Extracting prog: 30.457266821s
Minimizing prog: 5m16.080363334s
Simplifying prog options: 0s
Extracting C: 13.940724433s
Simplifying C: 1m52.076798902s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-socket$packet-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
socket$packet(0x11, 0x3, 0x300)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-socket$packet-write$binfmt_elf64-execveat$binfmt
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
socket$packet(0x11, 0x3, 0x300)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-socket$packet-write$binfmt_elf64-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
socket$packet(0x11, 0x3, 0x300)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-socket$packet-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
socket$packet(0x11, 0x3, 0x300)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write$binfmt_elf64(r0, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(0x0)
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, 0x0, 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_create_resource$binfmt-openat$binfmt-write$binfmt_elf64-execveat$binfmt-creat
detailed listing:
executing program 0:
r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
write$binfmt_elf64(r1, &(0x7f00000028c0)=ANY=[@ANYBLOB="7f454c4602010103000000000000000002003e00010000000001000000000000400000000000000000020000000000000000000040003800030040000200010001000000000000000000000000000000000001000000000050010000000000001000000000000000001000000000000000000000000000000100000000000000000000000000000000000200000000000002003e5fdb47ff127bc890827b58c241"], 0x13e8)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) (rerun: 64)
creat(&(0x7f0000000040)='./file0\x00', 0x0)

program crashed: DATA RACE in mm.(*MemoryManager).DecUsers
validation run: crashed=true
reproducing took 8m40.781285981s
repro crashed as (corrupted=false):
WARNING: DATA RACE
Write at 0x00c000ddfec0 by goroutine 511:
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).DecUsers()
      pkg/sentry/mm/lifecycle.go:286 +0x204
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Kernel).LoadTaskImage.deferwrap1()
      pkg/sentry/kernel/task_image.go:146 +0x4f
  runtime.deferreturn()
      GOROOT/src/runtime/panic.go:589 +0x5d
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runExecveAfterExecveCredsLock).execute()
      pkg/sentry/kernel/task_exec.go:191 +0x804
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:89 +0x4a9
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:416 +0x44

Previous read at 0x00c000ddfec0 by goroutine 547:
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).unmapASLocked()
      pkg/sentry/mm/address_space.go:129 +0x64
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).invalidateLocked()
      pkg/sentry/mm/pma.go:715 +0x355
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).Invalidate()
      pkg/sentry/mm/pma.go:667 +0x22b
  gvisor.dev/gvisor/pkg/sentry/memmap.MappingOfRange.invalidate()
      pkg/sentry/memmap/mapping_set.go:47 +0x28c
  gvisor.dev/gvisor/pkg/sentry/memmap.(*MappingSet).Invalidate()
      pkg/sentry/memmap/mapping_set.go:241 +0x232
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*regularFile).truncateLocked()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:227 +0x244
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*regularFile).truncate()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:181 +0xaf
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).open()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:471 +0x97c
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).OpenAt()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:446 +0xcce
  gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).OpenAt()
      pkg/sentry/vfs/vfs.go:470 +0x732
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.openat()
      pkg/sentry/syscalls/linux/sys_file.go:110 +0x344
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Creat()
      pkg/sentry/syscalls/linux/sys_file.go:96 +0x45
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x94b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x71
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0x93
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x48f
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:258 +0x1eb0
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:89 +0x4a9
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:416 +0x44

final repro crashed as (corrupted=false):
WARNING: DATA RACE
Write at 0x00c000ddfec0 by goroutine 511:
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).DecUsers()
      pkg/sentry/mm/lifecycle.go:286 +0x204
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Kernel).LoadTaskImage.deferwrap1()
      pkg/sentry/kernel/task_image.go:146 +0x4f
  runtime.deferreturn()
      GOROOT/src/runtime/panic.go:589 +0x5d
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runExecveAfterExecveCredsLock).execute()
      pkg/sentry/kernel/task_exec.go:191 +0x804
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:89 +0x4a9
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:416 +0x44

Previous read at 0x00c000ddfec0 by goroutine 547:
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).unmapASLocked()
      pkg/sentry/mm/address_space.go:129 +0x64
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).invalidateLocked()
      pkg/sentry/mm/pma.go:715 +0x355
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).Invalidate()
      pkg/sentry/mm/pma.go:667 +0x22b
  gvisor.dev/gvisor/pkg/sentry/memmap.MappingOfRange.invalidate()
      pkg/sentry/memmap/mapping_set.go:47 +0x28c
  gvisor.dev/gvisor/pkg/sentry/memmap.(*MappingSet).Invalidate()
      pkg/sentry/memmap/mapping_set.go:241 +0x232
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*regularFile).truncateLocked()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:227 +0x244
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*regularFile).truncate()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:181 +0xaf
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).open()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:471 +0x97c
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).OpenAt()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:446 +0xcce
  gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).OpenAt()
      pkg/sentry/vfs/vfs.go:470 +0x732
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.openat()
      pkg/sentry/syscalls/linux/sys_file.go:110 +0x344
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Creat()
      pkg/sentry/syscalls/linux/sys_file.go:96 +0x45
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x94b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x71
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0x93
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x48f
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:258 +0x1eb0
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:89 +0x4a9
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:416 +0x44