Extracting prog: 1m34.812318222s Minimizing prog: 28m15.90477489s Simplifying prog options: 0s Extracting C: 1m19.904334601s Simplifying C: 4m57.285529372s extracting reproducer from 10 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP-getsockopt$sock_cred-mmap$xdp-mount$bpf-ioctl$SECCOMP_IOCTL_NOTIF_RECV-shmctl$IPC_SET-syz_emit_ethernet detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, &(0x7f0000000340), 0x0}, 0x20) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r4, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000100)=0x0) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r10 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r11, r11) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) mmap$xdp(&(0x7f0000809000/0x1000)=nil, 0x1000, 0x5, 0x100010, r5, 0x80000000) mount$bpf(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x2000, &(0x7f00000004c0)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=r9, @ANYBLOB="2c7569641c", @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r13, @ANYBLOB=',gid=', @ANYRESHEX, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',mode=00000000000000000000011,obj_role=*&,\x00']) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) shmctl$IPC_SET(r4, 0x1, &(0x7f00000002c0)={{0x2, r6, r7, r11, r8, 0x1, 0x1}, 0x4ee9, 0x100000000, 0x0, 0x8, r12, r14, 0x7}) syz_emit_ethernet(0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd600a843500262f00e21c020000000000000000000000000001fefb51318000000000000000000000000000aa3c0022eb2871c631febb2214417377616d", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000d43f602566b7c9fb00"/26], 0x0) program crashed: WARNING in vma_add_pgoff single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP-getsockopt$sock_cred-mmap$xdp-mount$bpf-ioctl$SECCOMP_IOCTL_NOTIF_RECV-shmctl$IPC_SET detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, &(0x7f0000000340), 0x0}, 0x20) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r4, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000100)=0x0) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r10 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r11, r11) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) mmap$xdp(&(0x7f0000809000/0x1000)=nil, 0x1000, 0x5, 0x100010, r5, 0x80000000) mount$bpf(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x2000, &(0x7f00000004c0)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=r9, @ANYBLOB="2c7569641c", @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r13, @ANYBLOB=',gid=', @ANYRESHEX, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',mode=00000000000000000000011,obj_role=*&,\x00']) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)={0x0, 0x0}) shmctl$IPC_SET(r4, 0x1, &(0x7f00000002c0)={{0x2, r6, r7, r11, r8, 0x1, 0x1}, 0x4ee9, 0x100000000, 0x0, 0x8, r12, r14, 0x7}) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP-getsockopt$sock_cred-mmap$xdp-mount$bpf-ioctl$SECCOMP_IOCTL_NOTIF_RECV detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, &(0x7f0000000340), 0x0}, 0x20) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r4, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000100)=0x0) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r8 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r9, r9) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) mmap$xdp(&(0x7f0000809000/0x1000)=nil, 0x1000, 0x5, 0x100010, r5, 0x80000000) mount$bpf(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x2000, &(0x7f00000004c0)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=r7, @ANYBLOB="2c7569641c", @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r10, @ANYBLOB=',gid=', @ANYRESHEX, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',mode=00000000000000000000011,obj_role=*&,\x00']) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000240)) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP-getsockopt$sock_cred-mmap$xdp-mount$bpf detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, &(0x7f0000000340), 0x0}, 0x20) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r4, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000100)=0x0) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r8 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r9, r9) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) mmap$xdp(&(0x7f0000809000/0x1000)=nil, 0x1000, 0x5, 0x100010, r5, 0x80000000) mount$bpf(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x2000, &(0x7f00000004c0)=ANY=[@ANYBLOB='gid=', @ANYRESHEX=r7, @ANYBLOB="2c7569641c", @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r10, @ANYBLOB=',gid=', @ANYRESHEX, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',uid=', @ANYRESHEX=r6, @ANYBLOB=',mode=00000000000000000000011,obj_role=*&,\x00']) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP-getsockopt$sock_cred-mmap$xdp detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, &(0x7f0000000340), 