------------[ cut here ]------------
WARNING: CPU: 1 PID: 11995 at mm/mmap.c:965 vma_merge+0x24c/0xde8 mm/mmap.c:965
Modules linked in:
CPU: 1 PID: 11995 Comm: syz-executor.1 Not tainted 6.4.0-rc6-syzkaller #0
Hardware name: linux,dummy-virt (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : vma_merge+0x24c/0xde8 mm/mmap.c:965
lr : vma_merge+0xe8/0xde8 mm/mmap.c:935
sp : ffff800012707920
x29: ffff800012707920 x28: 0000000000000000 x27: 0000000000000000
x26: 0000000000000000 x25: ffff0000172f5ee0 x24: ffff000013dbcf00
x23: ffff000013dbc700 x22: 1ffff000024e0f38 x21: ffff000013e57080
x20: 0000000020ff4000 x19: 0000000020fff000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000007 x15: 1ffff000024e0eb6
x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff700002200125
x11: 1fffe000027b79e0 x10: 0000000000000000 x9 : dfff800000000000
x8 : ffff800011000923 x7 : 0000000000000004 x6 : 0000000000000001
x5 : ffff800011000920 x4 : 0000000000000003 x3 : ffff000013dbcf08
x2 : 000000000001ffff x1 : 1fffe000027b78e0 x0 : 0000000020000000
Call trace:
 vma_merge+0x24c/0xde8 mm/mmap.c:965
 userfaultfd_register fs/userfaultfd.c:1485 [inline]
 userfaultfd_ioctl+0x2bdc/0x3590 fs/userfaultfd.c:2050
 compat_ptr_ioctl+0x5c/0xa4 fs/ioctl.c:906
 __do_compat_sys_ioctl fs/ioctl.c:968 [inline]
 __se_compat_sys_ioctl fs/ioctl.c:910 [inline]
 __arm64_compat_sys_ioctl+0x1d0/0x21c fs/ioctl.c:910
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x6c/0x260 arch/arm64/kernel/syscall.c:52
 el0_svc_common.constprop.0+0xc4/0x254 arch/arm64/kernel/syscall.c:142
 do_el0_svc_compat+0x40/0x70 arch/arm64/kernel/syscall.c:199
 el0_svc_compat+0x4c/0x130 arch/arm64/kernel/entry-common.c:773
 el0t_32_sync_handler+0x90/0x140 arch/arm64/kernel/entry-common.c:783
 el0t_32_sync+0x194/0x198 arch/arm64/kernel/entry.S:596
irq event stamp: 382
hardirqs last  enabled at (381): [<ffff80000cb2d038>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (381): [<ffff80000cb2d038>] exit_to_kernel_mode+0x38/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (382): [<ffff80000cb2e478>] el1_dbg+0x24/0x9c arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (370): [<ffff800008010804>] _stext+0x804/0xd68
softirqs last disabled at (365): [<ffff8000080194bc>] ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---