Extracting prog: 59.285592145s
Minimizing prog: 20m35.433446606s
Simplifying prog options: 2m18.802749276s
Extracting C: 29.536118111s
Simplifying C: 0s


extracting reproducer from 79 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_ro-mmap-mmap-openat$cgroup_ro-mmap-openat$cgroup_ro
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x10, r8, 0x0)
mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r8, 0xaa0f4000)
r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r9, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0)

program crashed: WARNING in __split_vma
single: successfully extracted reproducer
found reproducer with 29 syscalls
minimizing guilty program
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_ro-mmap-mmap-openat$cgroup_ro-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x10, r8, 0x0)
mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r8, 0xaa0f4000)
r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r9, 0x0)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_ro-mmap-mmap-openat$cgroup_ro
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x10, r8, 0x0)
mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r8, 0xaa0f4000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_ro-mmap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x10, r8, 0x0)
mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r8, 0xaa0f4000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_ro-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)
mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x10, r8, 0x0)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro-openat$cgroup_ro
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro-openat$cgroup_ro
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap-openat$cgroup_ro
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mremap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000002000/0x2000)=nil)

program did not crash
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-write$tun-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r7 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
write$tun(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program did not crash
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-sendmsg$nl_route_sched-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r4=>0x0})
r5 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r6 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000cc0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7ff, 0x7ff, 0x0, 0x1}, @rand_addr=0x64010102, @private=0xa010101, 0x0, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8c}}, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$nl_route_sched-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r4=>0x0})
r5 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r6 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffe0, 0xffff}, {0x0, 0x2}}, [@TCA_STAB={0x14c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x3, 0x2, 0x0, 0x0, 0x6, 0xfff, 0x6}}, {0x10, 0x2, [0x1, 0x64b1, 0x8000, 0x1, 0x7, 0x2900]}}, {{0x1c, 0x1, {0xeb, 0x6, 0x800, 0x3, 0x2, 0x4a6f8842, 0x101, 0x7}}, {0x12, 0x2, [0x1, 0xd, 0x1, 0x9, 0x3, 0x6fe, 0x800]}}, {{0x1c, 0x1, {0x9, 0x9, 0x4, 0x23a8cb84, 0x1, 0x7, 0x5, 0x4}}, {0xc, 0x2, [0xf000, 0x2, 0x7f, 0x6]}}, {{0x1c, 0x1, {0x0, 0xe, 0xc, 0x2, 0x2, 0x9, 0x8, 0x2}}, {0x8, 0x2, [0x5, 0x3]}}, {{0x1c, 0x1, {0x5, 0x6, 0x9, 0x9, 0x2, 0x4, 0x6, 0xffffffffffffff0a}}, {0x8, 0x2, [0x7, 0x8]}}, {{0x1c, 0x1, {0xe, 0x81, 0x198, 0xfdc1, 0x1, 0x8, 0x9eba, 0x3}}, {0xa, 0x2, [0x5, 0x8, 0x9]}}, {{0x1c, 0x1, {0x8, 0x0, 0x3, 0x7f, 0x0, 0x6, 0xa, 0x6}}, {0x10, 0x2, [0x1, 0x6d, 0x4, 0x9, 0xff, 0x4]}}, {{0x1c, 0x1, {0x7, 0x7, 0xa000, 0x3, 0x1, 0x9, 0x4, 0x3}}, {0xa, 0x2, [0x9, 0x26, 0x0]}}]}]}, 0x170}}, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'})
r3 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
r4 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-socket$inet-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'})
r3 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
socket$inet(0x2, 0x2, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'})
r3 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c001b28000000dc3f7cabbdc625730000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001c0012800b000100697036746e6c00000c0002800800070003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'})
socket(0x10, 0x803, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-ioctl$sock_SIOCGIFINDEX-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
r0 = socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'})
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-socket$nl_route-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-openat$tun-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-syz_genetlink_get_family_id$ethtool-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-socket$nl_generic-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
socket$nl_generic(0x10, 0x3, 0x10)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-bpf$PROG_LOAD_XDP-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x5}, 0x94)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-socket$nl_route-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
socket$nl_route(0x10, 0x3, 0x0)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program did not crash
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-mremap-mmap
detailed listing:
executing program 0:
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program did not crash
testing program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(0x0, 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program did not crash
extracting C reproducer
testing compiled C program (duration=32.013236013s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
program did not crash
simplifying guilty program options
testing program (duration=32.013236013s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
extracting C reproducer
testing compiled C program (duration=32.013236013s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
program did not crash
testing program (duration=32.013236013s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
extracting C reproducer
testing compiled C program (duration=32.013236013s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
program did not crash
testing program (duration=32.013236013s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
validation run: crashed=true
testing program (duration=32.013236013s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
validation run: crashed=true
testing program (duration=32.013236013s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$sg-mremap-mremap-mmap
detailed listing:
executing program 0:
syz_open_dev$sg(&(0x7f0000000000), 0x10000004000, 0x1)
mremap(&(0x7f0000002000/0x4000)=nil, 0x200000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil)
mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000002000/0x4000)=nil)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0xff46d000)