0x0}, 0x20) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r4, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r6 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r7, r7) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440), &(0x7f0000000480)=0xc) mmap$xdp(&(0x7f0000809000/0x1000)=nil, 0x1000, 0x5, 0x100010, r5, 0x80000000) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP-getsockopt$sock_cred detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, &(0x7f0000000340), 0x0}, 0x20) r4 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r4, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r5, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r6 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r7, r7) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440), &(0x7f0000000480)=0xc) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid-ioctl$sock_SIOCGPGRP detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r1, &(0x7f0000000340), 0x0}, 0x20) r3 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r3, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r4, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r5 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r6, r6) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid-getgid detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r4 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r5, r5) getgid() program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred-setreuid detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r4 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0}, &(0x7f0000001e40)=0xc) setreuid(r5, r5) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic-getsockopt$sock_cred detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) r4 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001e00), &(0x7f0000001e40)=0xc) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups-socket$nl_generic detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) socket$nl_generic(0x10, 0x3, 0x10) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID-getgroups detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000100)) getgroups(0xa, &(0x7f0000000180)=[0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff]) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns-ioctl$NS_GET_OWNER_UID detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000340)) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000000100)) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER-syz_open_procfs$userns detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) syz_open_procfs$userns(0x0, &(0x7f0000000340)) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat-ioctl$UFFDIO_UNREGISTER detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private-shmat detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) r2 = shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) shmat(r2, &(0x7f000005a000/0x2000)=nil, 0xa000) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY-shmget$private detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) shmget$private(0x0, 0x3000, 0x2, &(0x7f000006c000/0x3000)=nil) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind-bpf$MAP_GET_NEXT_KEY detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000340), 0x0}, 0x20) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-madvise detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000003000/0x1000)=nil, 0x7f7884acbfff, 0x14) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-madvise-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mmap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8010, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-getsockopt$bt_BT_RCVMTU-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, &(0x7f0000000140)) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-syz_init_net_socket$bt_sco-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-bpf$MAP_CREATE-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mbind(&(0x7f00000a2000/0x4000)=nil, 0x4000, 0x4003, &(0x7f0000000380)=0x200000000000000c, 0x5, 0x3) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-madvise-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap-mremap-mbind detailed listing: executing program 0: mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind program crashed: WARNING in vma_add_pgoff testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mremap-mremap-mbind detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x7, 0x2) program crashed: WARNING in vma_add_pgoff validation run: crashed=true reproducing took 39m19.287973336s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: mm/vma.h:277 at assert_sane_pgoff mm/vma.h:277 [inline], CPU#1: syz.0.17/4916 WARNING: mm/vma.h:277 at vma_set_pgoff mm/vma.h:283 [inline], CPU#1: syz.0.17/4916 WARNING: mm/vma.h:277 at vma_add_pgoff+0x50c/0x700 