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/osutil/osutil_unix.go:75 +0x56

goroutine 21 [chan receive, 3 minutes]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000057ee8 sp=0xc000057ec8 pc=0x4390f6
runtime.chanrecv(0xc0000820c0, 0x0, 0x1)
	/usr/local/go/src/runtime/chan.go:583 +0x49d fp=0xc000057f78 sp=0xc000057ee8 pc=0x406f5d
runtime.chanrecv1(0x0?, 0x0?)
	/usr/local/go/src/runtime/chan.go:442 +0x18 fp=0xc000057fa0 sp=0xc000057f78 pc=0x406a98
main.main.func1()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:182 +0x1f fp=0xc000057fe0 sp=0xc000057fa0 pc=0x90cc1f
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000057fe8 sp=0xc000057fe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:180 +0x48f

goroutine 6 [select, 3 minutes, locked to thread]:
runtime.gopark(0xc000b4cfa8?, 0x2?, 0x72?, 0x94?, 0xc000b4cfa4?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4ce18 sp=0xc000b4cdf8 pc=0x4390f6
runtime.selectgo(0xc000b4cfa8, 0xc000b4cfa0, 0x0?, 0x0, 0x0?, 0x1)
	/usr/local/go/src/runtime/select.go:327 +0x7be fp=0xc000b4cf58 sp=0xc000b4ce18 pc=0x4491fe
runtime.ensureSigM.func1()
	/usr/local/go/src/runtime/signal_unix.go:1000 +0x1af fp=0xc000b4cfe0 sp=0xc000b4cf58 pc=0x46138f
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4cfe8 sp=0xc000b4cfe0 pc=0x469781
created by runtime.ensureSigM
	/usr/local/go/src/runtime/signal_unix.go:983 +0xbd

goroutine 7 [syscall, 3 minutes]:
runtime.notetsleepg(0x0?, 0x0?)
	/usr/local/go/src/runtime/lock_futex.go:236 +0x34 fp=0xc000b4d7a0 sp=0xc000b4d768 pc=0x40c554
os/signal.signal_recv()
	/usr/local/go/src/runtime/sigqueue.go:152 +0x2f fp=0xc000b4d7c0 sp=0xc000b4d7a0 pc=0x465d4f
os/signal.loop()
	/usr/local/go/src/os/signal/signal_unix.go:23 +0x19 fp=0xc000b4d7e0 sp=0xc000b4d7c0 pc=0x52c8b9
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4d7e8 sp=0xc000b4d7e0 pc=0x469781
created by os/signal.Notify.func1.1
	/usr/local/go/src/os/signal/signal.go:151 +0x2a

goroutine 23 [IO wait]:
runtime.gopark(0x1?, 0xb?, 0x0?, 0x0?, 0x3?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc01e9b1958 sp=0xc01e9b1938 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc01e9b1990 sp=0xc01e9b1958 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ad0efc28, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc01e9b19b0 sp=0xc01e9b1990 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc00078f880?, 0xc0007e3000?, 0x0)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc01e9b19d8 sp=0xc01e9b19b0 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc00078f880, {0xc0007e3000, 0x1000, 0x1000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc01e9b1a70 sp=0xc01e9b19d8 pc=0x4d8e59
net.(*netFD).Read(0xc00078f880, {0xc0007e3000?, 0x95ebe0?, 0xc0250e9848?})
	/usr/local/go/src/net/fd_posix.go:55 +0x29 fp=0xc01e9b1ab8 sp=0xc01e9b1a70 pc=0x65d9e9
net.(*conn).Read(0xc000c5b7c0, {0xc0007e3000?, 0x198?, 0x4b25fa?})
	/usr/local/go/src/net/net.go:183 +0x45 fp=0xc01e9b1b00 sp=0xc01e9b1ab8 pc=0x66f525
net.(*TCPConn).Read(0xc000b68120?, {0xc0007e3000?, 0x9e2660?, 0xc0250e9830?})
	<autogenerated>:1 +0x29 fp=0xc01e9b1b30 sp=0xc01e9b1b00 pc=0x67f789
bufio.(*Reader).fill(0xc000077da0)
	/usr/local/go/src/bufio/bufio.go:106 +0xff fp=0xc01e9b1b68 sp=0xc01e9b1b30 pc=0x50c7ff
bufio.(*Reader).ReadByte(0xc000077da0)
	/usr/local/go/src/bufio/bufio.go:265 +0x2c fp=0xc01e9b1b88 sp=0xc01e9b1b68 pc=0x50cfcc
compress/flate.(*decompressor).moreBits(0xc0008a8000)
	/usr/local/go/src/compress/flate/inflate.go:696 +0x2d fp=0xc01e9b1bc0 sp=0xc01e9b1b88 pc=0x51888d
compress/flate.(*decompressor).nextBlock(0xc0008a8000)
	/usr/local/go/src/compress/flate/inflate.go:303 +0x2e fp=0xc01e9b1bd8 sp=0xc01e9b1bc0 pc=0x516c4e
compress/flate.(*decompressor).Read(0xc0008a8000, {0xc0007fb000, 0x1000, 0xc01e9b1c80?})
	/usr/local/go/src/compress/flate/inflate.go:347 +0x7e fp=0xc01e9b1c10 sp=0xc01e9b1bd8 pc=0x516ebe
github.com/google/syzkaller/pkg/rpctype.(*flateConn).Read(0xc000b68100?, {0xc0007fb000?, 0x9eda40?, 0xc0250e9800?})
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/rpctype/rpc.go:136 +0x26 fp=0xc01e9b1c40 sp=0xc01e9b1c10 pc=0x909126
bufio.(*Reader).Read(0xc000077e00, {0xc0007b10d0, 0x1, 0xc01e9b1d70?})
	/usr/local/go/src/bufio/bufio.go:237 +0x1bb fp=0xc01e9b1c78 sp=0xc01e9b1c40 pc=0x50cddb
io.ReadAtLeast({0xcd8a20, 0xc000077e00}, {0xc0007b10d0, 0x1, 0x9}, 0x1)
	/usr/local/go/src/io/io.go:332 +0x9a fp=0xc01e9b1cc0 sp=0xc01e9b1c78 pc=0x4b25fa
io.ReadFull(...)
	/usr/local/go/src/io/io.go:351
encoding/gob.decodeUintReader({0xcd8a20?, 0xc000077e00?}, {0xc0007b10d0?, 0x9?, 0x9?})
	/usr/local/go/src/encoding/gob/decode.go:116 +0x57 fp=0xc01e9b1d18 sp=0xc01e9b1cc0 pc=0x89bfd7
encoding/gob.(*Decoder).recvMessage(0xc00078f900)
	/usr/local/go/src/encoding/gob/decoder.go:82 +0x39 fp=0xc01e9b1d50 sp=0xc01e9b1d18 pc=0x8a5b99
encoding/gob.(*Decoder).decodeTypeSequence(0xc00078f900, 0x0)
	/usr/local/go/src/encoding/gob/decoder.go:148 +0x4f fp=0xc01e9b1d80 sp=0xc01e9b1d50 pc=0x8a5f2f
encoding/gob.(*Decoder).DecodeValue(0xc00078f900, {0x957940?, 0xc000480990?, 0x7fa6d44a2a48?})
	/usr/local/go/src/encoding/gob/decoder.go:227 +0x18f fp=0xc01e9b1e00 sp=0xc01e9b1d80 pc=0x8a63cf
encoding/gob.(*Decoder).Decode(0xc00078f900, {0x957940?, 0xc000480990?})
	/usr/local/go/src/encoding/gob/decoder.go:204 +0x165 fp=0xc01e9b1e58 sp=0xc01e9b1e00 pc=0x8a61e5
net/rpc.(*gobClientCodec).ReadResponseHeader(0xa13280?, 0xc000480990?)
	/usr/local/go/src/net/rpc/client.go:228 +0x27 fp=0xc01e9b1e80 sp=0xc01e9b1e58 pc=0x8bbce7
net/rpc.(*Client).input(0xc000077ec0)
	/usr/local/go/src/net/rpc/client.go:109 +0xb4 fp=0xc01e9b1fc8 sp=0xc01e9b1e80 pc=0x8baf74
net/rpc.NewClientWithCodec.func1()
	/usr/local/go/src/net/rpc/client.go:206 +0x26 fp=0xc01e9b1fe0 sp=0xc01e9b1fc8 pc=0x8bbba6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc01e9b1fe8 sp=0xc01e9b1fe0 pc=0x469781
created by net/rpc.NewClientWithCodec
	/usr/local/go/src/net/rpc/client.go:206 +0xc5

goroutine 10 [IO wait, 1 minutes]:
runtime.gopark(0x0?, 0xb?, 0x0?, 0x0?, 0xf?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4fde8 sp=0xc000b4fdc8 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc000b4fe20 sp=0xc000b4fde8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ad0efb38, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc000b4fe40 sp=0xc000b4fe20 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc000650060?, 0xc027394000?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc000b4fe68 sp=0xc000b4fe40 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc000650060, {0xc027394000, 0x20000, 0x20000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc000b4ff00 sp=0xc000b4fe68 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c258480, {0xc027394000?, 0xc000804180?, 0xc000804120?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc000b4ff58 sp=0xc000b4ff00 pc=0x4e42be
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc0002bf030)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:629 +0x8a fp=0xc000b4ffc8 sp=0xc000b4ff58 pc=0x906e0a
github.com/google/syzkaller/pkg/ipc.makeCommand.func7()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:644 +0x2a fp=0xc000b4ffe0 sp=0xc000b4ffc8 pc=0x906d4a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4ffe8 sp=0xc000b4ffe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:623 +0xa7b

