2025/11/18 09:49:13 extracted 321630 text symbol hashes for base and 321634 for patched 2025/11/18 09:49:13 symbol "__UNIQUE_ID___addressable_vfio_pci_core_release_dev1053" has different values in base vs patch 2025/11/18 09:49:13 binaries are different, continuing fuzzing 2025/11/18 09:49:13 adding modified_functions to focus areas: ["__pfx_vfio_find_cap_start" "__pfx_vfio_pci_map_pfn" "vfio_find_cap_start" "vfio_pci_core_disable" "vfio_pci_core_ioctl" "vfio_pci_core_ioctl_feature" "vfio_pci_map_pfn" "vfio_pci_mmap_huge_fault" "vfio_pci_vga_init"] 2025/11/18 09:49:13 adding directly modified files to focus areas: ["drivers/vfio/pci/nvgrace-gpu/main.c" "drivers/vfio/pci/vfio_pci_config.c" "drivers/vfio/pci/vfio_pci_core.c" "include/linux/vfio_pci_core.h"] 2025/11/18 09:49:13 downloading corpus #1: "https://storage.googleapis.com/syzkaller/corpus/ci-upstream-kasan-gce-root-corpus.db" 2025/11/18 09:50:13 runner 2 connected 2025/11/18 09:50:13 runner 2 connected 2025/11/18 09:50:13 runner 8 connected 2025/11/18 09:50:13 runner 0 connected 2025/11/18 09:50:13 runner 6 connected 2025/11/18 09:50:13 runner 3 connected 2025/11/18 09:50:14 runner 7 connected 2025/11/18 09:50:19 runner 4 connected 2025/11/18 09:50:19 initializing coverage information... 2025/11/18 09:50:19 executor cover filter: 0 PCs 2025/11/18 09:50:19 runner 0 connected 2025/11/18 09:50:20 runner 5 connected 2025/11/18 09:50:20 runner 1 connected 2025/11/18 09:50:21 runner 1 connected 2025/11/18 09:50:23 machine check: disabled the following syscalls: openat$sev : failed to open /dev/sev: no such file or directory syz_kvm_setup_cpu$ppc64 : unsupported arch transitively disabled the following syscalls (missing resource [creating syscalls]): close$binfmt : fd_binfmt [openat$binfmt] close$fd_v4l2_buffer : fd_v4l2_buffer [ioctl$VIDIOC_QUERYBUF_DMABUF] close$ibv_device : fd_rdma [openat$uverbs0] ioctl$KVM_CAP_SGX_ATTRIBUTE : fd_sgx_provision [openat$sgx_provision] ioctl$KVM_SEV_CERT_EXPORT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_DECRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_ENCRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_ES_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_GET_ATTESTATION_REPORT : fd_sev [openat$sev] ioctl$KVM_SEV_GUEST_STATUS : fd_sev [openat$sev] ioctl$KVM_SEV_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_INIT2 : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_MEASURE : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_SECRET : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_LAUNCH_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_RECEIVE_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_CANCEL : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_START : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_START : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_UPDATE : fd_sev [openat$sev] BinFmtMisc : enabled Comparisons : enabled Coverage : enabled DelayKcovMmap : enabled DevlinkPCI : PCI device 0000:00:10.0 is not available ExtraCoverage : enabled Fault : enabled KCSAN : write(/sys/kernel/debug/kcsan, on) failed KcovResetIoctl : kernel does not support ioctl(KCOV_RESET_TRACE) LRWPANEmulation : enabled Leak : failed to write(kmemleak, "scan=off") NetDevices : enabled NetInjection : enabled NicVF : PCI device 0000:00:11.0 is not available SandboxAndroid : setfilecon: setxattr failed. (errno 1: Operation not permitted). . process exited with status 67. SandboxNamespace : enabled SandboxNone : enabled SandboxSetuid : enabled Swap : enabled USBEmulation : enabled VhciInjection : enabled WifiEmulation : enabled syscalls : 166/8056 2025/11/18 09:50:23 base: machine check complete 2025/11/18 09:50:25 discovered 7601 source files, 332490 symbols 2025/11/18 09:50:25 coverage filter: __pfx_vfio_find_cap_start: [] 2025/11/18 09:50:25 coverage filter: __pfx_vfio_pci_map_pfn: [] 2025/11/18 09:50:25 coverage filter: vfio_find_cap_start: [vfio_find_cap_start] 2025/11/18 09:50:25 coverage filter: vfio_pci_core_disable: [vfio_pci_core_disable] 2025/11/18 09:50:25 coverage filter: vfio_pci_core_ioctl: [vfio_pci_core_ioctl vfio_pci_core_ioctl_feature] 2025/11/18 09:50:25 coverage filter: vfio_pci_core_ioctl_feature: [] 2025/11/18 09:50:25 coverage filter: vfio_pci_map_pfn: [vfio_pci_map_pfn] 2025/11/18 09:50:25 coverage filter: vfio_pci_mmap_huge_fault: [vfio_pci_mmap_huge_fault] 2025/11/18 09:50:25 coverage filter: vfio_pci_vga_init: [vfio_pci_vga_init] 2025/11/18 09:50:25 coverage filter: drivers/vfio/pci/nvgrace-gpu/main.c: [] 2025/11/18 09:50:25 coverage filter: drivers/vfio/pci/vfio_pci_config.c: [drivers/vfio/pci/vfio_pci_config.c] 2025/11/18 09:50:25 coverage filter: drivers/vfio/pci/vfio_pci_core.c: [drivers/vfio/pci/vfio_pci_core.c] 2025/11/18 09:50:25 coverage filter: include/linux/vfio_pci_core.h: [] 2025/11/18 09:50:25 area "symbols": 379 PCs in the cover filter 2025/11/18 09:50:25 area "files": 1604 PCs in the cover filter 2025/11/18 09:50:25 area "": 0 PCs in the cover filter 2025/11/18 09:50:25 executor cover filter: 0 PCs 2025/11/18 09:50:26 machine check: disabled the following syscalls: openat$sev : failed to open /dev/sev: no such file or directory syz_kvm_setup_cpu$ppc64 : unsupported arch transitively disabled the following syscalls (missing resource [creating syscalls]): close$binfmt : fd_binfmt [openat$binfmt] close$fd_v4l2_buffer : fd_v4l2_buffer [ioctl$VIDIOC_QUERYBUF_DMABUF] close$ibv_device : fd_rdma [openat$uverbs0] ioctl$KVM_CAP_SGX_ATTRIBUTE : fd_sgx_provision [openat$sgx_provision] ioctl$KVM_SEV_CERT_EXPORT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_DECRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_DBG_ENCRYPT : fd_sev [openat$sev] ioctl$KVM_SEV_ES_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_GET_ATTESTATION_REPORT : fd_sev [openat$sev] ioctl$KVM_SEV_GUEST_STATUS : fd_sev [openat$sev] ioctl$KVM_SEV_INIT : fd_sev [openat$sev] ioctl$KVM_SEV_INIT2 : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_MEASURE : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_SECRET : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_LAUNCH_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_LAUNCH_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_START : sev_handle [ioctl$KVM_SEV_GUEST_STATUS ioctl$KVM_SEV_LAUNCH_START ioctl$KVM_SEV_RECEIVE_START] ioctl$KVM_SEV_RECEIVE_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_RECEIVE_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_CANCEL : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_START : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_DATA : fd_sev [openat$sev] ioctl$KVM_SEV_SEND_UPDATE_VMSA : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_FINISH : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_START : fd_sev [openat$sev] ioctl$KVM_SEV_SNP_LAUNCH_UPDATE : fd_sev [openat$sev] BinFmtMisc : enabled Comparisons : enabled Coverage : enabled DelayKcovMmap : enabled DevlinkPCI : PCI device 0000:00:10.0 is not available ExtraCoverage : enabled Fault : enabled KCSAN : write(/sys/kernel/debug/kcsan, on) failed KcovResetIoctl : kernel does not support ioctl(KCOV_RESET_TRACE) LRWPANEmulation : enabled Leak : failed to write(kmemleak, "scan=off") NetDevices : enabled NetInjection : enabled NicVF : PCI device 0000:00:11.0 is not available SandboxAndroid : setfilecon: setxattr failed. (errno 1: Operation not permitted). . process exited with status 67. SandboxNamespace : enabled SandboxNone : enabled SandboxSetuid : enabled Swap : enabled USBEmulation : enabled VhciInjection : enabled WifiEmulation : enabled syscalls : 166/8056 2025/11/18 09:50:26 new: machine check complete 2025/11/18 09:50:31 new: adding 2629 seeds 2025/11/18 09:50:46 