Extracting prog: 1m4.731980725s
Minimizing prog: 9m44.728922879s
Simplifying prog options: 2m20.506497759s
Extracting C: 41.84587306s
Simplifying C: 0s


extracting reproducer from 67 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mremap-io_uring_register$IORING_REGISTER_SYNC_CANCEL-syz_genetlink_get_family_id$l2tp-ioctl$XFS_IOC_FD_TO_HANDLE-sendmsg$L2TP_CMD_TUNNEL_GET-setsockopt$netlink_NETLINK_CAP_ACK
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000140)={0x5, r1, 0x1c, {0x9, 0x1}, 0x6}, 0x1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0)
ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000180)={<r3=>r0, &(0x7f0000000080)='(\x00', 0x301000, &(0x7f00000000c0)={@_ha_fsid={[0x10001, 0x200]}, {0x5, 0x89, 0x3, 0x1}}, 0x6659, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000027bd7000ffdbdf250400000006001c000010000006000300ffff000008001700", @ANYRES32=r3, @ANYBLOB="06001b004e210000140008007866726d300000000000000000000000060003000101000000ecbc9d2401000000000000000000000000000108000b000000000021378091b8ca25832cc458b96fcf389d292c28607aeebbe10ddcc131e8c58671af5d9fc30c69a7ea7006050000000000000095b6000000000000000872943acf04aa11b2b8afae6608be3153cd98496dec1a6e3323e96c470453267e1d9fb49c44bc2a93b0ad2eec5e8bed754d11d9737c2ca4a0ae32044e1f792fa11594646220728f938274a7889907469d5e9931bdc0423c4032a6d19ffb0bb437bcaff8101ae86694e12cc5fdbc788c97b48368539fab2826aa6483d310b093f565fb3c3ab807c7794aeb9c573bb596f5370a9e98f951fa261c8b91a9fbdfe264e527b41f3d5cbe53717dac"], 0x6c}, 0x1, 0x0, 0x0, 0x8010}, 0x8000044)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000940)=0x9, 0x4)

program crashed: WARNING in __split_vma
single: successfully extracted reproducer
found reproducer with 11 syscalls
minimizing guilty program
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mremap-io_uring_register$IORING_REGISTER_SYNC_CANCEL-syz_genetlink_get_family_id$l2tp-ioctl$XFS_IOC_FD_TO_HANDLE-sendmsg$L2TP_CMD_TUNNEL_GET
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000140)={0x5, r1, 0x1c, {0x9, 0x1}, 0x6}, 0x1)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0)
ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000180)={<r3=>r0, &(0x7f0000000080)='(\x00', 0x301000, &(0x7f00000000c0)={@_ha_fsid={[0x10001, 0x200]}, {0x5, 0x89, 0x3, 0x1}}, 0x6659, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000027bd7000ffdbdf250400000006001c000010000006000300ffff000008001700", @ANYRES32=r3, @ANYBLOB="06001b004e210000140008007866726d300000000000000000000000060003000101000000ecbc9d2401000000000000000000000000000108000b000000000021378091b8ca25832cc458b96fcf389d292c28607aeebbe10ddcc131e8c58671af5d9fc30c69a7ea7006050000000000000095b6000000000000000872943acf04aa11b2b8afae6608be3153cd98496dec1a6e3323e96c470453267e1d9fb49c44bc2a93b0ad2eec5e8bed754d11d9737c2ca4a0ae32044e1f792fa11594646220728f938274a7889907469d5e9931bdc0423c4032a6d19ffb0bb437bcaff8101ae86694e12cc5fdbc788c97b48368539fab2826aa6483d310b093f565fb3c3ab807c7794aeb9c573bb596f5370a9e98f951fa261c8b91a9fbdfe264e527b41f3d5cbe53717dac"], 0x6c}, 0x1, 0x0, 0x0, 0x8010}, 0x8000044)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mremap-io_uring_register$IORING_REGISTER_SYNC_CANCEL-syz_genetlink_get_family_id$l2tp-ioctl$XFS_IOC_FD_TO_HANDLE
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000140)={0x5, r1, 0x1c, {0x9, 0x1}, 0x6}, 0x1)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0)
ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000180)={r0, &(0x7f0000000080)='(\x00', 0x301000, &(0x7f00000000c0)={@_ha_fsid={[0x10001, 0x200]}, {0x5, 0x89, 0x3, 0x1}}, 0x6659, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x8})