goroutine 24 [sync.Cond.Wait]:
runtime.gopark(0xc024644600?, 0x4ec65e?, 0x0?, 0x0?, 0xc00055417b?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc001f83b50 sp=0xc001f83b30 pc=0x4390f6
runtime.goparkunlock(...)
	/usr/local/go/src/runtime/proc.go:387
sync.runtime_notifyListWait(0xc000b66a10, 0x5f)
	/usr/local/go/src/runtime/sema.go:527 +0x14c fp=0xc001f83b98 sp=0xc001f83b50 pc=0x4658ec
sync.(*Cond).Wait(0xaa36db?)
	/usr/local/go/src/sync/cond.go:70 +0x8c fp=0xc001f83bd0 sp=0xc001f83b98 pc=0x4824cc
github.com/google/syzkaller/pkg/ipc.(*Gate).Enter(0xc000b66a40)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/gate.go:34 +0x3f fp=0xc001f83bf8 sp=0xc001f83bd0 pc=0x902c3f
main.(*Proc).executeRaw(0xc01ca70080, 0x0?, 0x1e8?, 0x1)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:322 +0x88 fp=0xc001f83d10 sp=0xc001f83bf8 pc=0x912e08
main.(*Proc).execute(0xc01ca70080, 0xb?, 0xc?, 0xc001f83f38?, 0x1?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:255 +0x49 fp=0xc001f83e50 sp=0xc001f83d10 pc=0x9126a9
main.(*Proc).executeAndCollide(0xc01ca70080, 0xa849df?, 0xc01e554b70?, 0xc001f83f38?, 0xc01ca70000?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:284 +0x27 fp=0xc001f83e98 sp=0xc001f83e50 pc=0x912ba7
main.(*Proc).loop(0xc01ca70080)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:97 +0x3d7 fp=0xc001f83fc8 sp=0xc001f83e98 pc=0x910bb7
main.main.func2()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x26 fp=0xc001f83fe0 sp=0xc001f83fc8 pc=0x90cbc6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc001f83fe8 sp=0xc001f83fe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x15e5

goroutine 25 [sync.Cond.Wait]:
runtime.gopark(0xc0250c9a90?, 0x4ec65e?, 0x78?, 0xfb?, 0xc00055417b?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc001f7fb50 sp=0xc001f7fb30 pc=0x4390f6
runtime.goparkunlock(...)
	/usr/local/go/src/runtime/proc.go:387
sync.runtime_notifyListWait(0xc000b66a10, 0x5d)
	/usr/local/go/src/runtime/sema.go:527 +0x14c fp=0xc001f7fb98 sp=0xc001f7fb50 pc=0x4658ec
sync.(*Cond).Wait(0xaa36db?)
	/usr/local/go/src/sync/cond.go:70 +0x8c fp=0xc001f7fbd0 sp=0xc001f7fb98 pc=0x4824cc
github.com/google/syzkaller/pkg/ipc.(*Gate).Enter(0xc000b66a40)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/gate.go:34 +0x3f fp=0xc001f7fbf8 sp=0xc001f7fbd0 pc=0x902c3f
main.(*Proc).executeRaw(0xc01ca70100, 0x0?, 0x174?, 0x1)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:322 +0x88 fp=0xc001f7fd10 sp=0xc001f7fbf8 pc=0x912e08
main.(*Proc).execute(0xc01ca70100, 0xb?, 0xc?, 0xc001f7ff38?, 0x1?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:255 +0x49 fp=0xc001f7fe50 sp=0xc001f7fd10 pc=0x9126a9
main.(*Proc).executeAndCollide(0xc01ca70100, 0xa849df?, 0xc01e554ba0?, 0xc001f7ff38?, 0xc01ca70000?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:284 +0x27 fp=0xc001f7fe98 sp=0xc001f7fe50 pc=0x912ba7
main.(*Proc).loop(0xc01ca70100)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:97 +0x3d7 fp=0xc001f7ffc8 sp=0xc001f7fe98 pc=0x910bb7
main.main.func2()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x26 fp=0xc001f7ffe0 sp=0xc001f7ffc8 pc=0x90cbc6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc001f7ffe8 sp=0xc001f7ffe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x15e5

goroutine 26 [IO wait]:
runtime.gopark(0x540ee0?, 0xb?, 0x0?, 0x0?, 0x25?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc001f817a8 sp=0xc001f81788 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc001f817e0 sp=0xc001f817a8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ac154570, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc001f81800 sp=0xc001f817e0 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc0006507e0?, 0xc01ed369f0?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc001f81828 sp=0xc001f81800 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc0006507e0, {0xc01ed369f0, 0xc, 0xc})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc001f818c0 sp=0xc001f81828 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c2584f0, {0xc01ed369f0?, 0xc001f81950?, 0x40de47?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc001f81918 sp=0xc001f818c0 pc=0x4e42be
io.ReadAtLeast({0xcdbc00, 0xc01c2584f0}, {0xc01ed369f0, 0xc, 0xc}, 0xc)
	/usr/local/go/src/io/io.go:332 +0x9a fp=0xc001f81960 sp=0xc001f81918 pc=0x4b25fa
io.ReadFull(...)
	/usr/local/go/src/io/io.go:351
github.com/google/syzkaller/pkg/ipc.(*command).exec(0xc0002bf0a0, 0x7fa6a924c000?, {0x0, 0x0, 0x0})
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:786 +0x559 fp=0xc001f81b18 sp=0xc001f81960 pc=0x907d19
github.com/google/syzkaller/pkg/ipc.(*Env).Exec(0xc000218750, 0xc01ecc2801?, 0xc01ecc6140)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:286 +0x24e fp=0xc001f81bf8 sp=0xc001f81b18 pc=0x903d4e
main.(*Proc).executeRaw(0xc01ca701c0, 0x484b7e?, 0xc01ed366a0?, 0x1)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:328 +0x1bc fp=0xc001f81d10 sp=0xc001f81bf8 pc=0x912f3c
main.(*Proc).execute(0xc01ca701c0, 0xb?, 0xc?, 0xc001f81f38?, 0x1?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:255 +0x49 fp=0xc001f81e50 sp=0xc001f81d10 pc=0x9126a9
main.(*Proc).executeAndCollide(0xc01ca701c0, 0xa849df?, 0xc01e554bd0?, 0xc001f81f38?, 0xc01ca70000?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:284 +0x27 fp=0xc001f81e98 sp=0xc001f81e50 pc=0x912ba7
main.(*Proc).loop(0xc01ca701c0)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:97 +0x3d7 fp=0xc001f81fc8 sp=0xc001f81e98 pc=0x910bb7
main.main.func2()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x26 fp=0xc001f81fe0 sp=0xc001f81fc8 pc=0x90cbc6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc001f81fe8 sp=0xc001f81fe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x15e5

goroutine 27 [runnable]:
runtime.mapaccess1_fast64(0x999340, 0xc001b1d120, 0xc002f5ff80)
	/usr/local/go/src/runtime/map_fast64.go:13 +0x17f fp=0xc001b1cf98 sp=0xc001b1cf90 pc=0x411e1f
github.com/google/syzkaller/prog.clone({0xcdf5c0?, 0xc0030ee0c0?}, 0xc001b1d120)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/clone.go:81 +0x49b fp=0xc001b1d050 sp=0xc001b1cf98 pc=0x5474bb
github.com/google/syzkaller/prog.cloneCall(0xc0023bf7c0, 0xa1fd60?)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/clone.go:36 +0x15a fp=0xc001b1d0a0 sp=0xc001b1d050 pc=0x546f7a
github.com/google/syzkaller/prog.cloneCalls({0xc00305cb00, 0x8, 0x0?}, 0x0?)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/clone.go:23 +0x67 fp=0xc001b1d0e0 sp=0xc001b1d0a0 pc=0x546da7
github.com/google/syzkaller/prog.(*Prog).Clone(0xc00305c940)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/clone.go:14 +0x96 fp=0xc001b1d1f0 sp=0xc001b1d0e0 pc=0x546c76
github.com/google/syzkaller/prog.(*randGen).resourceCentric(0xc02772afe0, 0xc011eec7d0, 0x11ca8e0, 0x0?)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:917 +0xb0 fp=0xc001b1d340 sp=0xc001b1d1f0 pc=0x56a990
github.com/google/syzkaller/prog.(*ResourceType).generate(0x11ca8e0, 0xc02772afe0, 0x94f640?, 0xc0?)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:732 +0xd4 fp=0xc001b1d3d8 sp=0xc001b1d340 pc=0x568674
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc02772afe0, 0xc011eec7d0, {0xce5670?, 0x11ca8e0?}, 0x2, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:720 +0x606 fp=0xc001b1d498 sp=0xc001b1d3d8 pc=0x5683e6
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:670
github.com/google/syzkaller/prog.(*randGen).generateArgs(0x25e51c98?, 0x412f22?, {0x12fa500, 0x2, 0x2}, 0x2)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:658 +0x17b fp=0xc001b1d568 sp=0xc001b1d498 pc=0x567c1b
github.com/google/syzkaller/prog.(*StructType).generate(0x12fa4a0, 0xc0004800c0?, 0xb182a7?, 0x2)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:856 +0x45 fp=0xc001b1d5e0 sp=0xc001b1d568 pc=0x569b45
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc02772afe0, 0xc011eec7d0, {0xce5738?, 0x12fa4a0?}, 0x2, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:720 +0x606 fp=0xc001b1d6a0 sp=0xc001b1d5e0 pc=0x5683e6
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:670
github.com/google/syzkaller/prog.(*ArrayType).generate(0x12e52c0, 0xc02772afe0, 0x0?, 0x2)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:848 +0x22c fp=0xc001b1d770 sp=0xc001b1d6a0 pc=0x56990c
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc02772afe0, 0xc011eec7d0, {0xce4f68?, 0x12e52c0?}, 0x2, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:720 +0x606 fp=0xc001b1d830 sp=0xc001b1d770 pc=0x5683e6
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:670
github.com/google/syzkaller/prog.(*randGen).generateArgs(0xcdf500?, 0x412f22?, {0x186a0a0, 0x4, 0x4}, 0x2)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:658 +0x17b fp=0xc001b1d900 sp=0xc001b1d830 pc=0x567c1b
github.com/google/syzkaller/prog.(*StructType).generate(0x12fa440, 0xc0004800c0?, 0xb0e197?, 0x2)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:856 +0x45 fp=0xc001b1d978 sp=0xc001b1d900 pc=0x569b45
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc02772afe0, 0xc011eec7d0, {0xce5738?, 0x12fa440?}, 0x2, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:720 +0x606 fp=0xc001b1da38 sp=0xc001b1d978 pc=0x5683e6
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:670
github.com/google/syzkaller/prog.(*PtrType).generate(0x1214620, 0xc02772afe0, 0x415c70?, 0x0?)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:875 +0x85 fp=0xc001b1dac0 sp=0xc001b1da38 pc=0x569e45
github.com/google/syzkaller/prog.(*randGen).generateArgImpl(0xc02772afe0, 0xc011eec7d0, {0xce55a8?, 0x1214620?}, 0x0, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:720 +0x606 fp=0xc001b1db80 sp=0xc001b1dac0 pc=0x5683e6
github.com/google/syzkaller/prog.(*randGen).generateArg(...)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:670
github.com/google/syzkaller/prog.(*randGen).generateArgs(0x19334a0?, 0x0?, {0x166cc60, 0x3, 0x3}, 0x0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:658 +0x17b fp=0xc001b1dc50 sp=0xc001b1db80 pc=0x567c1b
github.com/google/syzkaller/prog.(*randGen).generateParticularCall(0xc02772afe0, 0xc011eec7d0?, 0x19334a0)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:584 +0x85 fp=0xc001b1dcd8 sp=0xc001b1dc50 pc=0x566ce5
github.com/google/syzkaller/prog.(*randGen).generateCall(0xc02772afe0, 0xc011eec7d0, 0xc0075436c0?, 0xc007543600?)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/rand.go:573 +0xb6 fp=0xc001b1dd00 sp=0xc001b1dcd8 pc=0x566bf6
github.com/google/syzkaller/prog.(*mutator).insertCall(0xc001b1de48)
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:152 +0xc5 fp=0xc001b1ddc0 sp=0xc001b1dd00 pc=0x55a405
github.com/google/syzkaller/prog.(*Prog).Mutate(0xc0075436c0, {0xcdd528?, 0xc01e554c00}, 0x1e, 0xc01ca70000, 0xc000480390, {0xc01f420000, 0x480a, 0x5400})
	/syzkaller/gopath/src/github.com/google/syzkaller/prog/mutation.go:49 +0x2ac fp=0xc001b1de98 sp=0xc001b1ddc0 pc=0x5596ec
main.(*Proc).loop(0xc01ca70300)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:95 +0x365 fp=0xc001b1dfc8 sp=0xc001b1de98 pc=0x910b45
main.main.func2()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x26 fp=0xc001b1dfe0 sp=0xc001b1dfc8 pc=0x90cbc6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc001b1dfe8 sp=0xc001b1dfe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x15e5

