Extracting prog: 1m8.059584606s Minimizing prog: 3m22.682129176s Simplifying prog options: 0s Extracting C: 20.640895558s Simplifying C: 3m22.194220712s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program crashed: WARNING in __split_vma single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-mremap-mremap detailed listing: executing program 0: mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in __split_vma simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in corrupted a never seen crash title: WARNING in corrupted, ignore testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in __split_vma testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in __split_vma testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in __split_vma testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in __split_vma testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program did not crash testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap program crashed: WARNING in __split_vma testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program crashed: WARNING in __split_vma validation run: crashed=true testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program crashed: WARNING in __split_vma validation run: crashed=true testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap detailed listing: executing program 0: syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) program crashed: WARNING in __split_vma validation run: crashed=true reproducing took 10m15.241680197s repro crashed as (corrupted=false): ------------[ cut here ]------------ pgoff != vma->vm_start >> 12 WARNING: mm/vma.h:277 at assert_sane_pgoff mm/vma.h:277 [inline], CPU#2: syz.0.17/5930 WARNING: mm/vma.h:277 at vma_set_pgoff mm/vma.h:283 [inline], CPU#2: syz.0.17/5930 WARNING: mm/vma.h:277 at vma_add_pgoff mm/vma.h:314 [inline], CPU#2: syz.0.17/5930 WARNING: mm/vma.h:277 at __split_vma+0x162b/0x1de0 mm/vma.c:607, CPU#2: syz.0.17/5930 Modules linked in: CPU: 2 UID: 0 PID: 5930 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:assert_sane_pgoff mm/vma.h:277 [inline] RIP: 0010:vma_set_pgoff mm/vma.h:283 [inline] RIP: 0010:vma_add_pgoff mm/vma.h:314 [inline] RIP: 0010:__split_vma+0x162b/0x1de0 mm/vma.c:607 Code: 3c 02 00 0f 85 b1 07 00 00 4d 8b 27 48 89 ef 49 c1 ec 0c 4c 89 e6 e8 c4 15 9f ff 4c 39 e5 0f 84 63 fc ff ff e8 d6 1b 9f ff 90 <0f> 0b 90 e9 55 fc ff ff e8 c8 1b 9f ff 48 8b 54 24 30 48 b8 00 00 RSP: 0018:ffffc90002d475b0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88802b253310 RCX: 0000000000000000 RDX: ffff888024c62580 RSI: ffffffff826c205a RDI: ffff888024c62580 RBP: 0000000000080004 R08: 0000000000000006 R09: 0000000000080004 R10: 0000000000080ffe R11: 0000000000000000 R12: 0000000000080ffe R13: ffff88802b253340 R14: ffffc90002d47b50 R15: ffff88802b2532c0 FS: 0000000000000000(0000) GS:ffff888096b67000(0063) knlGS:00000000f67c5b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000040443000 CR4: 0000000000352ef0 Call Trace: vms_gather_munmap_vmas+0x1d2/0x1720 mm/vma.c:1507 do_vmi_align_munmap+0x287/0x5f0 mm/vma.c:1675 do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1732 shrink_vma+0x1c5/0x380 mm/mremap.c:1421 mremap_at mm/mremap.c:1652 [inline] do_mremap mm/mremap.c:2008 [inline] __do_sys_mremap+0x12d6/0x1780 mm/mremap.c:2064 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf6fcefec Code: Unable to access opcode bytes at 0xf6fcefc2. RSP: 002b:00000000f67c550c EFLAGS: 00000292 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 0000000080ffd000 RCX: 0000000000002000 RDX: 0000000000001000 RSI: 0000000000000000 RDI: 0000000080ffe000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 final repro crashed as (corrupted=false): ------------[ cut here ]------------ pgoff != vma->vm_start >> 12 WARNING: mm/vma.h:277 at assert_sane_pgoff mm/vma.h:277 [inline], CPU#2: syz.0.17/5930 WARNING: mm/vma.h:277 at vma_set_pgoff mm/vma.h:283 [inline], CPU#2: syz.0.17/5930 WARNING: mm/vma.h:277 at vma_add_pgoff mm/vma.h:314 [inline], CPU#2: syz.0.17/5930 WARNING: mm/vma.h:277 at __split_vma+0x162b/0x1de0 mm/vma.c:607, CPU#2: syz.0.17/5930 Modules linked in: CPU: 2 UID: 0 PID: 5930 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:assert_sane_pgoff mm/vma.h:277 [inline] RIP: 0010:vma_set_pgoff mm/vma.h:283 [inline] RIP: 0010:vma_add_pgoff mm/vma.h:314 [inline] RIP: 0010:__split_vma+0x162b/0x1de0 mm/vma.c:607 Code: 3c 02 00 0f 85 b1 07 00 00 4d 8b 27 48 89 ef 49 c1 ec 0c 4c 89 e6 e8 c4 15 9f ff 4c 39 e5 0f 84 63 fc ff ff e8 d6 1b 9f ff 90 <0f> 0b 90 e9 55 fc ff ff e8 c8 1b 9f ff 48 8b 54 24 30 48 b8 00 00 RSP: 0018:ffffc90002d475b0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88802b253310 RCX: 0000000000000000 RDX: ffff888024c62580 RSI: ffffffff826c205a RDI: ffff888024c62580 RBP: 0000000000080004 R08: 0000000000000006 R09: 0000000000080004 R10: 0000000000080ffe R11: 0000000000000000 R12: 0000000000080ffe R13: ffff88802b253340 R14: ffffc90002d47b50 R15: ffff88802b2532c0 FS: 0000000000000000(0000) GS:ffff888096b67000(0063) knlGS:00000000f67c5b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000040443000 CR4: 0000000000352ef0 Call Trace: vms_gather_munmap_vmas+0x1d2/0x1720 mm/vma.c:1507 do_vmi_align_munmap+0x287/0x5f0 mm/vma.c:1675 do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1732 shrink_vma+0x1c5/0x380 mm/mremap.c:1421 mremap_at mm/mremap.c:1652 [inline] do_mremap mm/mremap.c:2008 [inline] __do_sys_mremap+0x12d6/0x1780 mm/mremap.c:2064 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf6fcefec Code: Unable to access opcode bytes at 0xf6fcefc2. RSP: 002b:00000000f67c550c EFLAGS: 00000292 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 0000000080ffd000 RCX: 0000000000002000 RDX: 0000000000001000 RSI: 0000000000000000 RDI: 0000000080ffe000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000