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mremap-io_uring_register$IORING_REGISTER_SYNC_CANCEL-syz_genetlink_get_family_id$l2tp
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000140)={0x5, r1, 0x1c, {0x9, 0x1}, 0x6}, 0x1)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mremap-io_uring_register$IORING_REGISTER_SYNC_CANCEL
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000140)={0x5, r0, 0x1c, {0x9, 0x1}, 0x6}, 0x1)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mremap
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)

program did not crash
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program did not crash
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program did not crash
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-mremap-mremap-mremap
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program did not crash
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, 0x0, &(0x7f0000000340), &(0x7f0000000000), &(0x7f0000000000))
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program did not crash
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, &(0x7f0000000000), &(0x7f0000000000))
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, &(0x7f0000000000))
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
testing program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
extracting C reproducer
testing compiled C program (duration=33.636537756s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
program did not crash
simplifying guilty program options
testing program (duration=33.636537756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
extracting C reproducer
testing compiled C program (duration=33.636537756s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
program did not crash
testing program (duration=33.636537756s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
extracting C reproducer
testing compiled C program (duration=33.636537756s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
program did not crash
testing program (duration=33.636537756s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
validation run: crashed=true
testing program (duration=33.636537756s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
validation run: crashed=true
testing program (duration=33.636537756s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-mremap-mremap-mremap
detailed listing:
executing program 0:
syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, 0x0, 0x0, 0x0)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil)