goroutine 28 [IO wait]:
runtime.gopark(0x540ee0?, 0xb?, 0x0?, 0x0?, 0x21?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc01e9ab7a8 sp=0xc01e9ab788 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc01e9ab7e0 sp=0xc01e9ab7a8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ac153c10, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc01e9ab800 sp=0xc01e9ab7e0 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc000650fc0?, 0xc020db47f0?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc01e9ab828 sp=0xc01e9ab800 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc000650fc0, {0xc020db47f0, 0xc, 0xc})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc01e9ab8c0 sp=0xc01e9ab828 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c258590, {0xc020db47f0?, 0xc01e9ab950?, 0x40de47?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc01e9ab918 sp=0xc01e9ab8c0 pc=0x4e42be
io.ReadAtLeast({0xcdbc00, 0xc01c258590}, {0xc020db47f0, 0xc, 0xc}, 0xc)
	/usr/local/go/src/io/io.go:332 +0x9a fp=0xc01e9ab960 sp=0xc01e9ab918 pc=0x4b25fa
io.ReadFull(...)
	/usr/local/go/src/io/io.go:351
github.com/google/syzkaller/pkg/ipc.(*command).exec(0xc0002bf1f0, 0x7fa6a6a4c000?, {0x0, 0x0, 0x0})
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:786 +0x559 fp=0xc01e9abb18 sp=0xc01e9ab960 pc=0x907d19
github.com/google/syzkaller/pkg/ipc.(*Env).Exec(0xc000218870, 0x1?, 0xc020dc6040)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:286 +0x24e fp=0xc01e9abbf8 sp=0xc01e9abb18 pc=0x903d4e
main.(*Proc).executeRaw(0xc01ca70380, 0x484b7e?, 0xc020db4490?, 0x1)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:328 +0x1bc fp=0xc01e9abd10 sp=0xc01e9abbf8 pc=0x912f3c
main.(*Proc).execute(0xc01ca70380, 0xb?, 0xc?, 0xc01e9abf38?, 0x1?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:255 +0x49 fp=0xc01e9abe50 sp=0xc01e9abd10 pc=0x9126a9
main.(*Proc).executeAndCollide(0xc01ca70380, 0xa849df?, 0xc01e554c30?, 0xc01e9abf38?, 0xc01ca70000?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:284 +0x27 fp=0xc01e9abe98 sp=0xc01e9abe50 pc=0x912ba7
main.(*Proc).loop(0xc01ca70380)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:97 +0x3d7 fp=0xc01e9abfc8 sp=0xc01e9abe98 pc=0x910bb7
main.main.func2()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x26 fp=0xc01e9abfe0 sp=0xc01e9abfc8 pc=0x90cbc6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc01e9abfe8 sp=0xc01e9abfe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x15e5

goroutine 29 [sync.Cond.Wait]:
runtime.gopark(0xc0250cb660?, 0xc0250cb640?, 0x20?, 0x0?, 0x20?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc002607c90 sp=0xc002607c70 pc=0x4390f6
runtime.goparkunlock(...)
	/usr/local/go/src/runtime/proc.go:387
sync.runtime_notifyListWait(0xc000b66a10, 0x5e)
	/usr/local/go/src/runtime/sema.go:527 +0x14c fp=0xc002607cd8 sp=0xc002607c90 pc=0x4658ec
sync.(*Cond).Wait(0xc002607d68?)
	/usr/local/go/src/sync/cond.go:70 +0x8c fp=0xc002607d10 sp=0xc002607cd8 pc=0x4824cc
github.com/google/syzkaller/pkg/ipc.(*Gate).Enter(0xc000b66a40)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/gate.go:34 +0x3f fp=0xc002607d38 sp=0xc002607d10 pc=0x902c3f
main.(*Proc).executeRaw(0xc01ca70480, 0xb?, 0xc?, 0x8)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:322 +0x88 fp=0xc002607e50 sp=0xc002607d38 pc=0x912e08
main.(*Proc).executeAndCollide(0xc01ca70480, 0xa849df?, 0xc01e554c60?, 0xc002607f38?, 0xc01ca70000?)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:292 +0x72 fp=0xc002607e98 sp=0xc002607e50 pc=0x912bf2
main.(*Proc).loop(0xc01ca70480)
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/proc.go:97 +0x3d7 fp=0xc002607fc8 sp=0xc002607e98 pc=0x910bb7
main.main.func2()
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x26 fp=0xc002607fe0 sp=0xc002607fc8 pc=0x90cbc6
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc002607fe8 sp=0xc002607fe0 pc=0x469781
created by main.main
	/syzkaller/gopath/src/github.com/google/syzkaller/syz-fuzzer/fuzzer.go:310 +0x15e5

goroutine 11 [syscall, 1 minutes]:
syscall.Syscall6(0xc01ca6e050?, 0x0?, 0x0?, 0x0?, 0x1?, 0xc000056e88?, 0x90f41f?)
	/usr/local/go/src/syscall/syscall_linux.go:91 +0x36 fp=0xc000056de0 sp=0xc000056d58 pc=0x4be516
os.(*Process).blockUntilWaitable(0xc01e5384e0)
	/usr/local/go/src/os/wait_waitid.go:32 +0x87 fp=0xc000056eb8 sp=0xc000056de0 pc=0x4ea887
os.(*Process).wait(0xc01e5384e0)
	/usr/local/go/src/os/exec_unix.go:22 +0x28 fp=0xc000056f18 sp=0xc000056eb8 pc=0x4e3b08
os.(*Process).Wait(...)
	/usr/local/go/src/os/exec.go:132
os/exec.(*Cmd).Wait(0xc019bea840)
	/usr/local/go/src/os/exec/exec.go:890 +0x45 fp=0xc000056f80 sp=0xc000056f18 pc=0x5283a5
github.com/google/syzkaller/pkg/ipc.makeCommand.func3(0xc0002bf030)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:652 +0x32 fp=0xc000056fc8 sp=0xc000056f80 pc=0x906c92
github.com/google/syzkaller/pkg/ipc.makeCommand.func8()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:657 +0x2a fp=0xc000056fe0 sp=0xc000056fc8 pc=0x906c2a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000056fe8 sp=0xc000056fe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:651 +0xc7c

goroutine 367 [select]:
runtime.gopark(0xc000b4a7b0?, 0x2?, 0x90?, 0xa0?, 0xc000b4a78c?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4a618 sp=0xc000b4a5f8 pc=0x4390f6
runtime.selectgo(0xc000b4a7b0, 0xc000b4a788, 0x4c9ff7?, 0x0, 0x906ce7?, 0x1)
	/usr/local/go/src/runtime/select.go:327 +0x7be fp=0xc000b4a758 sp=0xc000b4a618 pc=0x4491fe
github.com/google/syzkaller/pkg/ipc.(*command).exec.func1()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:771 +0x7d fp=0xc000b4a7e0 sp=0xc000b4a758 pc=0x90841d
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4a7e8 sp=0xc000b4a7e0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.(*command).exec
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:769 +0x25b

