Extracting prog: 1m8.397067142s
Minimizing prog: 15m38.322360691s
Simplifying prog options: 0s
Extracting C: 28.231632745s
Simplifying C: 4m44.508870477s


extracting reproducer from 69 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic-syz_genetlink_get_family_id$devlink-ioctl$TUNGETDEVNETNS-openat$dlm_plock-ioctl$DVB_DVR_DMX_EXPBUF-sendmsg$DEVLINK_CMD_RELOAD-sendmsg$IPVS_CMD_NEW_DAEMON
detailed listing:
executing program 0:
r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r2=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r2, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r1, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r3) (async)
r5 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) (async, rerun: 32)
r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32)
ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000100)={0x6, 0x0, <r7=>r1})
sendmsg$DEVLINK_CMD_RELOAD(r3, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, r4, 0x300, 0x70bd29, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r6}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r7}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20040084}, 0x804) (async)
sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x44, r0, 0x1, 0x70bd26, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'batadv0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x8090)

program crashed: general protection fault in iommufd_ioas_change_process
single: successfully extracted reproducer
found reproducer with 12 syscalls
minimizing guilty program
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic-syz_genetlink_get_family_id$devlink-ioctl$TUNGETDEVNETNS-openat$dlm_plock-ioctl$DVB_DVR_DMX_EXPBUF-sendmsg$DEVLINK_CMD_RELOAD
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r2) (async)
r4 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) (async, rerun: 32)
r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32)
ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000100)={0x6, 0x0, <r6=>r0})
sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, r3, 0x300, 0x70bd29, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r6}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20040084}, 0x804) (async)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic-syz_genetlink_get_family_id$devlink-ioctl$TUNGETDEVNETNS-openat$dlm_plock-ioctl$DVB_DVR_DMX_EXPBUF
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r2) (async)
ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) (async, rerun: 32)
openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32)
ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000100)={0x6, 0x0, r0})

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic-syz_genetlink_get_family_id$devlink-ioctl$TUNGETDEVNETNS-openat$dlm_plock
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r2) (async)
ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) (async, rerun: 32)
openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async, rerun: 32)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic-syz_genetlink_get_family_id$devlink-ioctl$TUNGETDEVNETNS
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r2) (async)
ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) (async, rerun: 32)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic-syz_genetlink_get_family_id$devlink
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)
syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r2) (async)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl-socket$nl_generic
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)
socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc})
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-openat$iommufd-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, 0x0, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$ipvs-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r0=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r0, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(0xffffffffffffffff, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001})
ioctl(r0, 0x3b92, &(0x7f0000000000)="10")

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0)
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, 0x0, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001})
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, 0x0) (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)) (async, rerun: 64)

program did not crash
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10") (rerun: 64)

program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10")

program crashed: general protection fault in iommufd_ioas_change_process
extracting C reproducer
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
simplifying C reproducer
testing compiled C program (duration=35.983517478s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program did not crash
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program did not crash
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
testing compiled C program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
program crashed: general protection fault in iommufd_ioas_change_process
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10")

program crashed: general protection fault in iommufd_ioas_change_process
validation run: crashed=true
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10")

program crashed: general protection fault in iommufd_ioas_change_process
validation run: crashed=true
testing program (duration=35.983517478s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_IOAS_MAP$PAGES-ioctl
detailed listing:
executing program 0:
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000001c0)={0xc, 0x0, <r1=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r1, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8001}) (async)
ioctl(r0, 0x3b92, &(0x7f0000000000)="10")