mm/vma.h:314, CPU#1: syz.0.17/4916 Modules linked in: CPU: 1 UID: 0 PID: 4916 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : assert_sane_pgoff mm/vma.h:277 [inline] pc : vma_set_pgoff mm/vma.h:283 [inline] pc : vma_add_pgoff+0x50c/0x700 mm/vma.h:314 lr : assert_sane_pgoff mm/vma.h:277 [inline] lr : vma_set_pgoff mm/vma.h:283 [inline] lr : vma_add_pgoff+0x50c/0x700 mm/vma.h:314 sp : ffff800093c376e0 x29: ffff800093c37700 x28: 1fffe0001b9bccaa x27: 0000000000000001 x26: ffff0000cabc3700 x25: dfff800000000000 x24: 1fffe0001b9bccb0 x23: ffff0000dcde6580 x22: 0000000000020a97 x21: ffff0000dcde6548 x20: ffff0000dcde6500 x19: 0000000020001000 x18: 1fffe00035ba3828 x17: ffff800080adeaf4 x16: ffff800080addecc x15: ffff800080b8bf18 x14: ffff800080b96bac x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff800080bee7b0 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800080ae89e0 x2 : 0000000000020001 x1 : ffff0000cec71d80 x0 : 0000000000000000 Call trace: assert_sane_pgoff mm/vma.h:277 [inline] (P) vma_set_pgoff mm/vma.h:283 [inline] (P) vma_add_pgoff+0x50c/0x700 mm/vma.h:314 (P) __split_vma+0x6a8/0x83c mm/vma.c:607 split_vma mm/vma.c:643 [inline] vma_modify+0x11ac/0x18f0 mm/vma.c:1771 vma_modify_policy+0x210/0x2b8 mm/vma.c:1834 mbind_range+0x160/0x3e4 mm/mempolicy.c:1061 do_mbind mm/mempolicy.c:1563 [inline] kernel_mbind mm/mempolicy.c:1760 [inline] __do_sys_mbind mm/mempolicy.c:1834 [inline] __se_sys_mbind mm/mempolicy.c:1830 [inline] __arm64_sys_mbind+0x5c8/0x994 mm/mempolicy.c:1830 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 irq event stamp: 1834 hardirqs last enabled at (1833): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (1833): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (1834): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445 softirqs last enabled at (1778): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (1778): [] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline] softirqs last enabled at (1778): [] do_sve_acc+0x32c/0x4b8 arch/arm64/kernel/fpsimd.c:1349 softirqs last disabled at (1776): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (1776): [] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline] softirqs last disabled at (1776): [] do_sve_acc+0x10c/0x4b8 arch/arm64/kernel/fpsimd.c:1325 ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: mm/vma.h:277 at assert_sane_pgoff mm/vma.h:277 [inline], CPU#1: syz.0.17/4916 WARNING: mm/vma.h:277 at vma_set_pgoff mm/vma.h:283 [inline], CPU#1: syz.0.17/4916 WARNING: mm/vma.h:277 at vma_add_pgoff+0x50c/0x700 mm/vma.h:314, CPU#1: syz.0.17/4916 Modules linked in: CPU: 1 UID: 0 PID: 4916 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : assert_sane_pgoff mm/vma.h:277 [inline] pc : vma_set_pgoff mm/vma.h:283 [inline] pc : vma_add_pgoff+0x50c/0x700 mm/vma.h:314 lr : assert_sane_pgoff mm/vma.h:277 [inline] lr : vma_set_pgoff mm/vma.h:283 [inline] lr : vma_add_pgoff+0x50c/0x700 mm/vma.h:314 sp : ffff800093c376e0 x29: ffff800093c37700 x28: 1fffe0001b9bccaa x27: 0000000000000001 x26: ffff0000cabc3700 x25: dfff800000000000 x24: 1fffe0001b9bccb0 x23: ffff0000dcde6580 x22: 0000000000020a97 x21: ffff0000dcde6548 x20: ffff0000dcde6500 x19: 0000000020001000 x18: 1fffe00035ba3828 x17: ffff800080adeaf4 x16: ffff800080addecc x15: ffff800080b8bf18 x14: ffff800080b96bac x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff800080bee7b0 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800080ae89e0 x2 : 0000000000020001 x1 : ffff0000cec71d80 x0 : 0000000000000000 Call trace: assert_sane_pgoff mm/vma.h:277 [inline] (P) vma_set_pgoff mm/vma.h:283 [inline] (P) vma_add_pgoff+0x50c/0x700 mm/vma.h:314 (P) __split_vma+0x6a8/0x83c mm/vma.c:607 split_vma mm/vma.c:643 [inline] vma_modify+0x11ac/0x18f0 mm/vma.c:1771 vma_modify_policy+0x210/0x2b8 mm/vma.c:1834 mbind_range+0x160/0x3e4 mm/mempolicy.c:1061 do_mbind mm/mempolicy.c:1563 [inline] kernel_mbind mm/mempolicy.c:1760 [inline] __do_sys_mbind mm/mempolicy.c:1834 [inline] __se_sys_mbind mm/mempolicy.c:1830 [inline] __arm64_sys_mbind+0x5c8/0x994 mm/mempolicy.c:1830 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 irq event stamp: 1834 hardirqs last enabled at (1833): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (1833): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (1834): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445 softirqs last enabled at (1778): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (1778): [] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline] softirqs last enabled at (1778): [] do_sve_acc+0x32c/0x4b8 arch/arm64/kernel/fpsimd.c:1349 softirqs last disabled at (1776): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (1776): [] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline] softirqs last disabled at (1776): [] do_sve_acc+0x10c/0x4b8 arch/arm64/kernel/fpsimd.c:1325 ---[ end trace 0000000000000000 ]---