triaged 97.0% of the corpus 2025/11/18 09:50:46 starting bug reproductions 2025/11/18 09:50:46 starting bug reproductions (max 6 VMs, 4 repros) 2025/11/18 09:51:16 triaged 100.0% of the corpus 2025/11/18 09:54:16 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 0, "corpus": 695, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 0, "coverage": 9187, "distributor delayed": 420, "distributor undelayed": 420, "distributor violated": 0, "exec candidate": 2629, "exec collide": 3890, "exec fuzz": 7443, "exec gen": 439, "exec hints": 1231, "exec inject": 0, "exec minimize": 8833, "exec retries": 0, "exec seeds": 1948, "exec smash": 8380, "exec total [base]": 17239, "exec total [new]": 44511, "exec triage": 1881, "executor restarts [base]": 28, "executor restarts [new]": 48, "fault jobs": 0, "fuzzer jobs": 804, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 141, "max signal": 9645, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 4801, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 797, "no exec duration": 18000000000, "no exec requests": 18, "pending": 0, "prog exec time": 168, "reproducing": 0, "rpc recv": 1176178324, "rpc sent": 57213536, "signal": 8744, "smash jobs": 650, "triage jobs": 13, "vm output": 183193, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2025/11/18 09:59:16 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 16, "corpus": 1025, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 4, "coverage": 12042, "distributor delayed": 582, "distributor undelayed": 582, "distributor violated": 0, "exec candidate": 2629, "exec collide": 8859, "exec fuzz": 16941, "exec gen": 951, "exec hints": 3306, "exec inject": 0, "exec minimize": 13886, "exec retries": 0, "exec seeds": 2958, "exec smash": 20271, "exec total [base]": 29211, "exec total [new]": 80407, "exec triage": 2768, "executor restarts [base]": 28, "executor restarts [new]": 48, "fault jobs": 0, "fuzzer jobs": 622, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 174, "max signal": 12578, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 7166, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1180, "no exec duration": 18000000000, "no exec requests": 18, "pending": 0, "prog exec time": 235, "reproducing": 0, "rpc recv": 2206485448, "rpc sent": 135689856, "signal": 11493, "smash jobs": 437, "triage jobs": 11, "vm output": 280820, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2025/11/18 10:04:16 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 41, "corpus": 1235, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 92, "coverage": 12683, "distributor delayed": 700, "distributor undelayed": 700, "distributor violated": 0, "exec candidate": 2629, "exec collide": 13256, "exec fuzz": 25244, "exec gen": 1423, "exec hints": 6194, "exec inject": 0, "exec minimize": 17272, "exec retries": 0, "exec seeds": 3702, "exec smash": 29810, "exec total [base]": 39204, "exec total [new]": 110688, "exec triage": 3321, "executor restarts [base]": 28, "executor restarts [new]": 48, "fault jobs": 0, "fuzzer jobs": 137, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 36, "max signal": 13189, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 8670, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1418, "no exec duration": 18000000000, "no exec requests": 18, "pending": 0, "prog exec time": 299, "reproducing": 0, "rpc recv": 3194132420, "rpc sent": 199499176, "signal": 12006, "smash jobs": 94, "triage jobs": 7, "vm output": 386229, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2025/11/18 10:09:16 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 50, "corpus": 1339, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 181, "coverage": 13068, "distributor delayed": 766, "distributor undelayed": 766, "distributor violated": 0, "exec candidate": 2629, "exec collide": 19602, "exec fuzz": 37196, "exec