goroutine 31 [IO wait, 1 minutes]:
runtime.gopark(0x0?, 0xb?, 0x0?, 0x0?, 0x10?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000051de8 sp=0xc000051dc8 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc000051e20 sp=0xc000051de8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ad0ef2c8, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc000051e40 sp=0xc000051e20 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc0016ad2c0?, 0xc027434000?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc000051e68 sp=0xc000051e40 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc0016ad2c0, {0xc027434000, 0x20000, 0x20000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc000051f00 sp=0xc000051e68 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc0155f39a0, {0xc027434000?, 0x4807?, 0x5400?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc000051f58 sp=0xc000051f00 pc=0x4e42be
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc0003975e0)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:629 +0x8a fp=0xc000051fc8 sp=0xc000051f58 pc=0x906e0a
github.com/google/syzkaller/pkg/ipc.makeCommand.func7()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:644 +0x2a fp=0xc000051fe0 sp=0xc000051fc8 pc=0x906d4a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000051fe8 sp=0xc000051fe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:623 +0xa7b

goroutine 15 [IO wait, 1 minutes]:
runtime.gopark(0x0?, 0xb?, 0x0?, 0x0?, 0x23?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4b5e8 sp=0xc000b4b5c8 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc000b4b620 sp=0xc000b4b5e8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ad0eee18, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc000b4b640 sp=0xc000b4b620 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc000650720?, 0xc0273d4000?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc000b4b668 sp=0xc000b4b640 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc000650720, {0xc0273d4000, 0x20000, 0x20000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc000b4b700 sp=0xc000b4b668 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c2584d0, {0xc0273d4000?, 0x0?, 0x1d0cb50?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc000b4b758 sp=0xc000b4b700 pc=0x4e42be
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc0002bf0a0)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:629 +0x8a fp=0xc000b4b7c8 sp=0xc000b4b758 pc=0x906e0a
github.com/google/syzkaller/pkg/ipc.makeCommand.func7()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:644 +0x2a fp=0xc000b4b7e0 sp=0xc000b4b7c8 pc=0x906d4a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4b7e8 sp=0xc000b4b7e0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:623 +0xa7b

goroutine 16 [IO wait, 1 minutes]:
runtime.gopark(0x0?, 0xb?, 0x0?, 0x0?, 0x2a?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4bde8 sp=0xc000b4bdc8 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc000b4be20 sp=0xc000b4bde8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ac1541b0, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc000b4be40 sp=0xc000b4be20 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc000650a80?, 0xc0273f4000?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc000b4be68 sp=0xc000b4be40 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc000650a80, {0xc0273f4000, 0x20000, 0x20000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc000b4bf00 sp=0xc000b4be68 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c258530, {0xc0273f4000?, 0x0?, 0x1c197e0?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc000b4bf58 sp=0xc000b4bf00 pc=0x4e42be
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc0002bf180)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:629 +0x8a fp=0xc000b4bfc8 sp=0xc000b4bf58 pc=0x906e0a
github.com/google/syzkaller/pkg/ipc.makeCommand.func7()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:644 +0x2a fp=0xc000b4bfe0 sp=0xc000b4bfc8 pc=0x906d4a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4bfe8 sp=0xc000b4bfe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:623 +0xa7b

goroutine 33 [syscall, 1 minutes]:
syscall.Syscall6(0x0?, 0x0?, 0x0?, 0x0?, 0x0?, 0x402020302020302?, 0x0?)
	/usr/local/go/src/syscall/syscall_linux.go:91 +0x36 fp=0xc000b4c5e0 sp=0xc000b4c558 pc=0x4be516
os.(*Process).blockUntilWaitable(0xc01e5387e0)
	/usr/local/go/src/os/wait_waitid.go:32 +0x87 fp=0xc000b4c6b8 sp=0xc000b4c5e0 pc=0x4ea887
os.(*Process).wait(0xc01e5387e0)
	/usr/local/go/src/os/exec_unix.go:22 +0x28 fp=0xc000b4c718 sp=0xc000b4c6b8 pc=0x4e3b08
os.(*Process).Wait(...)
	/usr/local/go/src/os/exec.go:132
os/exec.(*Cmd).Wait(0xc001c6a160)
	/usr/local/go/src/os/exec/exec.go:890 +0x45 fp=0xc000b4c780 sp=0xc000b4c718 pc=0x5283a5
github.com/google/syzkaller/pkg/ipc.makeCommand.func3(0xc0003975e0)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:652 +0x32 fp=0xc000b4c7c8 sp=0xc000b4c780 pc=0x906c92
github.com/google/syzkaller/pkg/ipc.makeCommand.func8()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:657 +0x2a fp=0xc000b4c7e0 sp=0xc000b4c7c8 pc=0x906c2a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4c7e8 sp=0xc000b4c7e0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:651 +0xc7c

goroutine 302 [IO wait]:
runtime.gopark(0x0?, 0xb?, 0x0?, 0x0?, 0x15?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4dde8 sp=0xc000b4ddc8 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc000b4de20 sp=0xc000b4dde8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ad0ef0e8, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc000b4de40 sp=0xc000b4de20 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc01765ef60?, 0xc0120fc000?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc000b4de68 sp=0xc000b4de40 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc01765ef60, {0xc0120fc000, 0x20000, 0x20000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc000b4df00 sp=0xc000b4de68 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c2585d8, {0xc0120fc000?, 0xc01911a1c8?, 0x0?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc000b4df58 sp=0xc000b4df00 pc=0x4e42be
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc00041d180)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:629 +0x8a fp=0xc000b4dfc8 sp=0xc000b4df58 pc=0x906e0a
github.com/google/syzkaller/pkg/ipc.makeCommand.func7()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:644 +0x2a fp=0xc000b4dfe0 sp=0xc000b4dfc8 pc=0x906d4a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4dfe8 sp=0xc000b4dfe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:623 +0xa7b

goroutine 35 [IO wait, 1 minutes]:
runtime.gopark(0x0?, 0xb?, 0x0?, 0x0?, 0x13?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000b4e5e8 sp=0xc000b4e5c8 pc=0x4390f6
runtime.netpollblock(0x4bc5a5?, 0x40482f?, 0x0?)
	/usr/local/go/src/runtime/netpoll.go:527 +0xf7 fp=0xc000b4e620 sp=0xc000b4e5e8 pc=0x431a57
internal/poll.runtime_pollWait(0x7fa6ad0efa48, 0x72)
	/usr/local/go/src/runtime/netpoll.go:306 +0x89 fp=0xc000b4e640 sp=0xc000b4e620 pc=0x463b49
internal/poll.(*pollDesc).wait(0xc000650f00?, 0xc027414000?, 0x1)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32 fp=0xc000b4e668 sp=0xc000b4e640 pc=0x4d7a72
internal/poll.(*pollDesc).waitRead(...)
	/usr/local/go/src/internal/poll/fd_poll_runtime.go:89
internal/poll.(*FD).Read(0xc000650f00, {0xc027414000, 0x20000, 0x20000})
	/usr/local/go/src/internal/poll/fd_unix.go:167 +0x299 fp=0xc000b4e700 sp=0xc000b4e668 pc=0x4d8e59
os.(*File).read(...)
	/usr/local/go/src/os/file_posix.go:31
os.(*File).Read(0xc01c258578, {0xc027414000?, 0x0?, 0x12cecb0?})
	/usr/local/go/src/os/file.go:118 +0x5e fp=0xc000b4e758 sp=0xc000b4e700 pc=0x4e42be
github.com/google/syzkaller/pkg/ipc.makeCommand.func2(0xc0002bf1f0)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:629 +0x8a fp=0xc000b4e7c8 sp=0xc000b4e758 pc=0x906e0a
github.com/google/syzkaller/pkg/ipc.makeCommand.func7()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:644 +0x2a fp=0xc000b4e7e0 sp=0xc000b4e7c8 pc=0x906d4a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4e7e8 sp=0xc000b4e7e0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:623 +0xa7b

goroutine 32 [syscall, 1 minutes]:
syscall.Syscall6(0xc01ca70000?, 0x0?, 0x0?, 0x0?, 0xc00078f900?, 0xc000051688?, 0x90f41f?)
	/usr/local/go/src/syscall/syscall_linux.go:91 +0x36 fp=0xc0000515e0 sp=0xc000051558 pc=0x4be516
os.(*Process).blockUntilWaitable(0xc00bc1f7a0)
	/usr/local/go/src/os/wait_waitid.go:32 +0x87 fp=0xc0000516b8 sp=0xc0000515e0 pc=0x4ea887
os.(*Process).wait(0xc00bc1f7a0)
	/usr/local/go/src/os/exec_unix.go:22 +0x28 fp=0xc000051718 sp=0xc0000516b8 pc=0x4e3b08
os.(*Process).Wait(...)
	/usr/local/go/src/os/exec.go:132
os/exec.(*Cmd).Wait(0xc019bea9a0)
	/usr/local/go/src/os/exec/exec.go:890 +0x45 fp=0xc000051780 sp=0xc000051718 pc=0x5283a5
github.com/google/syzkaller/pkg/ipc.makeCommand.func3(0xc0002bf0a0)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:652 +0x32 fp=0xc0000517c8 sp=0xc000051780 pc=0x906c92
github.com/google/syzkaller/pkg/ipc.makeCommand.func8()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:657 +0x2a fp=0xc0000517e0 sp=0xc0000517c8 pc=0x906c2a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc0000517e8 sp=0xc0000517e0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:651 +0xc7c

goroutine 36 [syscall, 1 minutes]:
syscall.Syscall6(0x0?, 0x0?, 0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/usr/local/go/src/syscall/syscall_linux.go:91 +0x36 fp=0xc002a31de0 sp=0xc002a31d58 pc=0x4be516
os.(*Process).blockUntilWaitable(0xc01e538960)
	/usr/local/go/src/os/wait_waitid.go:32 +0x87 fp=0xc002a31eb8 sp=0xc002a31de0 pc=0x4ea887
os.(*Process).wait(0xc01e538960)
	/usr/local/go/src/os/exec_unix.go:22 +0x28 fp=0xc002a31f18 sp=0xc002a31eb8 pc=0x4e3b08
os.(*Process).Wait(...)
	/usr/local/go/src/os/exec.go:132
os/exec.(*Cmd).Wait(0xc019beab00)
	/usr/local/go/src/os/exec/exec.go:890 +0x45 fp=0xc002a31f80 sp=0xc002a31f18 pc=0x5283a5
github.com/google/syzkaller/pkg/ipc.makeCommand.func3(0xc0002bf180)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:652 +0x32 fp=0xc002a31fc8 sp=0xc002a31f80 pc=0x906c92
github.com/google/syzkaller/pkg/ipc.makeCommand.func8()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:657 +0x2a fp=0xc002a31fe0 sp=0xc002a31fc8 pc=0x906c2a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc002a31fe8 sp=0xc002a31fe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:651 +0xc7c

