2026/03/11 03:46:33 extracted 324953 text symbol hashes for base and 324953 for patched 2026/03/11 03:46:33 symbol "vfio_pci_mmap_huge_fault.descriptor" has different values in base vs patch 2026/03/11 03:46:33 binaries are different, continuing fuzzing 2026/03/11 03:46:33 adding modified_functions to focus areas: ["_vfio_alloc_device" "vfio_device_fops_unl_ioctl" "vfio_pci_core_aer_err_detected" "vfio_pci_core_close_device" "vfio_pci_core_disable" "vfio_pci_core_request"] 2026/03/11 03:46:33 adding directly modified files to focus areas: ["drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c" "drivers/vfio/pci/mlx5/cmd.c" "drivers/vfio/pci/mlx5/cmd.h" "drivers/vfio/pci/mlx5/main.c" "drivers/vfio/pci/qat/main.c" "drivers/vfio/pci/vfio_pci_core.c" "drivers/vfio/pci/virtio/migrate.c" "drivers/vfio/vfio_main.c" "include/linux/mlx5/mlx5_ifc.h" "include/linux/vfio.h" "include/uapi/linux/vfio.h" "samples/vfio-mdev/mtty.c"] 2026/03/11 03:46:33 downloading corpus #1: "https://storage.googleapis.com/syzkaller/corpus/ci-upstream-kasan-gce-root-corpus.db" 2026/03/11 03:47:32 runner 8 connected 2026/03/11 03:47:32 runner 3 connected 2026/03/11 03:47:32 runner 7 connected 2026/03/11 03:47:32 runner 1 connected 2026/03/11 03:47:32 runner 2 connected 2026/03/11 03:47:33 runner 2 connected 2026/03/11 03:47:33 runner 5 connected 2026/03/11 03:47:33 runner 4 connected 2026/03/11 03:47:33 runner 0 connected 2026/03/11 03:47:33 runner 1 connected 2026/03/11 03:47:33 runner 6 connected 2026/03/11 03:47:33 runner 0 connected 2026/03/11 03:47:38 initializing coverage information... 2026/03/11 03:47:39 executor cover filter: 0 PCs 2026/03/11 03:47:40 machine check: disabled the following syscalls: openat$sev : failed to open /dev/sev: no such file or directory syz_kvm_setup_cpu$ppc64 : unsupported arch transitively disabled the following syscalls (missing resource [creating syscalls]): close$binfmt : fd_binfmt [openat$binfmt] close$fd_v4l2_buffer : fd_v4l2_buffer [ioctl$VIDIOC_QUERYBUF_DMABUF] close$ibv_device : fd_rdma [openat$uverbs0] ioctl$KVM_CAP_SGX_ATTRIBUTE : fd_sgx_provision [openat$sgx_provision] ioctl$KVM_SEV_CERT_EXPORT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_DECRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_ENCRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_ES_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_GET_ATTESTATION_REPORT : fd_sev [openat$sev] ioctl$KVM_SEV_GUEST_STATUS : fd_sev [openat$sev] ioctl$KVM_SEV_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_INIT2 : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_MEASURE : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_SECRET : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_LAUNCH_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_RECEIVE_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_CANCEL : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_START : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_START : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_UPDATE : fd_sev [openat$sev] BinFmtMisc : enabled Comparisons : enabled Coverage : enabled DelayKcovMmap : enabled DevlinkPCI : PCI device 0000:00:10.0 is not available ExtraCoverage : enabled Fault : enabled KCSAN : write(/sys/kernel/debug/kcsan, on) failed KcovResetIoctl : kernel does not support ioctl(KCOV_RESET_TRACE) LRWPANEmulation : enabled Leak : failed to write(kmemleak, "scan=off") MemoryDump : disabled by user NetDevices : enabled NetInjection : enabled NicVF : PCI device 0000:00:11.0 is not available SandboxAndroid : setfilecon: setxattr failed. (errno 1: Operation not permitted). . process exited with status 67. SandboxNamespace : enabled SandboxNone : enabled SandboxSetuid : enabled Swap : enabled USBEmulation : enabled VhciInjection : enabled WifiEmulation : enabled syscalls : 172/8184 2026/03/11 03:47:40 base: machine check complete 2026/03/11 03:47:42 discovered 7666 source files, 336155 symbols 2026/03/11 03:47:42 coverage filter: ^_vfio_alloc_device$: [_vfio_alloc_device] 2026/03/11 03:47:42 coverage filter: ^vfio_device_fops_unl_ioctl$: [vfio_device_fops_unl_ioctl] 2026/03/11 03:47:42 coverage filter: ^vfio_pci_core_aer_err_detected$: [vfio_pci_core_aer_err_detected] 2026/03/11 03:47:42 coverage filter: ^vfio_pci_core_close_device$: [vfio_pci_core_close_device] 2026/03/11 03:47:42 coverage filter: ^vfio_pci_core_disable$: [vfio_pci_core_disable] 2026/03/11 03:47:42 coverage filter: ^vfio_pci_core_request$: [vfio_pci_core_request] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c: [] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/mlx5/cmd.c: [] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/mlx5/cmd.h: [] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/mlx5/main.c: [] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/qat/main.c: [] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/vfio_pci_core.c: [drivers/vfio/pci/vfio_pci_core.c] 2026/03/11 03:47:42 coverage filter: drivers/vfio/pci/virtio/migrate.c: [] 2026/03/11 03:47:42 coverage filter: drivers/vfio/vfio_main.c: [drivers/vfio/vfio_main.c] 2026/03/11 03:47:42 coverage filter: include/linux/mlx5/mlx5_ifc.h: [] 2026/03/11 03:47:42 coverage filter: include/linux/vfio.h: [] 2026/03/11 03:47:42 coverage filter: include/uapi/linux/vfio.h: [] 2026/03/11 03:47:42 coverage filter: samples/vfio-mdev/mtty.c: [] 2026/03/11 03:47:42 area "symbols": 265 PCs in the cover filter 2026/03/11 03:47:42 area "files": 1455 PCs in the cover filter 2026/03/11 03:47:42 area "": 0 PCs in the cover filter 2026/03/11 03:47:42 executor cover filter: 0 PCs 2026/03/11 03:47:43 machine check: disabled the following syscalls: openat$sev : failed to open /dev/sev: no such file or directory syz_kvm_setup_cpu$ppc64 : unsupported arch transitively disabled the following syscalls (missing resource [creating syscalls]): close$binfmt : fd_binfmt [openat$binfmt] close$fd_v4l2_buffer : fd_v4l2_buffer [ioctl$VIDIOC_QUERYBUF_DMABUF] close$ibv_device : fd_rdma [openat$uverbs0] ioctl$KVM_CAP_SGX_ATTRIBUTE : fd_sgx_provision [openat$sgx_provision] ioctl$KVM_SEV_CERT_EXPORT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_DECRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_ENCRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_ES_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_GET_ATTESTATION_REPORT : fd_sev [openat$sev] ioctl$KVM_SEV_GUEST_STATUS : fd_sev [openat$sev] ioctl$KVM_SEV_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_INIT2 : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_MEASURE : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_SECRET : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_LAUNCH_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_RECEIVE_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_CANCEL : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_START : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_START : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_UPDATE : fd_sev [openat$sev] BinFmtMisc : enabled Comparisons : enabled Coverage : enabled DelayKcovMmap : enabled DevlinkPCI : PCI device 0000:00:10.0 is not available ExtraCoverage : enabled Fault : enabled KCSAN : write(/sys/kernel/debug/kcsan, on) failed KcovResetIoctl : kernel does not support ioctl(KCOV_RESET_TRACE) LRWPANEmulation : enabled Leak : failed to write(kmemleak, "scan=off") MemoryDump : disabled by user NetDevices : enabled NetInjection : enabled NicVF : PCI device 0000:00:11.0 is not available SandboxAndroid : setfilecon: setxattr failed. (errno 1: Operation not permitted). . process exited with status 67. SandboxNamespace : enabled SandboxNone : enabled SandboxSetuid : enabled Swap : enabled USBEmulation : enabled VhciInjection : enabled WifiEmulation : enabled syscalls : 172/8184 2026/03/11 03:47:43 new: machine check complete 2026/03/11 03:47:46 new: adding 2545 seeds 2026/03/11 03:48:05 triaged 98.5% of the corpus 2026/03/11 03:48:05 starting bug reproductions 2026/03/11 03:48:05 starting bug reproductions (max 6 VMs, 4 repros) 2026/03/11 03:48:35 triaged 100.0% of the corpus 2026/03/11 03:51:35 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 3, "corpus": 734, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 3, "coverage": 10465, "distributor delayed": 506, "distributor undelayed": 506, "distributor violated": 0, "exec candidate": 2545, "exec collide": 4917, "exec fuzz": 9441, "exec gen": 512, "exec hints": 1502, "exec inject": 0, "exec minimize": 9481, "exec retries": 0, "exec seeds": 2086, "exec smash": 11047, "exec total [base]": 19296, "exec total [new]": 51139, "exec triage": 2037, "executor restarts [base]": 28, "executor restarts [new]": 50, "fault jobs": 0, "fuzzer jobs": 720, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 135, "max signal": 10875, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 5022, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 862, "no exec duration": 27272000000, "no exec requests": 65, "pending": 0, "prog exec time": 209, "reproducing": 0, "rpc recv": 1345620680, "rpc sent": 68769504, "signal": 9985, "smash jobs": 573, "triage jobs": 12, "vm output": 214616, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2026/03/11 03:56:35 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 48, "corpus": 1028, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 80, "coverage": 12478, "distributor delayed": 649, "distributor undelayed": 649, "distributor violated": 0, "exec candidate": 2545, "exec collide": 10146, "exec fuzz": 19107, "exec gen": 1057, "exec hints": 4259, "exec inject": 0, "exec minimize": 14656, "exec retries": 0, "exec seeds": 3028, "exec smash": 22785, "exec total [base]": 31854, "exec total [new]": 88008, "exec triage": 2850, "executor restarts [base]": 28, "executor restarts [new]": 50, "fault jobs": 0, "fuzzer jobs": 356, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 103, "max signal": 12971, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 7371, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1209, "no exec duration": 27272000000, "no exec requests": 65, "pending": 0, "prog exec time": 227, "reproducing": 0, "rpc recv": 2463606520, "rpc sent": 147728336, "signal": 11922, "smash jobs": 244, "triage jobs": 9, "vm output": 