Extracting prog: 11m12.291177368s
Minimizing prog: 1h45m23.793585896s
Simplifying prog options: 0s
Extracting C: 1m2.600786154s
Simplifying C: 11m48.127399552s


12 programs, 3 VMs, timeouts [45s 5m0s 16m0s]
extracting reproducer from 12 programs
single: executing 2 programs separately with timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$BINDER_CTL_ADD-mq_open-ioctl$BTRFS_IOC_SNAP_DESTROY_V2-ioctl$TIOCL_UNBLANKSCREEN-pipe2$watch_queue-socket$unix-recvmmsg$unix-ioctl$F2FS_IOC_GET_FEATURES-recvmmsg$unix-ioctl$TIOCL_UNBLANKSCREEN
detailed listing:
executing program 0:
ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0x5452, 0x0)
r0 = mq_open(&(0x7f00000000c0)='$}}:]@\x00', 0x42, 0x0, 0x0)
ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5452, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(r0, 0x5421, &(0x7f0000000380))
pipe2$watch_queue(0x0, 0x80)
socket$unix(0x1, 0x2, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580), 0x18}}], 0x1, 0x22001, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(r0, 0x5451, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f00000015c0), 0x0, 0x10123, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x5421, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
single: failed to extract reproducer
bisect: bisecting 12 programs with base timeout 45s
testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 3, 4, 10, 5, 5, 3, 13, 8, 3, 10]
detailed listing:
executing program 1:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cpuacct.stat\x00', 0x26e1, 0x0)
close(r0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300))
sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x2e, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[], 0x33fe0}}, 0x0)
sendmsg$SEG6_CMD_DUMPHMAC(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000), 0x2, 0x9}}, 0x20)
executing program 0:
close(0xffffffffffffffff)
socket$inet6_icmp(0xa, 0x2, 0x3a)
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = mq_open(&(0x7f0000000080)='@\x00', 0x40, 0x0, 0x0)
ioctl$BTRFS_IOC_QGROUP_ASSIGN(r0, 0x5450, 0x0)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10)
recvfrom$inet(r0, &(0x7f0000000240)=""/7, 0x7, 0x40, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10)
executing program 0:
r0 = mq_open(&(0x7f0000000500)='wg1\x00', 0x40, 0x0, 0x0)
r1 = memfd_create(&(0x7f0000000600)='\x00', 0x0)
r2 = dup3(r1, r0, 0x0)
write$tcp_congestion(r2, 0x0, 0x0)
executing program 0:
ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0x5452, 0x0)
r0 = mq_open(&(0x7f00000000c0)='$}}:]@\x00', 0x42, 0x0, 0x0)
ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5452, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(r0, 0x5421, &(0x7f0000000380))
pipe2$watch_queue(0x0, 0x80)
socket$unix(0x1, 0x2, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580), 0x18}}], 0x1, 0x22001, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(r0, 0x5451, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f00000015c0), 0x0, 0x10123, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x5421, 0x0)
executing program 1:
r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
close(r0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = syz_open_pts(r0, 0x0)
ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0x5450, 0x0)
executing program 0:
close(0xffffffffffffffff)
socket$inet6_icmp(0xa, 0x2, 0x3a)
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = mq_open(&(0x7f0000000080)='@\x00', 0x40, 0x0, 0x0)
ioctl$BTRFS_IOC_QGROUP_ASSIGN(r0, 0x5450, 0x0)
executing program 1:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x69ff9a93bfc25838)
ioctl$BTRFS_IOC_SYNC(r0, 0x8902, 0x20000000)
executing program 1:
syz_open_procfs$namespace(0x0, 0x0)
r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
pipe2(0x0, 0x0)
getsockname$netlink(0xffffffffffffffff, 0x0, 0x0)
mq_open(0x0, 0x0, 0x0, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0)
close(r0)
r1 = mq_open(&(0x7f00000000c0)='*\x00\x1e\x95\x9a\x17u\xff\xff\xff\xff@\x00', 0x40, 0x0, 0x0)
ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x5451, 0x0)
ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x5421, 0x0)
openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x5450, 0x0)
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)
executing program 1:
listen(0xffffffffffffffff, 0x0)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x2000002, &(0x7f0000000280)={[{@user_xattr}]}, 0x9, 0x537, &(0x7f0000000fc0)="$eJzs3c9vI1cdAPCvJ4mTbtNmF3qACtgFCgtarb3xtlHVC90LCFWVEIgD4rANiTcKseMQO1UTIpH+DXDgCn8CByQOSD1x4MYRiQNCKgekBSLQBgkkoxlPUm/idL2Nf0D8+UijmTfPM9/3ksy8mefJvAAm1o2IOIiIYkS8FREL+fpCPsXrnSn93KPD/ZWjw/2VQrTb3/pbIctP10XXNqln833ORcQ3vxbxvcLZuM3dvY3lWq26nafLrfpWubm7d3u9vrxWXatuVipLi0t3Xr37SmVgdb1e/8XDr66/8e1f/+rT7//u4Ms/TIs1n+d112OQOlWfOYmTmo6IN4YRbAym8nlxzOXgo0ki4mMR8bns+F+IqeyvEwC4zNrthWgvdKcBgMsuyfrACkkp7wuYjyQplTp9eC/ElaTWaLZuPWjsbK52+squxkzyYL1WvXNt9g8/yK4YZgppejHLy/KzdOVU+m5EXIuIn8w+k6VLK43a6vguewBgoj17qv3/52yn/e9Dj2/1AID/G3PjLgAAMHLafwCYPNp/AJg8fbT/+Zf9B0MvCwAwGk9x/58MsxwAwOjo/weAyaP9B4CJ8o0330yn9lH+/uvVt3d3Nhpv316tNjdK9Z2V0kpje6u01misZe/sqT9pf7VGY2vx5dh5p9yqNlvl5u7e/XpjZ7N1P3uv9/3qzEhqBQB8mGvX3/t9ISIOXnsmm6JrLAdtNVxunueByeUlfjC5jPYFk6v/e/zfDrUcwPj0vA+Y67n4uJ8+RRDPGcH/lJuf7L//3xjPcLno/4fJNfWRtpodeDmA0dP/D5Or3S6cHvO/eJIFAFxKF3jGv/2jQV2EAGP1pOeAB/L9PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwy8xHx/SgkpXws8PlIklIp4rmIuBozhQfrteqdiHg+rkfEzGyaXhx3oQGAC0r+UsjH/7q58NL86dxi4V/ZYP/FtPXP120vpuv/frJ+9nj4sMoH211gXEEAYMDeWW61tiv5vOtG/tHh/srxNMryPLwX/8mHIl45OtzPpk7OdExn87nsWuLKPwp5ujMW6YsRMTWA+AfvRsQnetW/kPWNXM1HPu2OH3ns50YaP3ksfpLldebpxdfHB1AWmDTv3YuI13sdf0ncyOa9j/+57Ax1cQ/vdXZ2fO47OtwvHsc/Pv9N9YifHvM3+o3x8m++fmZle6GT927Ei9OPxT85/xzHL5wT/6U+4//xU5/58VfOyWv/LOJm9I7fHavcqm+Vm7t7t9fry2vVtepmpbK0uHTn1buvVMpZH3X5uKf6rL++duv588qW1v/KOfHneta/eLLtF/qs/8///dZ3P/sh8b/0+V7xk3ihZ/yOtE38Yp/xl6/88tzhu9P4q+fU/0m//1t9xn//z3urfX4UABiB5u7exnKtVt2+0EJ6FzqI/ZxZSIs40B32WCh2Ff5PMdxYT7UwM6yf6tAXpk+uFQe75++kexxxdZKB1+JCC49GFWu85yVg+D446MddEgAAAAAAAAAAAAAA4Dyj+NelcdcRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAy+u/AQAA//9xkcaD")
quotactl$Q_SETQUOTA(0xffffffff80000900, &(0x7f0000000c80)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
executing program 1:
ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0x5452, 0x0)
r0 = mq_open(&(0x7f00000000c0)='$}}:]@\x00', 0x42, 0x0, 0x0)
ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5452, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(r0, 0x5421, &(0x7f0000000380))
pipe2$watch_queue(0x0, 0x80)
socket$unix(0x1, 0x2, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580), 0x18}}], 0x1, 0x22001, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(r0, 0x5451, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f00000015c0), 0x0, 0x10123, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x5421, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 2 programs separately with timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$BINDER_CTL_ADD-mq_open-ioctl$BTRFS_IOC_SNAP_DESTROY_V2-ioctl$TIOCL_UNBLANKSCREEN-pipe2$watch_queue-socket$unix-recvmmsg$unix-ioctl$F2FS_IOC_GET_FEATURES-recvmmsg$unix-ioctl$TIOCL_UNBLANKSCREEN
detailed listing:
executing program 0:
ioctl$BINDER_CTL_ADD(0xffffffffffffffff, 0x5452, 0x0)
r0 = mq_open(&(0x7f00000000c0)='$}}:]@\x00', 0x42, 0x0, 0x0)
ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5452, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(r0, 0x5421, &(0x7f0000000380))
pipe2$watch_queue(0x0, 0x80)
socket$unix(0x1, 0x2, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001580), 0x18}}], 0x1, 0x22001, 0x0)
ioctl$F2FS_IOC_GET_FEATURES(r0, 0x5451, 0x0)
recvmmsg$unix(0xffffffffffffffff, &(0x7f00000015c0), 0x0, 0x10123, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x5421, 0x0)

program did not crash
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program crashed: BUG: unable to handle kernel NULL pointer dereference in corrupted
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
io_uring_setup(0x3eb2, &(0x7f0000000080))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0))