program crashed: WARNING in __split_vma
validation run: crashed=true
reproducing took 15m44.363146942s
repro crashed as (corrupted=false):
------------[ cut here ]------------
pgoff != vma->vm_start >> 12
WARNING: mm/vma.h:276 at assert_sane_pgoff mm/vma.h:276 [inline], CPU#3: syz.0.17/5909
WARNING: mm/vma.h:276 at vma_set_pgoff mm/vma.h:282 [inline], CPU#3: syz.0.17/5909
WARNING: mm/vma.h:276 at vma_add_pgoff mm/vma.h:289 [inline], CPU#3: syz.0.17/5909
WARNING: mm/vma.h:276 at __split_vma+0x1228/0x1800 mm/vma.c:578, CPU#3: syz.0.17/5909
Modules linked in:
CPU: 3 UID: 0 PID: 5909 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:assert_sane_pgoff mm/vma.h:276 [inline]
RIP: 0010:vma_set_pgoff mm/vma.h:282 [inline]
RIP: 0010:vma_add_pgoff mm/vma.h:289 [inline]
RIP: 0010:__split_vma+0x1228/0x1800 mm/vma.c:578
Code: 3c 02 00 0f 85 d3 05 00 00 4c 8b 2b 48 89 ef 49 c1 ed 0c 4c 89 ee e8 a7 3d 9e ff 4c 39 ed 0f 84 bf fd ff ff e8 b9 43 9e ff 90 <0f> 0b 90 e9 b1 fd ff ff e8 ab 43 9e ff 48 8b 54 24 38 48 b8 00 00
RSP: 0018:ffffc900044df5d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802c304280 RCX: 0000000000000000
RDX: ffff888029102580 RSI: ffffffff826cbe17 RDI: ffff888029102580
RBP: 0000000200000004 R08: 0000000000000006 R09: 0000000200000004
R10: 0000000200000ffe R11: 0000000000000000 R12: ffff88802c3042d0
R13: 0000000200000ffe R14: ffffc900044dfb70 R15: 0000000000000000
FS:  000055557a080500(0000) GS:ffff8880d5ea2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efef6a70000 CR3: 000000002c5f9000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 vms_gather_munmap_vmas+0x1d2/0x1720 mm/vma.c:1472
 do_vmi_align_munmap+0x287/0x5f0 mm/vma.c:1640
 do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1697
 shrink_vma+0x1c5/0x380 mm/mremap.c:1419
 mremap_at mm/mremap.c:1650 [inline]
 do_mremap mm/mremap.c:2006 [inline]
 __do_sys_mremap+0x12d6/0x1780 mm/mremap.c:2062
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efef6b9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc42181f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007efef6e25fa0 RCX: 00007efef6b9e0d9
RDX: 0000000000001000 RSI: 0000000000002000 RDI: 0000200000ffd000
RBP: 00007efef6c35024 R08: 0000200000ffe000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efef6e25fac R14: 00007efef6e25fa0 R15: 00007efef6e25fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
pgoff != vma->vm_start >> 12
WARNING: mm/vma.h:276 at assert_sane_pgoff mm/vma.h:276 [inline], CPU#3: syz.0.17/5909
WARNING: mm/vma.h:276 at vma_set_pgoff mm/vma.h:282 [inline], CPU#3: syz.0.17/5909
WARNING: mm/vma.h:276 at vma_add_pgoff mm/vma.h:289 [inline], CPU#3: syz.0.17/5909
WARNING: mm/vma.h:276 at __split_vma+0x1228/0x1800 mm/vma.c:578, CPU#3: syz.0.17/5909
Modules linked in:
CPU: 3 UID: 0 PID: 5909 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:assert_sane_pgoff mm/vma.h:276 [inline]
RIP: 0010:vma_set_pgoff mm/vma.h:282 [inline]
RIP: 0010:vma_add_pgoff mm/vma.h:289 [inline]
RIP: 0010:__split_vma+0x1228/0x1800 mm/vma.c:578
Code: 3c 02 00 0f 85 d3 05 00 00 4c 8b 2b 48 89 ef 49 c1 ed 0c 4c 89 ee e8 a7 3d 9e ff 4c 39 ed 0f 84 bf fd ff ff e8 b9 43 9e ff 90 <0f> 0b 90 e9 b1 fd ff ff e8 ab 43 9e ff 48 8b 54 24 38 48 b8 00 00
RSP: 0018:ffffc900044df5d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802c304280 RCX: 0000000000000000
RDX: ffff888029102580 RSI: ffffffff826cbe17 RDI: ffff888029102580
RBP: 0000000200000004 R08: 0000000000000006 R09: 0000000200000004
R10: 0000000200000ffe R11: 0000000000000000 R12: ffff88802c3042d0
R13: 0000000200000ffe R14: ffffc900044dfb70 R15: 0000000000000000
FS:  000055557a080500(0000) GS:ffff8880d5ea2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efef6a70000 CR3: 000000002c5f9000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 vms_gather_munmap_vmas+0x1d2/0x1720 mm/vma.c:1472
 do_vmi_align_munmap+0x287/0x5f0 mm/vma.c:1640
 do_vmi_munmap+0x1f8/0x3e0 mm/vma.c:1697
 shrink_vma+0x1c5/0x380 mm/mremap.c:1419
 mremap_at mm/mremap.c:1650 [inline]
 do_mremap mm/mremap.c:2006 [inline]
 __do_sys_mremap+0x12d6/0x1780 mm/mremap.c:2062
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efef6b9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc42181f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007efef6e25fa0 RCX: 00007efef6b9e0d9
RDX: 0000000000001000 RSI: 0000000000002000 RDI: 0000200000ffd000
RBP: 00007efef6c35024 R08: 0000200000ffe000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efef6e25fac R14: 00007efef6e25fa0 R15: 00007efef6e25fa0
 </TASK>