335739, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2026/03/11 04:01:35 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 77, "corpus": 1212, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 210, "coverage": 13085, "distributor delayed": 761, "distributor undelayed": 761, "distributor violated": 0, "exec candidate": 2545, "exec collide": 15519, "exec fuzz": 29475, "exec gen": 1585, "exec hints": 7672, "exec inject": 0, "exec minimize": 17818, "exec retries": 0, "exec seeds": 3633, "exec smash": 30168, "exec total [base]": 42393, "exec total [new]": 119334, "exec triage": 3345, "executor restarts [base]": 28, "executor restarts [new]": 50, "fault jobs": 0, "fuzzer jobs": 15, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 5, "max signal": 13608, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 8860, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1422, "no exec duration": 27272000000, "no exec requests": 65, "pending": 0, "prog exec time": 238, "reproducing": 0, "rpc recv": 3432750828, "rpc sent": 221042968, "signal": 12493, "smash jobs": 7, "triage jobs": 3, "vm output": 485105, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2026/03/11 04:06:35 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 91, "corpus": 1322, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 335, "coverage": 13556, "distributor delayed": 831, "distributor undelayed": 831, "distributor violated": 0, "exec candidate": 2545, "exec collide": 23133, "exec fuzz": 43730, "exec gen": 2324, "exec hints": 8146, "exec inject": 0, "exec minimize": 19764, "exec retries": 0, "exec seeds": 3969, "exec smash": 33056, "exec total [base]": 51910, "exec total [new]": 147893, "exec triage": 3653, "executor restarts [base]": 28, "executor restarts [new]": 50, "fault jobs": 0, "fuzzer jobs": 6, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 0, "max signal": 14113, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 9796, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1556, "no exec duration": 27272000000, "no exec requests": 65, "pending": 0, "prog exec time": 266, "reproducing": 0, "rpc recv": 4180894952, "rpc sent": 295152768, "signal": 12931, "smash jobs": 1, "triage jobs": 5, "vm output": 664898, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2026/03/11 04:11:35 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 100, "corpus": 1420, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 433, "coverage": 13796, "distributor delayed": 880, "distributor undelayed": 880, "distributor violated": 0, "exec candidate": 2545, "exec collide": 30727, "exec fuzz": 58410, "exec gen": 3012, "exec hints": 8316, "exec inject": 0, "exec minimize": 21490, "exec retries": 0, "exec seeds": 4273, "exec smash": 35507, "exec total [base]": 61160, "exec total [new]": 175739, "exec triage": 3884, "executor restarts [base]": 28, "executor restarts [new]": 50, "fault jobs": 0, "fuzzer jobs": 19, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 2, "max signal": 14369, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 10606, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1666, "no exec duration": 27272000000, "no exec requests": 65, "pending": 0, "prog exec time": 291, "reproducing": 0, "rpc recv": 4901486712, "rpc sent": 366240360, "signal": 13157, "smash jobs": 9, "triage jobs": 8, "vm output": 832789, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2026/03/11 04:16:35 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 113, "corpus": 1539, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 544, "coverage": 14134, "distributor delayed": 950, "distributor undelayed": 950, "distributor violated": 0, "exec candidate": 2545, "exec collide": 38057, "exec fuzz": 72123, "exec gen": 3768, "exec hints": 8753, "exec inject": 0, "exec minimize": 23446, "exec retries": 0, "exec seeds": 4630, "exec smash": 38472, "exec total [base]": 70357, "exec total [new]": 203561, "exec triage": 4195, "executor restarts [base]": 28, "executor restarts [new]": 50, "fault jobs": 0, "fuzzer jobs": 17, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 2, "max signal": 14729, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 11486, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1798, "no exec duration": 27272000000, "no exec requests": 65, "pending": 0, "prog exec time": 304, "reproducing": 0, "rpc recv": 5665189636, "rpc sent": 436415448, "signal": 13501, "smash jobs": 12, "triage jobs": 3, "vm output": 1013254, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2026/03/11 04:18:35 fuzzer has not reached the modified code in 30m0s, aborting 2026/03/11 04:18:35 repro loop terminated 2026/03/11 04:18:35 new: rpc server terminaled 2026/03/11 04:18:35 base: rpc server terminaled 2026/03/11 04:18:36 new: pool terminated 2026/03/11 04:18:36 new: kernel context loop terminated 2026/03/11 04:18:36 base: pool terminated 2026/03/11 04:18:36 base: kernel context loop terminated 2026/03/11 04:18:36 diff fuzzing terminated 2026/03/11 04:18:36 bug reporting terminated 2026/03/11 04:18:36 status reporting terminated 2026/03/11 04:18:36 fuzzing is finished 2026/03/11 04:18:36 status at the end: Title On-Base On-Patched Status