goroutine 50 [syscall, 1 minutes]:
syscall.Syscall6(0xc01ca70000?, 0x0?, 0x0?, 0x0?, 0x19e4260?, 0xc000b4ee88?, 0x90f41f?)
	/usr/local/go/src/syscall/syscall_linux.go:91 +0x36 fp=0xc000b4ede0 sp=0xc000b4ed58 pc=0x4be516
os.(*Process).blockUntilWaitable(0xc00bc1f8c0)
	/usr/local/go/src/os/wait_waitid.go:32 +0x87 fp=0xc000b4eeb8 sp=0xc000b4ede0 pc=0x4ea887
os.(*Process).wait(0xc00bc1f8c0)
	/usr/local/go/src/os/exec_unix.go:22 +0x28 fp=0xc000b4ef18 sp=0xc000b4eeb8 pc=0x4e3b08
os.(*Process).Wait(...)
	/usr/local/go/src/os/exec.go:132
os/exec.(*Cmd).Wait(0xc019beac60)
	/usr/local/go/src/os/exec/exec.go:890 +0x45 fp=0xc000b4ef80 sp=0xc000b4ef18 pc=0x5283a5
github.com/google/syzkaller/pkg/ipc.makeCommand.func3(0xc0002bf1f0)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:652 +0x32 fp=0xc000b4efc8 sp=0xc000b4ef80 pc=0x906c92
github.com/google/syzkaller/pkg/ipc.makeCommand.func8()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:657 +0x2a fp=0xc000b4efe0 sp=0xc000b4efc8 pc=0x906c2a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000b4efe8 sp=0xc000b4efe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:651 +0xc7c

goroutine 360 [select]:
runtime.gopark(0xc000053fb0?, 0x2?, 0xc0?, 0x26?, 0xc000053f8c?)
	/usr/local/go/src/runtime/proc.go:381 +0xd6 fp=0xc000053e18 sp=0xc000053df8 pc=0x4390f6
runtime.selectgo(0xc000053fb0, 0xc000053f88, 0x0?, 0x0, 0x0?, 0x1)
	/usr/local/go/src/runtime/select.go:327 +0x7be fp=0xc000053f58 sp=0xc000053e18 pc=0x4491fe
github.com/google/syzkaller/pkg/ipc.(*command).exec.func1()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:771 +0x7d fp=0xc000053fe0 sp=0xc000053f58 pc=0x90841d
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc000053fe8 sp=0xc000053fe0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.(*command).exec
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:769 +0x25b

goroutine 303 [syscall]:
syscall.Syscall6(0xc002a30608?, 0x4488f3?, 0x4390f6?, 0x1?, 0x0?, 0xc002a30748?, 0x4497b4?)
	/usr/local/go/src/syscall/syscall_linux.go:91 +0x36 fp=0xc002a305e0 sp=0xc002a30558 pc=0x4be516
os.(*Process).blockUntilWaitable(0xc00477b980)
	/usr/local/go/src/os/wait_waitid.go:32 +0x87 fp=0xc002a306b8 sp=0xc002a305e0 pc=0x4ea887
os.(*Process).wait(0xc00477b980)
	/usr/local/go/src/os/exec_unix.go:22 +0x28 fp=0xc002a30718 sp=0xc002a306b8 pc=0x4e3b08
os.(*Process).Wait(...)
	/usr/local/go/src/os/exec.go:132
os/exec.(*Cmd).Wait(0xc001c6b760)
	/usr/local/go/src/os/exec/exec.go:890 +0x45 fp=0xc002a30780 sp=0xc002a30718 pc=0x5283a5
github.com/google/syzkaller/pkg/ipc.makeCommand.func3(0xc00041d180)
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:652 +0x32 fp=0xc002a307c8 sp=0xc002a30780 pc=0x906c92
github.com/google/syzkaller/pkg/ipc.makeCommand.func8()
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:657 +0x2a fp=0xc002a307e0 sp=0xc002a307c8 pc=0x906c2a
runtime.goexit()
	/usr/local/go/src/runtime/asm_amd64.s:1598 +0x1 fp=0xc002a307e8 sp=0xc002a307e0 pc=0x469781
created by github.com/google/syzkaller/pkg/ipc.makeCommand
	/syzkaller/gopath/src/github.com/google/syzkaller/pkg/ipc/ipc.go:651 +0xc7c


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] go runtime error

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    610a689d2a57 Merge branch 'rtnl-rcu'
git tree:       net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12ded821e80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df5e944701db1d04
dashboard link: https://syzkaller.appspot.com/bug?extid=b8bbc03ee7bf80fc9f78
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16da084ee80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f1698c13981a/disk-610a689d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/21213e55dd47/vmlinux-610a689d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3f85e89cca69/bzImage-610a689d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b8bbc03ee7bf80fc9f78@syzkaller.appspotmail.com

fatal error: Connection to 10.128.1.63 closed by remote host.


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Shouldn't be there

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

See the discussion at
https://lore.kernel.org/all/6a88012e.dbb3a75c.13dd47.0007.GAE@google.com/T/

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: adrianox@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz set subsystems: kvm

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Hasn't happened for a while

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz dup: general protection fault in dummy_udc_start

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jeffinphilip14@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
51cb1aa1250c36269474b8b6ca6b6319e170f5a5

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Hasn't happened in a while

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Hasn't happened in a long while.

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Hasn't happened in a long while

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Hasn't happened in a long while

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Hasn't happened for a long while

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
58717b2a1365

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: joshua.crofts1@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

Let's check if the command works.

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

Apparently, already fixed.

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

Hasn't been happening in a long while.

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

hasn't happened in a while

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

It hasn't been happening in a very long time.

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Actually already fixed

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Fixed long ago

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Actually fixed long ago.

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Doesn't happen for a long time in fact.

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

The bug has actually been already fixed.

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

The bug is actually no longer present.

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

The bug is actually fixed long time ago.

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: daiky0325@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: halves@igalia.com

#syz test

--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -147,6 +147,7 @@ int dvb_generic_open(struct inode *inode, struct file *file)
                dvbdev->writers--;
        }

+       dvb_device_get(dvbdev);
        dvbdev->users--;
        return 0;
 }
-- 
2.53.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: klnm1908v@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index 91fd3673c09a..e588a188f50a 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -126,23 +126,10 @@ static enum hrtimer_restart
xen_timer_callback(struct hrtimer *timer)
 {
 	struct kvm_vcpu *vcpu = container_of(timer, struct kvm_vcpu,
 					     arch.xen.timer);
-	struct kvm_xen_evtchn e;
-	int rc;

 	if (atomic_read(&vcpu->arch.xen.timer_pending))
 		return HRTIMER_NORESTART;

-	e.vcpu_id = vcpu->vcpu_id;
-	e.vcpu_idx = vcpu->vcpu_idx;
-	e.port = vcpu->arch.xen.timer_virq;
-	e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
-
-	rc = kvm_xen_set_evtchn_fast(&e, vcpu->kvm);
-	if (rc != -EWOULDBLOCK) {
-		vcpu->arch.xen.timer_expires = 0;
-		return HRTIMER_NORESTART;
-	}
-
 	atomic_inc(&vcpu->arch.xen.timer_pending);
 	kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
 	kvm_vcpu_kick(vcpu);

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: contact@gvernon.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: pimyn@google.com

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: agruenba@redhat.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
4daba9379bbd702c63459f54ef448746bfeab42d

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/minix/inode.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 7897f5123b3d..bee191c50010 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -171,7 +171,15 @@ static bool minix_check_superblock(struct super_block *sb)
 {
 	struct minix_sb_info *sbi = minix_sb(sb);
 
-	if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+	if (sbi->s_log_zone_size != 0) {
+		printk("minix-fs error: zone size must equal block size. "
+		       "s_log_zone_size > 0 is not supported.\n");
+		return false;
+	}
+
+	if (sbi->s_imap_blocks < 1 || sbi->s_zmap_blocks < 1 ||
+	    sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
+	    sbi->s_firstdatazone >= sbi->s_nzones)
 		return false;
 
 	/*
-- 
2.51.2

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: eslam.medhat1993@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: eslam.medhat1993@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: eslam.medhat1993@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: eslam.medhat1993@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: eslam.medhat1993@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: eslam.medhat1993@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz dup: WARNING in ntfs_put_super