program crashed: general protection fault in iommufd_ioas_change_process
validation run: crashed=true
reproducing took 23m55.690295689s
repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
CPU: 2 UID: 0 PID: 6443 Comm: syz.0.201 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:iommufd_ioas_change_process+0x513/0x11c0 drivers/iommu/iommufd/ioas.c:538
Code: 5b fc 48 8d 7b 68 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 e1 0a 00 00 48 8b 6b 68 48 8d bd c0 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e d5 0a 00 00 8b ad c0 00 00
RSP: 0018:ffffc9000503fba0 EFLAGS: 00010206
RAX: 0000000000000018 RBX: ffff8880550e9400 RCX: ffffffff8526f53b
RDX: ffff88802c6b8000 RSI: ffffffff85af13fb RDI: 00000000000000c0
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000001fff R11: 0000000000000000 R12: 0000000000000007
R13: fffffbfff22438f4 R14: dffffc0000000000 R15: ffffc9000503fc38
FS:  00007f1248ff36c0(0000) GS:ffff8880d5fec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1248ff2ff8 CR3: 000000005355a000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 iommufd_fops_ioctl+0x358/0x520 drivers/iommu/iommufd/main.c:533
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f124819e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1248ff3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1248426090 RCX: 00007f124819e0d9
RDX: 0000200000000000 RSI: 0000000000003b92 RDI: 0000000000000003
RBP: 00007f1248235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1248426128 R14: 00007f1248426090 R15: 00007ffea12de908
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:iommufd_ioas_change_process+0x513/0x11c0 drivers/iommu/iommufd/ioas.c:538
Code: 5b fc 48 8d 7b 68 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 e1 0a 00 00 48 8b 6b 68 48 8d bd c0 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e d5 0a 00 00 8b ad c0 00 00
RSP: 0018:ffffc9000503fba0 EFLAGS: 00010206
RAX: 0000000000000018 RBX: ffff8880550e9400 RCX: ffffffff8526f53b
RDX: ffff88802c6b8000 RSI: ffffffff85af13fb RDI: 00000000000000c0
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000001fff R11: 0000000000000000 R12: 0000000000000007
R13: fffffbfff22438f4 R14: dffffc0000000000 R15: ffffc9000503fc38
FS:  00007f1248ff36c0(0000) GS:ffff8880d5fec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1248ff2ff8 CR3: 000000005355a000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	5b                   	pop    %rbx
   1:	fc                   	cld
   2:	48 8d 7b 68          	lea    0x68(%rbx),%rdi
   6:	48 89 f8             	mov    %rdi,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1)
  12:	0f 85 e1 0a 00 00    	jne    0xaf9
  18:	48 8b 6b 68          	mov    0x68(%rbx),%rbp
  1c:	48 8d bd c0 00 00 00 	lea    0xc0(%rbp),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 04 30       	movzbl (%rax,%r14,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	74 08                	je     0x3b
  33:	3c 03                	cmp    $0x3,%al
  35:	0f 8e d5 0a 00 00    	jle    0xb10
  3b:	8b                   	.byte 0x8b
  3c:	ad                   	lods   %ds:(%rsi),%eax
  3d:	c0 00 00             	rolb   $0x0,(%rax)

final repro crashed as (corrupted=false):
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
CPU: 2 UID: 0 PID: 6443 Comm: syz.0.201 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:iommufd_ioas_change_process+0x513/0x11c0 drivers/iommu/iommufd/ioas.c:538
Code: 5b fc 48 8d 7b 68 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 e1 0a 00 00 48 8b 6b 68 48 8d bd c0 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e d5 0a 00 00 8b ad c0 00 00
RSP: 0018:ffffc9000503fba0 EFLAGS: 00010206
RAX: 0000000000000018 RBX: ffff8880550e9400 RCX: ffffffff8526f53b
RDX: ffff88802c6b8000 RSI: ffffffff85af13fb RDI: 00000000000000c0
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000001fff R11: 0000000000000000 R12: 0000000000000007
R13: fffffbfff22438f4 R14: dffffc0000000000 R15: ffffc9000503fc38
FS:  00007f1248ff36c0(0000) GS:ffff8880d5fec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1248ff2ff8 CR3: 000000005355a000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 iommufd_fops_ioctl+0x358/0x520 drivers/iommu/iommufd/main.c:533
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f124819e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1248ff3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1248426090 RCX: 00007f124819e0d9
RDX: 0000200000000000 RSI: 0000000000003b92 RDI: 0000000000000003
RBP: 00007f1248235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1248426128 R14: 00007f1248426090 R15: 00007ffea12de908
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:iommufd_ioas_change_process+0x513/0x11c0 drivers/iommu/iommufd/ioas.c:538
Code: 5b fc 48 8d 7b 68 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 e1 0a 00 00 48 8b 6b 68 48 8d bd c0 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e d5 0a 00 00 8b ad c0 00 00
RSP: 0018:ffffc9000503fba0 EFLAGS: 00010206
RAX: 0000000000000018 RBX: ffff8880550e9400 RCX: ffffffff8526f53b
RDX: ffff88802c6b8000 RSI: ffffffff85af13fb RDI: 00000000000000c0
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: 0000000000001fff R11: 0000000000000000 R12: 0000000000000007
R13: fffffbfff22438f4 R14: dffffc0000000000 R15: ffffc9000503fc38
FS:  00007f1248ff36c0(0000) GS:ffff8880d5fec000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1248ff2ff8 CR3: 000000005355a000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	5b                   	pop    %rbx
   1:	fc                   	cld
   2:	48 8d 7b 68          	lea    0x68(%rbx),%rdi
   6:	48 89 f8             	mov    %rdi,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1)
  12:	0f 85 e1 0a 00 00    	jne    0xaf9
  18:	48 8b 6b 68          	mov    0x68(%rbx),%rbp
  1c:	48 8d bd c0 00 00 00 	lea    0xc0(%rbp),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 04 30       	movzbl (%rax,%r14,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	74 08                	je     0x3b
  33:	3c 03                	cmp    $0x3,%al
  35:	0f 8e d5 0a 00 00    	jle    0xb10
  3b:	8b                   	.byte 0x8b
  3c:	ad                   	lods   %ds:(%rsi),%eax
  3d:	c0 00 00             	rolb   $0x0,(%rax)