r0 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, 0x0, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)
ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
detailed listing:
executing program 0:
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0))
r1 = io_uring_setup(0x3eb2, &(0x7f0000000080))
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
ioctl$UFFDIO_COPY(r0, 0xc028aa05, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)

program did not crash
extracting C reproducer
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: BUG: unable to handle kernel paging request in cpuacct_charge
simplifying C reproducer
testing compiled C program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program did not crash
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: BUG: Bad rss-counter state
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: BUG: unable to handle kernel paging request in corrupted
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: kernel stack overflow in lock_mm_and_find_vma
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: BUG: unable to handle kernel NULL pointer dereference in __khugepaged_exit
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: BUG: unable to handle kernel paging request in corrupted
reproducing took 2h9m26.81297656s
repro crashed as (corrupted=true):
Unable to handle kernel paging request at virtual address 007000007f8eedc0
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[007000007f8eedc0] address between user and kernel address ranges

report is corrupted, running repro again
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: Internal error in corrupted
report is corrupted, running repro again
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-userfaultfd-ioctl$UFFDIO_API-io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-madvise
program crashed: BUG: unable to handle kernel paging request in mas_walk
final repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address 00700000077b9b78
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[00700000077b9b78] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3186 Comm: syz-executor162 Not tainted 6.10.0-rc1-syzkaller-00027-g4a4be1ad3a6e #0
Hardware name: linux,dummy-virt (DT)
pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : ma_data_end lib/maple_tree.c:1419 [inline]
pc : mtree_range_walk lib/maple_tree.c:2771 [inline]
pc : mas_state_walk lib/maple_tree.c:3678 [inline]
pc : mas_walk+0x194/0x328 lib/maple_tree.c:4909
lr : lock_vma_under_rcu+0x58/0x134 mm/memory.c:5840
sp : ffff800088cabd50
x29: ffff800088cabd50 x28: f2f0000005e50000 x27: 0000000000000000
x26: 0000000000000004 x25: f7f0000005c03900 x24: 0000000082000007
x23: 0000ffff82687800 x22: 0000000000000354 x21: 0000ffff82687800
x20: 0000ffff82687800 x19: ffff800088cabeb0 x18: ff7ffffffffffbff
x17: 0000aaaadab2dc00 x16: 1e4e000000ef7371 x15: 0000000000000001
x14: ffffffffffffffff x13: 0000000000000000 x12: ffff800081e3d1e8
x11: 0000000000000001 x10: f2700000077b9b8c x9 : f2700000077b9b00
x8 : 0000ffff82687800 x7 : 0000000000000001 x6 : 000000000000000e
x5 : 0000000000000001 x4 : ffff800088cabd78 x3 : 0000aaaadab2dc00
x2 : 000000000000000e x1 : 000000000000000f x0 : f2700000077b9b08
Call trace:
 ma_data_end lib/maple_tree.c:1418 [inline]
 mtree_range_walk lib/maple_tree.c:2771 [inline]
 mas_state_walk lib/maple_tree.c:3678 [inline]
 mas_walk+0x194/0x328 lib/maple_tree.c:4909
 do_page_fault+0xd4/0x480 arch/arm64/mm/fault.c:567
 do_translation_fault+0xac/0xbc arch/arm64/mm/fault.c:690
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:826
 el0_ia+0xa4/0x118 arch/arm64/kernel/entry-common.c:598
 el0t_64_sync_handler+0xd0/0x12c arch/arm64/kernel/entry-common.c:736
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: 91002120 51000426 92401cc2 12001cc6 (f8627802) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	91002120 	add	x0, x9, #0x8
   4:	51000426 	sub	w6, w1, #0x1
   8:	92401cc2 	and	x2, x6, #0xff
   c:	12001cc6 	and	w6, w6, #0xff
* 10:	f8627802 	ldr	x2, [x0, x2, lsl #3] <-- trapping instruction