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---

diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
 	int res;
 
 	inode = hfs_new_inode(dir, &dentry->d_name, mode);
-	if (!inode)
-		return -ENOMEM;
+	if (IS_ERR(inode))
+		return PTR_ERR(inode);
 
 	res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
 	if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
 	int res;
 
 	inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
-	if (!inode)
-		return ERR_PTR(-ENOMEM);
+	if (IS_ERR(inode))
+		return ERR_CAST(inode);
 
 	res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
 	if (res) {
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..beec6fe7e801 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -186,16 +186,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	s64 next_id;
 	s64 file_count;
 	s64 folder_count;
+	int err = -ENOMEM;
 
 	if (!inode)
-		return NULL;
+		goto out_err;
+
+	err = -ENOSPC;
 
 	mutex_init(&HFS_I(inode)->extents_lock);
 	INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
 	spin_lock_init(&HFS_I(inode)->open_dir_lock);
 	hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
 	next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
-	BUG_ON(next_id > U32_MAX);
+	if (next_id > U32_MAX) {
+		pr_err("hfs: next file ID exceeds 32-bit limit — possible "
+		       "superblock corruption");
+		goto out_discard;
+	}
 	inode->i_ino = (u32)next_id;
 	inode->i_mode = mode;
 	inode->i_uid = current_fsuid();
@@ -209,7 +216,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	if (S_ISDIR(mode)) {
 		inode->i_size = 2;
 		folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
-		BUG_ON(folder_count > U32_MAX);
+		if (folder_count > U32_MAX) {
+			pr_err("hfs: folder count exceeds 32-bit limit — possible "
+			       "superblock corruption");
+			goto out_discard;
+		}
 		if (dir->i_ino == HFS_ROOT_CNID)
 			HFS_SB(sb)->root_dirs++;
 		inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +230,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	} else if (S_ISREG(mode)) {
 		HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
 		file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
-		BUG_ON(file_count > U32_MAX);
+		if (file_count > U32_MAX) {
+			pr_err("hfs: file count exceeds 32-bit limit — possible "
+			       "superblock corruption");
+			goto out_discard;
+		}
 		if (dir->i_ino == HFS_ROOT_CNID)
 			HFS_SB(sb)->root_files++;
 		inode->i_op = &hfs_file_inode_operations;
@@ -243,6 +258,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	hfs_mark_mdb_dirty(sb);
 
 	return inode;
+
+	out_discard:
+		iput(inode);	
+	out_err:
+		return ERR_PTR(err); 
 }
 
 void hfs_delete_inode(struct inode *inode)
@@ -251,7 +271,6 @@ void hfs_delete_inode(struct inode *inode)
 
 	hfs_dbg("ino %lu\n", inode->i_ino);
 	if (S_ISDIR(inode->i_mode)) {
-		BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
 		atomic64_dec(&HFS_SB(sb)->folder_count);
 		if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
 			HFS_SB(sb)->root_dirs--;
@@ -260,7 +279,6 @@ void hfs_delete_inode(struct inode *inode)
 		return;
 	}
 
-	BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
 	atomic64_dec(&HFS_SB(sb)->file_count);
 	if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
 		HFS_SB(sb)->root_files--;
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 53f3fae60217..1c3fb631cc8e 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -273,15 +273,12 @@ void hfs_mdb_commit(struct super_block *sb)
 		/* These parameters may have been modified, so write them back */
 		mdb->drLsMod = hfs_mtime();
 		mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks);
-		BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX);
 		mdb->drNxtCNID =
 			cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id));
 		mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files);
 		mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs);
-		BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
 		mdb->drFilCnt =
 			cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count));
-		BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
 		mdb->drDirCnt =
 			cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count));
 
-- 
2.51.1.dirty

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---

diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
 	int res;
 
 	inode = hfs_new_inode(dir, &dentry->d_name, mode);
-	if (!inode)
-		return -ENOMEM;
+	if (IS_ERR(inode))
+		return PTR_ERR(inode);
 
 	res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
 	if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
 	int res;
 
 	inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
-	if (!inode)
-		return ERR_PTR(-ENOMEM);
+	if (IS_ERR(inode))
+		return ERR_CAST(inode);
 
 	res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
 	if (res) {
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index fff149af89da..6808b1316b60 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -273,4 +273,6 @@ static inline void hfs_bitmap_dirty(struct super_block *sb)
 	__bh;						\
 })
 
+#define EFSCORRUPTED   EUCLEAN         /* Filesystem is corrupted */
+
 #endif
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..cb74904994cc 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -186,16 +186,22 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	s64 next_id;
 	s64 file_count;
 	s64 folder_count;
+	int err = -ENOMEM;
 
 	if (!inode)
-		return NULL;
+		goto out_err;
+
+	err = -EFSCORRUPTED;
 
 	mutex_init(&HFS_I(inode)->extents_lock);
 	INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
 	spin_lock_init(&HFS_I(inode)->open_dir_lock);
 	hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
 	next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
-	BUG_ON(next_id > U32_MAX);
+	if (next_id > U32_MAX) {
+		printk(KERN_CRIT "hfs error: next file id on super block is corrupt");
+		goto out_discard;
+	}
 	inode->i_ino = (u32)next_id;
 	inode->i_mode = mode;
 	inode->i_uid = current_fsuid();
@@ -209,7 +215,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	if (S_ISDIR(mode)) {
 		inode->i_size = 2;
 		folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
-		BUG_ON(folder_count > U32_MAX);
+		if (folder_count > U32_MAX) {
+			printk(KERN_CRIT "hfs error: folder count on super block is corrupt");
+			goto out_discard;
+		}
 		if (dir->i_ino == HFS_ROOT_CNID)
 			HFS_SB(sb)->root_dirs++;
 		inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +228,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	} else if (S_ISREG(mode)) {
 		HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
 		file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
-		BUG_ON(file_count > U32_MAX);
+		if (file_count > U32_MAX) {
+			printk(KERN_CRIT "hfs error: file count on super block is corrupt");
+			goto out_discard;
+		}
 		if (dir->i_ino == HFS_ROOT_CNID)
 			HFS_SB(sb)->root_files++;
 		inode->i_op = &hfs_file_inode_operations;
@@ -243,6 +255,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
 	hfs_mark_mdb_dirty(sb);
 
 	return inode;
+
+	out_discard:
+		iput(inode);	
+	out_err:
+		return ERR_PTR(err); 
 }
 
 void hfs_delete_inode(struct inode *inode)

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---

diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474..ee1760305380 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
        int res;
 
        inode = hfs_new_inode(dir, &dentry->d_name, mode);
-       if (!inode)
-               return -ENOMEM;
+       if (IS_ERR(inode))
+               return PTR_ERR(inode);
 
        res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
        if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
        int res;
 
        inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
-       if (!inode)
-               return ERR_PTR(-ENOMEM);
+       if (IS_ERR(inode))
+               return ERR_CAST(inode);
 
        res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
        if (res) {
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index fff149af89da..6808b1316b60 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -273,4 +273,6 @@ static inline void hfs_bitmap_dirty(struct super_block *sb)
        __bh;                                           \
 })
 
+#define EFSCORRUPTED   EUCLEAN         /* Filesystem is corrupted */
+
 #endif
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 9cd449913dc8..ef46a2d29d6a 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -188,7 +188,7 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
        s64 folder_count;
 
        if (!inode)
-               return NULL;
+               return ERR_PTR(-ENOMEM);
 
        mutex_init(&HFS_I(inode)->extents_lock);
        INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
@@ -209,7 +209,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
        if (S_ISDIR(mode)) {
                inode->i_size = 2;
                folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
-               BUG_ON(folder_count > U32_MAX);
+               if (folder_count > U32_MAX) {
+                       printk(KERN_CRIT "hfs error: folder count on super block is corrupt");
+                       return ERR_PTR(-EFSCORRUPTED);
+               }
                if (dir->i_ino == HFS_ROOT_CNID)
                        HFS_SB(sb)->root_dirs++;
                inode->i_op = &hfs_dir_inode_operations;
@@ -219,7 +222,10 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
        } else if (S_ISREG(mode)) {
                HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
                file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
-               BUG_ON(file_count > U32_MAX);
+               if (file_count > U32_MAX) {
+                       printk(KERN_CRIT "hfs error: file count on super block is corrupt");
+                       return ERR_PTR(-EFSCORRUPTED);
+               }
                if (dir->i_ino == HFS_ROOT_CNID)
                        HFS_SB(sb)->root_files++;
                inode->i_op = &hfs_file_inode_operations;

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
 
 #endif
 
+#define EFSCORRUPTED   EUCLEAN         /* Filesystem is corrupted */
+
 #endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..f18f7474aca4 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -145,6 +145,12 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
        struct minix_dir_entry * de;
        int err;
 
+       if (inode->i_nlink < 1) {
+               printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+                      "has corrupted nlink", inode->i_ino);
+               return -EFSCORRUPTED;
+       }
+
        de = minix_find_entry(dentry, &folio);
        if (!de)
                return -ENOENT;
@@ -218,6 +224,13 @@ static int minix_rename(struct mnt_idmap *idmap,
                if (dir_de && !minix_empty_dir(new_inode))
                        goto out_dir;
 
+               err = -EFSCORRUPTED;
+               if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+                       printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+                              "has corrupted nlink", new_inode->i_ino);
+                       goto out_dir;
+               }
+
                err = -ENOENT;
                new_de = minix_find_entry(new_dentry, &new_folio);
                if (!new_de)

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index aae1f32f4dab..f193912d8632 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -704,8 +704,8 @@ static void ntfs_put_super(struct super_block *sb)
        ntfs_set_state(sbi, NTFS_DIRTY_CLEAR);
 
        if (sbi->options) {
+               kfree(sbi->options->nls_name);
                unload_nls(sbi->options->nls);
-               kfree(sbi->options->nls);
                kfree(sbi->options);
                sbi->options = NULL;
        }
@@ -1670,8 +1670,8 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
        iput(inode);
 out:
        if (sbi && sbi->options) {
+               kfree(sbi->options->nls_name);
                unload_nls(sbi->options->nls);
-               kfree(sbi->options->nls);
                kfree(sbi->options);
                sbi->options = NULL;
        }

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---

diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
 
 #endif
 
+#define EFSCORRUPTED   EUCLEAN         /* Filesystem is corrupted */
+
 #endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..493a75eff2c9 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -208,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
                if (dir_de && !minix_empty_dir(new_inode))
                        goto out_dir;
 
+               err = -EFSCORRUPTED;
+               if (new_inode->i_nlink == 0 || (dir_de && new_inode->i_nlink != 2)) {
+                       printk(KERN_CRIT "minix-fs error: inode (ino: %ld) "
+                              "has corrupted nlink", new_inode->i_ino);
+                       goto out_dir;
+               }
+
                err = -ENOENT;
                new_de = minix_find_entry(new_dentry, &new_folio);
                if (!new_de)

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
 
 #endif
 
+#define EFSCORRUPTED   EUCLEAN         /* Filesystem is corrupted */
+
 #endif /* FS_MINIX_H */

diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
                if (dir_de && !minix_empty_dir(new_inode))
                        goto out_dir;
 