program crashed: WARNING in __split_vma
validation run: crashed=true
reproducing took 26m29.839513176s
repro crashed as (corrupted=false):
------------[ cut here ]------------
pgoff != vma->vm_start >> 12
WARNING: mm/vma.h:276 at assert_sane_pgoff mm/vma.h:276 [inline], CPU#2: syz.0.17/5917
WARNING: mm/vma.h:276 at vma_set_pgoff mm/vma.h:282 [inline], CPU#2: syz.0.17/5917
WARNING: mm/vma.h:276 at vma_add_pgoff mm/vma.h:289 [inline], CPU#2: syz.0.17/5917
WARNING: mm/vma.h:276 at __split_vma+0xafd/0x1800 mm/vma.c:539, CPU#2: syz.0.17/5917
Modules linked in:
CPU: 2 UID: 0 PID: 5917 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:assert_sane_pgoff mm/vma.h:276 [inline]
RIP: 0010:vma_set_pgoff mm/vma.h:282 [inline]
RIP: 0010:vma_add_pgoff mm/vma.h:289 [inline]
RIP: 0010:__split_vma+0xafd/0x1800 mm/vma.c:539
Code: 06 fb ff ff e8 04 4b 9e ff 4d 89 e7 4c 89 ef 49 c1 ef 0c 4c 89 fe e8 d2 44 9e ff 4d 39 fd 0f 84 e6 fa ff ff e8 e4 4a 9e ff 90 <0f> 0b 90 e9 d8 fa ff ff e8 d6 4a 9e ff 48 8d 7d 28 48 b8 00 00 00
RSP: 0018:ffffc90003b27228 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88803de48500 RCX: 0000000000000000
RDX: ffff888023e2a580 RSI: ffffffff826cb6ec RDI: ffff888023e2a580
RBP: ffff88803de48c80 R08: 0000000000000006 R09: 0000000200000005
R10: 0000000200000fff R11: 0000000000000001 R12: 0000200000fff000
R13: 0000000200000005 R14: ffffc90003b275c8 R15: 0000000200000fff
FS:  000055555fb96500(0000) GS:ffff8880d5da2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c8dc70000 CR3: 000000002662c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 vms_gather_munmap_vmas+0x3a5/0x1720 mm/vma.c:1493
 __mmap_setup mm/vma.c:2496 [inline]
 __mmap_region+0x4a7/0x30b0 mm/vma.c:2818
 mmap_region+0x3db/0x6d0 mm/vma.c:2921
 do_mmap+0x12c7/0x1c30 mm/mmap.c:573
 vm_mmap_pgoff+0x28d/0x470 mm/util.c:581
 ksys_mmap_pgoff+0xe4/0x610 mm/mmap.c:619
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4c8dd9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff8175a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f4c8e025fa0 RCX: 00007f4c8dd9e0d9
RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000200000ffb000
RBP: 00007f4c8de35024 R08: ffffffffffffffff R09: 00000000ff46d000
R10: 840000000000a132 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4c8e025fac R14: 00007f4c8e025fa0 R15: 00007f4c8e025fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
pgoff != vma->vm_start >> 12
WARNING: mm/vma.h:276 at assert_sane_pgoff mm/vma.h:276 [inline], CPU#2: syz.0.17/5917
WARNING: mm/vma.h:276 at vma_set_pgoff mm/vma.h:282 [inline], CPU#2: syz.0.17/5917
WARNING: mm/vma.h:276 at vma_add_pgoff mm/vma.h:289 [inline], CPU#2: syz.0.17/5917
WARNING: mm/vma.h:276 at __split_vma+0xafd/0x1800 mm/vma.c:539, CPU#2: syz.0.17/5917
Modules linked in:
CPU: 2 UID: 0 PID: 5917 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:assert_sane_pgoff mm/vma.h:276 [inline]
RIP: 0010:vma_set_pgoff mm/vma.h:282 [inline]
RIP: 0010:vma_add_pgoff mm/vma.h:289 [inline]
RIP: 0010:__split_vma+0xafd/0x1800 mm/vma.c:539
Code: 06 fb ff ff e8 04 4b 9e ff 4d 89 e7 4c 89 ef 49 c1 ef 0c 4c 89 fe e8 d2 44 9e ff 4d 39 fd 0f 84 e6 fa ff ff e8 e4 4a 9e ff 90 <0f> 0b 90 e9 d8 fa ff ff e8 d6 4a 9e ff 48 8d 7d 28 48 b8 00 00 00
RSP: 0018:ffffc90003b27228 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88803de48500 RCX: 0000000000000000
RDX: ffff888023e2a580 RSI: ffffffff826cb6ec RDI: ffff888023e2a580
RBP: ffff88803de48c80 R08: 0000000000000006 R09: 0000000200000005
R10: 0000000200000fff R11: 0000000000000001 R12: 0000200000fff000
R13: 0000000200000005 R14: ffffc90003b275c8 R15: 0000000200000fff
FS:  000055555fb96500(0000) GS:ffff8880d5da2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4c8dc70000 CR3: 000000002662c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 vms_gather_munmap_vmas+0x3a5/0x1720 mm/vma.c:1493
 __mmap_setup mm/vma.c:2496 [inline]
 __mmap_region+0x4a7/0x30b0 mm/vma.c:2818
 mmap_region+0x3db/0x6d0 mm/vma.c:2921
 do_mmap+0x12c7/0x1c30 mm/mmap.c:573
 vm_mmap_pgoff+0x28d/0x470 mm/util.c:581
 ksys_mmap_pgoff+0xe4/0x610 mm/mmap.c:619
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4c8dd9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff8175a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f4c8e025fa0 RCX: 00007f4c8dd9e0d9
RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000200000ffb000
RBP: 00007f4c8de35024 R08: ffffffffffffffff R09: 00000000ff46d000
R10: 840000000000a132 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4c8e025fac R14: 00007f4c8e025fa0 R15: 00007f4c8e025fa0
 </TASK>