gen": 2017, "exec hints": 9606, "exec inject": 0, "exec minimize": 19014, "exec retries": 0, "exec seeds": 4023, "exec smash": 33466, "exec total [base]": 48482, "exec total [new]": 139040, "exec triage": 3652, "executor restarts [base]": 28, "executor restarts [new]": 48, "fault jobs": 0, "fuzzer jobs": 15, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 5, "max signal": 13599, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 9489, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1553, "no exec duration": 18000000000, "no exec requests": 18, "pending": 0, "prog exec time": 314, "reproducing": 0, "rpc recv": 3925664704, "rpc sent": 267091408, "signal": 12331, "smash jobs": 6, "triage jobs": 4, "vm output": 543008, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2025/11/18 10:14:16 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 60, "corpus": 1420, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 285, "coverage": 13280, "distributor delayed": 811, "distributor undelayed": 811, "distributor violated": 0, "exec candidate": 2629, "exec collide": 26425, "exec fuzz": 50312, "exec gen": 2708, "exec hints": 10956, "exec inject": 0, "exec minimize": 20575, "exec retries": 0, "exec seeds": 4265, "exec smash": 35493, "exec total [base]": 57084, "exec total [new]": 165084, "exec triage": 3882, "executor restarts [base]": 28, "executor restarts [new]": 48, "fault jobs": 0, "fuzzer jobs": 11, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 3, "max signal": 13838, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 10241, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1650, "no exec duration": 18000000000, "no exec requests": 18, "pending": 0, "prog exec time": 367, "reproducing": 0, "rpc recv": 4597719412, "rpc sent": 332896016, "signal": 12575, "smash jobs": 6, "triage jobs": 2, "vm output": 736619, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2025/11/18 10:19:16 STAT { "buffer too small": 0, "candidate triage jobs": 0, "candidates": 0, "comps overflows": 69, "corpus": 1497, "corpus [files]": 0, "corpus [symbols]": 0, "cover overflows": 385, "coverage": 13540, "distributor delayed": 843, "distributor undelayed": 843, "distributor violated": 0, "exec candidate": 2629, "exec collide": 33387, "exec fuzz": 63637, "exec gen": 3452, "exec hints": 11300, "exec inject": 0, "exec minimize": 21895, "exec retries": 0, "exec seeds": 4506, "exec smash": 37517, "exec total [base]": 65446, "exec total [new]": 190246, "exec triage": 4087, "executor restarts [base]": 28, "executor restarts [new]": 48, "fault jobs": 0, "fuzzer jobs": 6, "fuzzing VMs [base]": 3, "fuzzing VMs [new]": 9, "hints jobs": 0, "max signal": 14106, "minimize: array": 0, "minimize: buffer": 0, "minimize: call": 10839, "minimize: filename": 0, "minimize: integer": 0, "minimize: pointer": 0, "minimize: props": 0, "minimize: resource": 0, "modules [base]": 1, "modules [new]": 1, "new inputs": 1741, "no exec duration": 18000000000, "no exec requests": 18, "pending": 0, "prog exec time": 315, "reproducing": 0, "rpc recv": 5243142596, "rpc sent": 398603248, "signal": 12838, "smash jobs": 3, "triage jobs": 3, "vm output": 902893, "vm restarts [base]": 3, "vm restarts [new]": 9 } 2025/11/18 10:21:16 fuzzer has not reached the modified code in 30m0s, aborting 2025/11/18 10:21:16 repro loop terminated 2025/11/18 10:21:16 base: rpc server terminaled 2025/11/18 10:21:16 new: rpc server terminaled 2025/11/18 10:21:17 base: pool terminated 2025/11/18 10:21:17 base: kernel context loop terminated 2025/11/18 10:21:17 new: pool terminated 2025/11/18 10:21:17 new: kernel context loop terminated 2025/11/18 10:21:17 diff fuzzing terminated 2025/11/18 10:21:17 bug reporting terminated 2025/11/18 10:21:17 status reporting terminated 2025/11/18 10:21:17 fuzzing is finished 2025/11/18 10:21:17 status at the end: Title On-Base On-Patched