+               err = -EFSCORRUPTED;
+               if (dir_de && new_inode->i_nlink != 2) {
+                       printk(KERN_CRIT "minix-fs error: directory inode has "
+                              "corrupted nlink");
+                       goto out_dir;
+               }
+
                err = -ENOENT;
                new_de = minix_find_entry(new_dentry, &new_folio);
                if (!new_de)

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---

diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index a8d5a7e22b7b..8648d860ef0c 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -218,6 +218,13 @@ static int minix_rename(struct mnt_idmap *idmap,
                if (dir_de && !minix_empty_dir(new_inode))
                        goto out_dir;
 
+               err = -EFSCORRUPTED;
+               if (dir_de && new_inode->i_nlink != 2) {
+                       printk(KERN_CRIT "minix-fs error: directory inode has "
+                              "corrupted nlink");
+                       goto out_dir;
+               }
+
                err = -ENOENT;
                new_de = minix_find_entry(new_dentry, &new_folio);
                if (!new_de)

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/minix/minix.h |  2 ++
 fs/minix/namei.c | 26 ++++++++++++++++++--------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index d54273c3c9ff..ce62cb61186d 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -168,4 +168,6 @@ static inline int minix_test_bit(int nr, const void *vaddr)
 
 #endif
 
+#define EFSCORRUPTED	EUCLEAN		/* Filesystem is corrupted */
+
 #endif /* FS_MINIX_H */
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..a8d5a7e22b7b 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,25 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
 static int minix_rmdir(struct inode * dir, struct dentry *dentry)
 {
 	struct inode * inode = d_inode(dentry);
-	int err = -ENOTEMPTY;
-
-	if (minix_empty_dir(inode)) {
-		err = minix_unlink(dir, dentry);
-		if (!err) {
-			inode_dec_link_count(dir);
-			inode_dec_link_count(inode);
-		}
+	int err = -EFSCORRUPTED;
+
+	if (dir->i_nlink <= 2) {
+		printk(KERN_CRIT "minix-fs error: directory inode has "
+		       "corrupted nlink");
+		goto out;
 	}
+
+	err = -ENOTEMPTY;
+	if (!minix_empty_dir(inode))
+		goto out;
+
+	err = minix_unlink(dir, dentry);
+	if (!err) {
+		inode_dec_link_count(dir);
+		inode_dec_link_count(inode);
+ 	}
+
+out:
 	return err;
 }
 
-- 
2.51.1.dirty

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/jfs/jfs_dtree.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..e919de01c42a 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
 static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
 			      int ri, struct component_name * key, int flag);
 
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
-			  ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+			 ddata_t * data, struct dt_lock **);
 
 static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
 			struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
 	lv->length = 1;
 	dtlck->index++;
 
-	dtInsertEntry(p, index, name, &data, &dtlck);
+	if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+		return rc;
 
 	/* linelock stbl of non-root leaf page */
 	if (!(p->header.flag & BT_ROOT)) {
@@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i,	/* entry index */
  * function: allocate free slot(s) and
  *	     write a leaf/internal entry
  *
- * return: entry slot index
+ * * return: 0 - success;
+ *	   errno - failure;
  */
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 			  ddata_t * data, struct dt_lock ** dtlock)
 {
 	struct dtslot *h, *t;
@@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 
 	/* allocate a free slot */
 	hsi = fsi = p->header.freelist;
+	if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+		jfs_err("Encountered corrupted dtpage before insert");
+		return -EIO;
+	}
 	h = &p->slot[fsi];
 	p->header.freelist = h->next;
 	--p->header.freecnt;
@@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 	while (klen) {
 		/* get free slot */
 		fsi = p->header.freelist;
+		if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+			jfs_err("Encountered corrupted dtpage before insert");
+			return -EIO;
+		}
 		t = &p->slot[fsi];
 		p->header.freelist = t->next;
 		--p->header.freecnt;
@@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 
 	/* advance next available entry index of stbl */
 	++p->header.nextindex;
+
+	return 0;
 }
 
 
-- 
2.51.1.dirty

Re: Forwarded:

[Al Viro]

On Tue, Oct 28, 2025 at 10:25:20AM -0700, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@vger.kernel.org.

For fuck sake, either generate a more useful subject, or take
that to a separate list just for syzbot use.

Do you really intend to end up in a bunch of .procmailrc?

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/jfs/jfs_dtree.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..e919de01c42a 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
 static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
 			      int ri, struct component_name * key, int flag);
 
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
-			  ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+			 ddata_t * data, struct dt_lock **);
 
 static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
 			struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
 	lv->length = 1;
 	dtlck->index++;
 
-	dtInsertEntry(p, index, name, &data, &dtlck);
+	if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+		return rc;
 
 	/* linelock stbl of non-root leaf page */
 	if (!(p->header.flag & BT_ROOT)) {
@@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i,	/* entry index */
  * function: allocate free slot(s) and
  *	     write a leaf/internal entry
  *
- * return: entry slot index
+ * * return: 0 - success;
+ *	   errno - failure;
  */
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 			  ddata_t * data, struct dt_lock ** dtlock)
 {
 	struct dtslot *h, *t;
@@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 
 	/* allocate a free slot */
 	hsi = fsi = p->header.freelist;
+	if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+		jfs_err("Encountered corrupted dtpage before insert");
+		return -EIO;
+	}
 	h = &p->slot[fsi];
 	p->header.freelist = h->next;
 	--p->header.freecnt;
@@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 	while (klen) {
 		/* get free slot */
 		fsi = p->header.freelist;
+		if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) {
+			jfs_err("Encountered corrupted dtpage before insert");
+			return -EIO;
+		}
 		t = &p->slot[fsi];
 		p->header.freelist = t->next;
 		--p->header.freecnt;
@@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 
 	/* advance next available entry index of stbl */
 	++p->header.nextindex;
+
+	return 0;
 }
 
 
-- 
2.51.1.dirty

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..07dd01c79ca2 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
 static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
 			      int ri, struct component_name * key, int flag);
 
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
-			  ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+			 ddata_t * data, struct dt_lock **);
 
 static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
 			struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
 	lv->length = 1;
 	dtlck->index++;
 
-	dtInsertEntry(p, index, name, &data, &dtlck);
+	if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+		return rc;
 
 	/* linelock stbl of non-root leaf page */
 	if (!(p->header.flag & BT_ROOT)) {
@@ -3627,7 +3628,7 @@ static void dtGetKey(dtpage_t * p, int i,	/* entry index */
  *
  * return: entry slot index
  */
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 			  ddata_t * data, struct dt_lock ** dtlock)
 {
 	struct dtslot *h, *t;
@@ -3649,6 +3650,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 
 	/* allocate a free slot */
 	hsi = fsi = p->header.freelist;
+	if (fsi >= p->header.maxslot) {
+		jfs_err("Encountered corrupted dtpage before insert");
+		return -EIO;
+	}
 	h = &p->slot[fsi];
 	p->header.freelist = h->next;
 	--p->header.freecnt;
@@ -3697,6 +3702,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 	while (klen) {
 		/* get free slot */
 		fsi = p->header.freelist;
+		if (fsi >= p->header.maxslot) {
+			jfs_err("Encountered corrupted dtpage before insert");
+			return -EIO;
+		}
 		t = &p->slot[fsi];
 		p->header.freelist = t->next;
 		--p->header.freecnt;
@@ -3774,6 +3783,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
 
 	/* advance next available entry index of stbl */
 	++p->header.nextindex;
+
+	return 0;
 }

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: kubik.bartlomiej@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: zlatistiv@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: clf700383@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master

From 6dc2deb09faf7d53707cc9e75e175b09644fd181 Mon Sep 17 00:00:00 2001
From: clingfei <clf700383@gmail.com>
Date: Mon, 20 Oct 2025 13:48:54 +0800
Subject: [PATCH] fix integer overflow in set_ipsecrequest

syzbot reported a kernel BUG in set_ipsecrequest() due to an skb_over_panic.

The mp->new_family and mp->old_family is u16, while set_ipsecrequest receives
family as uint8_t,  causing a integer overflow and the later size_req calculation
error, which exceeds the size used in alloc_skb, and ultimately triggered the
kernel bug in skb_put.

Reported-by: syzbot+be97dd4da14ae88b6ba4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be97dd4da14ae88b6ba4
Signed-off-by: Cheng Lingfei <clf700383@gmail.com>
---
 net/key/af_key.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 2ebde0352245..08f4cde01994 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *
 
 static int set_ipsecrequest(struct sk_buff *skb,
 			    uint8_t proto, uint8_t mode, int level,
-			    uint32_t reqid, uint8_t family,
+			    uint32_t reqid, uint16_t family,
 			    const xfrm_address_t *src, const xfrm_address_t *dst)
 {
 	struct sadb_x_ipsecrequest *rq;
-- 
2.34.1

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/minix/inode.c | 14 ++++++++++++++
 fs/minix/namei.c | 22 ++++++++++++++--------
 2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
 		iget_failed(inode);
 		return ERR_PTR(-ESTALE);
 	}
+	if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+		printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+		       inode->i_ino);
+		brelse(bh);
+		iget_failed(inode);
+		return ERR_PTR(-EIO);
+	}
 	inode->i_mode = raw_inode->i_mode;
 	i_uid_write(inode, raw_inode->i_uid);
 	i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
 		iget_failed(inode);
 		return ERR_PTR(-ESTALE);
 	}
+	if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+		printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+		       inode->i_ino);
+		brelse(bh);
+		iget_failed(inode);
+		return ERR_PTR(-EIO);
+	}
 	inode->i_mode = raw_inode->i_mode;
 	i_uid_write(inode, raw_inode->i_uid);
 	i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
 static int minix_rmdir(struct inode * dir, struct dentry *dentry)
 {
 	struct inode * inode = d_inode(dentry);
-	int err = -ENOTEMPTY;
-
-	if (minix_empty_dir(inode)) {
-		err = minix_unlink(dir, dentry);
-		if (!err) {
-			inode_dec_link_count(dir);
-			inode_dec_link_count(inode);
-		}
+	int err = -EIO;
+
+	if (dir->i_nlink <= 2)
+		goto out;
+
+	err = -ENOTEMPTY;
+	if (!minix_empty_dir(inode))
+		goto out;
+
+	err = minix_unlink(dir, dentry);
+	if (!err) {
+		inode_dec_link_count(dir);
+		inode_dec_link_count(inode);
 	}
+out:
 	return err;
 }
 
