Extracting prog: 50.713984959s
Minimizing prog: 44m30.959453805s
Simplifying prog options: 0s
Extracting C: 1m15.807851355s
Simplifying C: 5m30.505723166s


extracting reproducer from 25 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-sendmsg$TEAM_CMD_OPTIONS_GET-accept$alg-recvmmsg-ioctl$USBDEVFS_SUBMITURB
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', <r8=>0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00', <r9=>0x0})
r10 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000140)={'vcan0\x00', <r11=>0x0})
bind$can_j1939(r10, &(0x7f0000000000)={0x1d, r11, 0x3}, 0x18)
sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000000e40)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41}, 0xc, &(0x7f0000000e00)={&(0x7f0000000780)={0x64c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x60, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x5, 0x5, 0x5, 0x3}, {0x2, 0x1, 0xff, 0x8}, {0x47c, 0xb3, 0x1, 0xd}, {0x7, 0x9, 0x7f, 0x1}, {0x1000, 0x4, 0x1, 0x5}]}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x1b0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xe3c0}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6df0}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5d8}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}]}, 0x64c}, 0x1, 0x0, 0x0, 0x40040000}, 0x8040)
r12 = accept$alg(r3, 0x0, 0x0)
recvmmsg(r12, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x10042, 0x0)
ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000280)=@urb_type_interrupt={0x1, {0x8}, 0x5, 0x6, &(0x7f0000000000)="4e923b2096c6f1de63a3f8030764473035cb5a61477bf7a68e99f47e21c3ec503ce9368d9e3f4d2084ace090f5d009959c7dd67d2a58123e941cb25112657d562cd8ca0fedbea1cec5c7dca4f90be59065735372165dc2b5f65516e4ea77d68aa1b79cd41177af380dba81a0a7d1a59de0cbebf059cfd5df67df5f1536fed0bd3c0467e03f97db01cd3b53451806ca7d413f09c2275bd065a8ab5a8021a4fa228b9ae87b7ac61006fb4258bc444f14529c197aeaa59edd18aa54da2d1bab6f4c93ac7db204963343e6518abdbb8dce2bbd42d42efea3496fbaffcbb7495694615d1c92f373fe0475926c", 0xea, 0x9, 0xe109, 0x0, 0x5, 0x9, &(0x7f00000001c0)="664521983b8310d601f10e8c0e2429bee60d303fc065ad69851a4ffe5619552a5fb865d5ae62c711c89a044932831faaf4ddd13b6abb12bbc1b7b9b6f0a1e3bb4ff84447a5525f5cc0c3929e26ff01ae90ec036fbc2f1f36c7b6a33c4ef2c8f4e31d70a1850afb01607ed29e46f99a6a6ce00e3c0461fe313ca56ba4f8eebf2ea806e54fe81faabdcd3cd275d6677b6cfd4f244a482c50fc12bc1909ede5d4cef4c31d58af1a8a7c4dca449e7afd"})

program crashed: WARNING in vma_merge
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-sendmsg$TEAM_CMD_OPTIONS_GET-accept$alg-recvmmsg
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', <r8=>0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00', <r9=>0x0})
r10 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000140)={'vcan0\x00', <r11=>0x0})
bind$can_j1939(r10, &(0x7f0000000000)={0x1d, r11, 0x3}, 0x18)
sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000000e40)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41}, 0xc, &(0x7f0000000e00)={&(0x7f0000000780)={0x64c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x60, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x5, 0x5, 0x5, 0x3}, {0x2, 0x1, 0xff, 0x8}, {0x47c, 0xb3, 0x1, 0xd}, {0x7, 0x9, 0x7f, 0x1}, {0x1000, 0x4, 0x1, 0x5}]}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x1b0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xe3c0}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6df0}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5d8}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}]}, 0x64c}, 0x1, 0x0, 0x0, 0x40040000}, 0x8040)
r12 = accept$alg(r3, 0x0, 0x0)
recvmmsg(r12, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x10042, 0x0)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-sendmsg$TEAM_CMD_OPTIONS_GET-accept$alg
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', <r8=>0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00', <r9=>0x0})
r10 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000140)={'vcan0\x00', <r11=>0x0})
bind$can_j1939(r10, &(0x7f0000000000)={0x1d, r11, 0x3}, 0x18)
sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000000e40)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41}, 0xc, &(0x7f0000000e00)={&(0x7f0000000780)={0x64c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x60, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x5, 0x5, 0x5, 0x3}, {0x2, 0x1, 0xff, 0x8}, {0x47c, 0xb3, 0x1, 0xd}, {0x7, 0x9, 0x7f, 0x1}, {0x1000, 0x4, 0x1, 0x5}]}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x1b0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xe3c0}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6df0}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5d8}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}]}, 0x64c}, 0x1, 0x0, 0x0, 0x40040000}, 0x8040)
accept$alg(r3, 0x0, 0x0)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-sendmsg$TEAM_CMD_OPTIONS_GET
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', <r8=>0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00', <r9=>0x0})
r10 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f0000000140)={'vcan0\x00', <r11=>0x0})
bind$can_j1939(r10, &(0x7f0000000000)={0x1d, r11, 0x3}, 0x18)
sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000000e40)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x41}, 0xc, &(0x7f0000000e00)={&(0x7f0000000780)={0x64c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x60, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x5, 0x5, 0x5, 0x3}, {0x2, 0x1, 0xff, 0x8}, {0x47c, 0xb3, 0x1, 0xd}, {0x7, 0x9, 0x7f, 0x1}, {0x1000, 0x4, 0x1, 0x5}]}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8}, {0x1b0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xe3c0}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6df0}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5d8}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}]}, 0x64c}, 0x1, 0x0, 0x0, 0x40040000}, 0x8040)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00'})
r8 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000140)={'vcan0\x00', <r9=>0x0})
bind$can_j1939(r8, &(0x7f0000000000)={0x1d, r9, 0x3}, 0x18)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket-ioctl$ifreq_SIOCGIFINDEX_vcan
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00'})
r8 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000140)={'vcan0\x00'})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan-socket
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00'})
socket(0x1d, 0x2, 0x6)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$ifreq_SIOCGIFINDEX_vcan
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000740)={'vcan0\x00'})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000700)={'ip6tnl0\x00', &(0x7f0000000640)={'syztnl2\x00', 0x0, 0x4, 0x5, 0x6, 0x401, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @dev={0xfe, 0x80, '\x00', 0x13}, 0x40, 0x40, 0xffff8fd2, 0x81}})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', <r7=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x148, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_MAX_P={0x1, 0x4, 0xfff}, @TCA_GRED_LIMIT={0x8, 0x5, 0x9}]}}]}, 0x148}}, 0x24040004)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00'})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6-socket$inet6_udp
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
socket$inet6_udp(0xa, 0x2, 0x0)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6-sendto$inet6
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
r5 = socket$inet6(0xa, 0x2, 0x3a)
sendto$inet6(r5, &(0x7f00000006c0)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER-socket$inet6
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
socket$inet6(0xa, 0x2, 0x3a)