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/minix/inode.c | 14 ++++++++++++++
 fs/minix/namei.c | 22 ++++++++++++++--------
 2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
 		iget_failed(inode);
 		return ERR_PTR(-ESTALE);
 	}
+	if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+		printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+		       inode->i_ino);
+		brelse(bh);
+		iget_failed(inode);
+		return ERR_PTR(-EIO);
+	}
 	inode->i_mode = raw_inode->i_mode;
 	i_uid_write(inode, raw_inode->i_uid);
 	i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
 		iget_failed(inode);
 		return ERR_PTR(-ESTALE);
 	}
+	if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+		printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+		       inode->i_ino);
+		brelse(bh);
+		iget_failed(inode);
+		return ERR_PTR(-EIO);
+	}
 	inode->i_mode = raw_inode->i_mode;
 	i_uid_write(inode, raw_inode->i_uid);
 	i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
 static int minix_rmdir(struct inode * dir, struct dentry *dentry)
 {
 	struct inode * inode = d_inode(dentry);
-	int err = -ENOTEMPTY;
-
-	if (minix_empty_dir(inode)) {
-		err = minix_unlink(dir, dentry);
-		if (!err) {
-			inode_dec_link_count(dir);
-			inode_dec_link_count(inode);
-		}
+	int err = -EIO;
+
+	if (dir->i_nlink <= 2)
+		goto out;
+
+	err = -ENOTEMPTY;
+	if (!minix_empty_dir(inode))
+		goto out;
+
+	err = minix_unlink(dir, dentry);
+	if (!err) {
+		inode_dec_link_count(dir);
+		inode_dec_link_count(inode);
 	}
+out:
 	return err;
 }
 
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
fs/minix/namei.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..86779a6ec1a7 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -224,7 +224,7 @@ static int minix_rename(struct mnt_idmap *idmap,
err = minix_add_link(new_dentry, old_inode);
if (err)
goto out_dir;
- if (dir_de)
+ if (dir_de && old_dir != new_dir)
inode_inc_link_count(new_dir);
}
@@ -236,7 +236,7 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de) {
err = minix_set_link(dir_de, dir_folio, new_dir);
- if (!err)
+ if (!err && (new_inode || old_dir != new_dir))
inode_dec_link_count(old_dir);
}
out_dir:
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/jfs/namei.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..7879c049632b 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
 				jfs_err("jfs_rename: dtInsert returned -EIO");
 			goto out_tx;
 		}
-		if (S_ISDIR(old_ip->i_mode))
+		if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
 			inc_nlink(new_dir);
 	}
 	/*
@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
 		goto out_tx;
 	}
 	if (S_ISDIR(old_ip->i_mode)) {
-		drop_nlink(old_dir);
+		if (new_ip || old_dir != new_dir)
+			drop_nlink(old_dir);
+
 		if (old_dir != new_dir) {
 			/*
 			 * Change inode number of parent for moved directory
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test

---
 fs/jfs/namei.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..37cd16a423c5 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
 				jfs_err("jfs_rename: dtInsert returned -EIO");
 			goto out_tx;
 		}
-		if (S_ISDIR(old_ip->i_mode))
+		if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
 			inc_nlink(new_dir);
 	}
 	/*
@@ -1244,8 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
 		goto out_tx;
 	}
 	if (S_ISDIR(old_ip->i_mode)) {
-		drop_nlink(old_dir);
 		if (old_dir != new_dir) {
+			drop_nlink(old_dir);
+
 			/*
 			 * Change inode number of parent for moved directory
 			 */
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: jkoolstra@xs4all.nl

#syz test


 fs/ntfs3/index.c | 10 +++++-----
 fs/ntfs3/ntfs.h  |  5 ++++-
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 6d1bf890929d..2e512abc7000 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1808,7 +1808,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
 	CLST new_vbn;
 	__le64 t_vbn, *sub_vbn;
 	u16 sp_size;
-	void *hdr1_saved = NULL;
+	void *blk1_saved = NULL;
 
 	/* Try the most easy case. */
 	e = fnd->level - 1 == level ? fnd->de[level] : NULL;
@@ -1842,8 +1842,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
 	memcpy(up_e, sp, sp_size);
 
 	used1 = le32_to_cpu(hdr1->used);
-	hdr1_saved = kmemdup(hdr1, used1, GFP_NOFS);
-	if (!hdr1_saved) {
+	blk1_saved = kmemdup(&n1->index->blk, used1, GFP_NOFS);
+	if (!blk1_saved) {
 		err = -ENOMEM;
 		goto out;
 	}
@@ -1924,13 +1924,13 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
 		 * Undo critical operations.
 		 */
 		indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
-		memcpy(hdr1, hdr1_saved, used1);
+		memcpy(&n1->index->blk, blk1_saved, used1);
 		indx_write(indx, ni, n1, 0);
 	}
 
 out:
 	kfree(up_e);
-	kfree(hdr1_saved);
+	kfree(blk1_saved);
 
 	return err;
 }
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 552b97905813..d5e2b22eacd7 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -754,7 +754,10 @@ static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr)
 struct INDEX_BUFFER {
 	struct NTFS_RECORD_HEADER rhdr; // 'INDX'
 	__le64 vbn; // 0x10: vcn if index >= cluster or vsn id index < cluster
-	struct INDEX_HDR ihdr; // 0x18:
+	struct_group(blk,
+		struct INDEX_HDR ihdr; // 0x18:
+	        u8 data[]; // NTFS_DE entries
+	);
 };
 
 static_assert(sizeof(struct INDEX_BUFFER) == 0x28);
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nooraineqbal@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

Resending this patch in the existing thread with a '#syz test:' directive
so syzbot can test it.

From 1bb35c6722b8fb03e9262f6e6530d240629a44df Mon Sep 17 00:00:00 2001
From: neqbal <nooraineqbal@gmail.com>
Date: Sun, 28 Sep 2025 03:52:44 +0530
Subject: [PATCH] x86/mm: Fix off-by-one error in set_memory

Correct end page calculation by subtracting 1 to prevent
out-of-bounds access.

Reported-by: syzbot+e34177f6091df113ef20@syzkaller.appspotmail.com
Signed-off-by: neqbal <nooraineqbal@gmail.com>
---
 arch/x86/mm/pat/set_memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d2d54b8c4dbb..daefc96403f1 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -446,7 +446,7 @@ static void cpa_flush(struct cpa_data *cpa, int cache)
 	}
 
 	start = fix_addr(__cpa_addr(cpa, 0));
-	end =   fix_addr(__cpa_addr(cpa, cpa->numpages));
+	end =   fix_addr(__cpa_addr(cpa, cpa->numpages - 1));
 	if (cpa->force_flush_all)
 		end = TLB_FLUSH_ALL;
 
-- 
2.51.0

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: 
Author: kriish.sharma2006@gmail.com

#syz test

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 26d6c1eea559..a879e8030568 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
        u32 bytes_left, bytes;
        int x;

-       if (!length)
+       if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct
gfs2_bitmap))
                return -EINVAL;

        rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap),
GFP_NOFS);

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: deepak.takumi.120@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

no longer relevant

#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: nogikh@google.com

No longer relevant
#syz invalid

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: abinashsinghlalotra@gmail.com

#syz test

--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -33,6 +33,12 @@ static int ovl_cleanup_locked(struct dentry *workdir,
struct dentry *dentry)
        struct inode *dir = d_inode(workdir);
        struct inode *inode = d_inode(dentry);

+ /* Avoid unlinking an already unlinked inode */
+ if (inode && inode->i_nlink == 0) {
+ d_drop(dentry);
+ return 0;
+ }
+
        if (ovl_is_whiteout(dentry))
                return ovl_remove_and_whiteout(workdir, dentry, true);

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: abinashsinghlalotra@gmail.com

#syz test

--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -872,6 +872,11 @@ static int ax88772_bind(struct usbnet *dev, struct
usb_interface *intf)
        if (ret < 0)
                return ret;

+ if (ret >= 32) {
+ netdev_warn(dev->net, "Invalid PHY address %d, clamping\n", ret);
+ return -EINVAL;
+ }
+
        priv->phy_addr = ret;
        priv->embd_phy = ((priv->phy_addr & 0x1f) == AX_EMBD_PHY_ADDR);


--

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Don't lock inode around page_symlink

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: Ignore accounting key type larger than BCH_DISK_ACCOUNTING_TYPE_NR

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Fix incorrect transaction handling

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: btree_check_root_boundaries()

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: afs

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: Add missing ei_last_dirtied update

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: Increase BCH_MIN_NR_NBUCKETS

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Increase BCH_MIN_NR_NBUCKETS

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: mm: memory: extend finish_fault() to support large folio

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Fix possible console lock involved deadlock

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Fix possible console lock involved deadlock

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: block fs

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: journal_entry_btree_keys_to_text() is more careful

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: btree_iter: fix updates, journal overlay

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Add missing validation for superblock section clean

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: bluetooth

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Don't allow mounting with crazy numbers of dirty journal entries

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Move bset size check before csum check

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Move bset size check before csum check

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: block

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: Fix possible console lock involved deadlock

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: purvayeshi550@gmail.com

#syz-test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: purvayeshi550@gmail.com

#syz-test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Don't trust sb->nr_devices in members_to_text()

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: mm

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: mm

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: mm

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz set subsystems: net

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix:  bcachefs: fix the memory leak in exception case

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Fix __bch2_alloc_to_v4 copy

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: fix assert in bch2_btree_path_traverse_cached()

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: kent.overstreet@linux.dev

#syz fix: bcachefs: Move bset size check before csum check

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: purvayeshi550@gmail.com

#syz-test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: purvayeshi550@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: purvayeshi550@gmail.com

#syz test

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: purvayeshi550@gmail.com

#syz test