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$UFFDIO_API-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-userfaultfd-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
r4 = userfaultfd(0x80001)
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-bind$alg-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256\x00'}, 0x58)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-socket$alg-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
socket$alg(0x26, 0x5, 0x0)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0)
r3 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-fcntl$dupfd-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
fcntl$dupfd(r1, 0x0, r1)
r2 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-syz_open_dev$usbfs-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-syz_emit_ethernet-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-listen-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-bind$inet6-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-setsockopt$sock_int-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
r1 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
program crashed: WARNING in vma_merge
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-userfaultfd-ioctl$UFFDIO_API-ioctl$sock_inet6_SIOCSIFDSTADDR-mprotect-ioctl$UFFDIO_REGISTER
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x80001)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c})
ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @empty}, 0x1})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})

program crashed: WARNING in vma_merge
validation run: crashed=true
reproducing took 55m18.390953111s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4514 at mm/mmap.c:1049 vma_merge+0x930/0xa80 mm/mmap.c:1049
Modules linked in:
CPU: 1 PID: 4514 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : vma_merge+0x930/0xa80 mm/mmap.c:1049
lr : vma_merge+0x930/0xa80 mm/mmap.c:1049
sp : ffff800021727740
x29: ffff800021727820 x28: ffff0000d404d4d8 x27: ffff8000217277a0
x26: ffff0000d7f8f288 x25: 0000000020000000 x24: dfff800000000000
x23: 0000000020000000 x22: 1fffe0001a809a9b x21: 000000002000f000
x20: ffff0000caa79288 x19: ffff0000d7f8f290 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800011ba0e90 x15: 0000000000000000
x14: ffff70000394b5d8 x13: 1ffff0000394b5d8 x12: 0000000000000004
x11: ff00800008806c78 x10: 0000000000000000 x9 : ffff800008806c78
x8 : ffff0000d34c0000 x7 : ffff800011a81854 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800011a64f18
x2 : 0000000000000001 x1 : 0000000020000000 x0 : 000000002000f000
Call trace:
 vma_merge+0x930/0xa80 mm/mmap.c:1049
 userfaultfd_register fs/userfaultfd.c:1462 [inline]
 userfaultfd_ioctl+0x3290/0x43ac fs/userfaultfd.c:2042
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 1740
hardirqs last  enabled at (1739): [<ffff8000088f6370>] kasan_quarantine_put+0xc4/0x200 mm/kasan/quarantine.c:242
hardirqs last disabled at (1740): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1714): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1712): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4514 at mm/mmap.c:1049 vma_merge+0x930/0xa80 mm/mmap.c:1049
Modules linked in:
CPU: 1 PID: 4514 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : vma_merge+0x930/0xa80 mm/mmap.c:1049
lr : vma_merge+0x930/0xa80 mm/mmap.c:1049
sp : ffff800021727740
x29: ffff800021727820 x28: ffff0000d404d4d8 x27: ffff8000217277a0
x26: ffff0000d7f8f288 x25: 0000000020000000 x24: dfff800000000000
x23: 0000000020000000 x22: 1fffe0001a809a9b x21: 000000002000f000
x20: ffff0000caa79288 x19: ffff0000d7f8f290 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800011ba0e90 x15: 0000000000000000
x14: ffff70000394b5d8 x13: 1ffff0000394b5d8 x12: 0000000000000004
x11: ff00800008806c78 x10: 0000000000000000 x9 : ffff800008806c78
x8 : ffff0000d34c0000 x7 : ffff800011a81854 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800011a64f18
x2 : 0000000000000001 x1 : 0000000020000000 x0 : 000000002000f000
Call trace:
 vma_merge+0x930/0xa80 mm/mmap.c:1049
 userfaultfd_register fs/userfaultfd.c:1462 [inline]
 userfaultfd_ioctl+0x3290/0x43ac fs/userfaultfd.c:2042
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 1740
hardirqs last  enabled at (1739): [<ffff8000088f6370>] kasan_quarantine_put+0xc4/0x200 mm/kasan/quarantine.c:242
hardirqs last disabled at (1740): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1714): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1712): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---