Extracting prog: 6m37.97936942s
Minimizing prog: 1h49m6.822091583s
Simplifying prog options: 16m32.352959982s
Extracting C: 7m32.985918612s
Simplifying C: 0s


12 programs, 3 VMs, timeouts [45s 5m0s 16m0s]
extracting reproducer from 12 programs
single: executing 2 programs separately with timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic-sendmsg$DEVLINK_CMD_RATE_SET-recvmsg-dup3-sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD-sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)
recvmsg(r13, &(0x7f0000000000)={&(0x7f0000000980)=@pppol2tpv3={0x18, 0x1, {0x0, <r14=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, 0x0}, 0x0)
dup3(r13, r14, 0x0)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) (async)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binder_debug-ioctl$BINDER_THREAD_EXIT-bind$alg-accept4-openat$procfs-close-socket$inet6_sctp-setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM-socket-socket$can_j1939-mlockall-mremap-socket$inet6_udp-socket$inet6_tcp-recvmmsg-ioctl$TIOCSWINSZ-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-mlockall-fspick-ioctl$ifreq_SIOCGIFINDEX_vcan-ioctl$AUTOFS_DEV_IOCTL_VERSION-socket$nl_generic-setsockopt$sock_void-openat$yama_ptrace_scope-ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD-bind$can_j1939-sendmsg$L2TP_CMD_SESSION_MODIFY
detailed listing:
executing program 0:
r0 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40049409, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = openat$procfs(0xffffff9c, &(0x7f00000001c0)='/proc/partitions\x00', 0x0, 0x0)
close(r1)
socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, 0x0, 0x0)
r2 = socket(0x0, 0x5, 0x72)
r3 = socket$can_j1939(0x1d, 0x2, 0x7)
mlockall(0x1)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
recvmmsg(r5, &(0x7f0000000640)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, <r6=>0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0}}], 0x0, 0x0, 0x0)
ioctl$TIOCSWINSZ(r6, 0x5452, &(0x7f0000000040))
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x8901, &(0x7f0000000200)={'syztnl2\x00', 0x0})
mlockall(0x2)
fspick(r0, &(0x7f0000000140)='./file0\x00', 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vcan0\x00'})
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$sock_void(r6, 0x1, 0x3f, 0x20000000, 0x2)
openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f0000000040)={0x0, 'wg2\x00', {0x5}, 0x3})
bind$can_j1939(r2, &(0x7f0000000000)={0x1d, 0x0, 0x1, {0x0, 0xff}}, 0x18)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[], 0x14}}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 12 programs with base timeout 45s
testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 20, 4, 8, 11, 27, 10, 20, 6, 3, 30, 33]
detailed listing:
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
accept4(r0, 0x0, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
getpeername(r1, &(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x0, <r2=>0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000040)=0xb1)
close(r2)
fsetxattr$trusted_overlay_opaque(r2, &(0x7f00000000c0), 0x0, 0x0, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$IPVS_CMD_GET_DEST(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x12c, r4, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x38, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8fe}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wlan1\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bridge\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg2\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xcf}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x12c}}, 0x4044451)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r3)
sendmsg$NL80211_CMD_DEL_MPATH(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, r5, 0x20, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x56}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x88}, 0x1, 0x0, 0x0, 0x81}, 0x48040)
executing program 0:
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x13, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x78}}, 0xc3)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180)) (async, rerun: 32)
ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f00000001c0)) (rerun: 32)
r1 = openat$smackfs_access(0xffffffffffffff9c, &(0x7f0000000200)='/sys/fs/smackfs/access2\x00', 0x2, 0x0)
write$smackfs_access(r1, &(0x7f0000000240)={'syz1\x00', 0x20, 'syz2\x00', 0x20, 'wt'}, 0xf) (async, rerun: 32)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 32)
ioctl$RNDGETENTCNT(r2, 0x5452, &(0x7f0000000200)) (async, rerun: 32)
r3 = getuid() (rerun: 32)
r4 = getgid()
mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2004800, &(0x7f0000000300)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x8}}]}}) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0)
r7 = syz_open_dev$sndpcmc(&(0x7f0000000a00), 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r7, 0x4112, 0x0) (async, rerun: 32)
sendmsg$NL80211_CMD_SET_MCAST_RATE(r5, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000640)=ANY=[@ANYBLOB="2c000000f3dcd2776c4dbfcb23cf0eeddeacc7fd5262e879a405d8d9e9109e5153c85700f0777713e9d0e43e43d90000ab6958a5a102e28b32dc2587b228c7fe69781f1eceaaa33adb47a90100634b68e01f65bf1cb76c0bf36761ed081e2e4b688140dc", @ANYRES16=r6, @ANYBLOB="00012bbd7000ffdbdf255c00000008006b007800000008006b005a00000008006b00b6ed486a"], 0x2c}, 0x1, 0x0, 0x0, 0x20000004}, 0x400c0) (async, rerun: 32)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$net_dm(&(0x7f0000000500), r8) (async)
ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000540))
ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000600)={'wpan1\x00'})
executing program 0:
r0 = openat$vsock(0xffffff9c, &(0x7f0000000000), 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40004)
executing program 0:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan1\x00'})
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x4c00, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x0, 0x0)
socket$inet6(0xa, 0x801, 0x0)
r1 = mq_open(&(0x7f0000000040)='{\xb7\x00', 0x40, 0x8, 0x0)
ioctl$FS_IOC_FIEMAP(r1, 0x5450, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/rt6_stats\x00')
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
accept4(r0, 0x0, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
getpeername(r1, &(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x0, <r2=>0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000040)=0xb1)
close(r2)
fsetxattr$trusted_overlay_opaque(r2, &(0x7f00000000c0), 0x0, 0x0, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$IPVS_CMD_GET_DEST(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x12c, r4, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x38, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8fe}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x90, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wlan1\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bridge\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg2\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xcf}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x12c}}, 0x4044451)
sendmsg$NL80211_CMD_DEL_MPATH(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x56}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x88}, 0x1, 0x0, 0x0, 0x81}, 0x48040)
executing program 0:
r0 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40049409, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = openat$procfs(0xffffff9c, &(0x7f00000001c0)='/proc/partitions\x00', 0x0, 0x0)
close(r1)
socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, 0x0, 0x0)
r2 = socket(0x0, 0x5, 0x72)
r3 = socket$can_j1939(0x1d, 0x2, 0x7)
mlockall(0x1)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
recvmmsg(r5, &(0x7f0000000640)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, <r6=>0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0}}], 0x0, 0x0, 0x0)
ioctl$TIOCSWINSZ(r6, 0x5452, &(0x7f0000000040))
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x8901, &(0x7f0000000200)={'syztnl2\x00', 0x0})
mlockall(0x2)
fspick(r0, &(0x7f0000000140)='./file0\x00', 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vcan0\x00'})
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'})
socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$sock_void(r6, 0x1, 0x3f, 0x20000000, 0x2)
openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f0000000040)={0x0, 'wg2\x00', {0x5}, 0x3})
bind$can_j1939(r2, &(0x7f0000000000)={0x1d, 0x0, 0x1, {0x0, 0xff}}, 0x18)
sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[], 0x14}}, 0x0)
executing program 1:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
accept4(r0, 0x0, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
getpeername(r1, &(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x0, <r2=>0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000040)=0xb1)
close(r2)
fsetxattr$trusted_overlay_opaque(r2, &(0x7f00000000c0), 0x0, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_DEL_MPATH(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x88, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x56}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x88}, 0x1, 0x0, 0x0, 0x81}, 0x48040)
executing program 1:
r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat2(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', &(0x7f0000000040), 0x18) (async)
r1 = openat2(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', &(0x7f0000000040), 0x18)
syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000200)='./mnt\x00', 0x800003, &(0x7f0000000000), 0x4, 0x259, &(0x7f0000000540)="$eJzs3D1oJGUYB/BnZnfzuUjURhBUEBENhNgJNrFRCEgQC0GFiIiNkggxwW7XysZCa5VUNkHsjJaSJtgoglXuLkWuObgLV1y44q6YY3cmR46b4xY22bnL/H4wmY+87zwzTP7vTIqZAGprJiIWIqIREbMR0YqI5GSDF/JppljdnNxdjsiy964n/Xb5eu6433REdCPi9YjYSZP4vBmxsf3hwc29t1/+br310i/bH0yO9CQLhwf77xz9vPTt74uvbfz7/9WlJBaifc95nb6kZFsziXjqLIo9IpJm1UfAIN79+rcLvdw/HREv9vPfijTyi/f92thOK179qbxn1vnh2n/PjvZogdOWZa3ePbCbAbWTRkS7eEjtL0eazs3lz/AXG1PpF6trX81+trq+8mnVIxVwSnr/f++/9ef4H9P9zCfpXJH/K408/8B51SnmW5d6P48a1R4NMFrtiP3ZjzuvhPxD7cg/1FeR/4mQf3h8jZVuTSLLisWsNN3u/1Bf8g/1Jf9QX/IP9SX/cO6kgzaUf6gv+Yf6Opl/AKBesvEBXxTuHncAzouKhx8AAAAAAAAAAAAAAAAAAKDE5uTu8vF0BrufKNv4948Rh29GRLOsfqP4mGHedepG0mt2V5J3G8pHzw+5gyH9WvHb109crrb+P89VW7+zEtH9JiLmm837//6SwT+m+QBPPuT3rU+GLDCkN96vtv7trWrrL+5F/NUbf+bLxp80nunPy8efdu/6DVn/y1tD7gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICRuRMAAP//Qqto2w==") (async)
syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000200)='./mnt\x00', 0x800003, &(0x7f0000000000), 0x4, 0x259, &(0x7f0000000540)="$eJzs3D1oJGUYB/BnZnfzuUjURhBUEBENhNgJNrFRCEgQC0GFiIiNkggxwW7XysZCa5VUNkHsjJaSJtgoglXuLkWuObgLV1y44q6YY3cmR46b4xY22bnL/H4wmY+87zwzTP7vTIqZAGprJiIWIqIREbMR0YqI5GSDF/JppljdnNxdjsiy964n/Xb5eu6433REdCPi9YjYSZP4vBmxsf3hwc29t1/+br310i/bH0yO9CQLhwf77xz9vPTt74uvbfz7/9WlJBaifc95nb6kZFsziXjqLIo9IpJm1UfAIN79+rcLvdw/HREv9vPfijTyi/f92thOK179qbxn1vnh2n/PjvZogdOWZa3ePbCbAbWTRkS7eEjtL0eazs3lz/AXG1PpF6trX81+trq+8mnVIxVwSnr/f++/9ef4H9P9zCfpXJH/K408/8B51SnmW5d6P48a1R4NMFrtiP3ZjzuvhPxD7cg/1FeR/4mQf3h8jZVuTSLLisWsNN3u/1Bf8g/1Jf9QX/IP9SX/cO6kgzaUf6gv+Yf6Opl/AKBesvEBXxTuHncAzouKhx8AAAAAAAAAAAAAAAAAAKDE5uTu8vF0BrufKNv4948Rh29GRLOsfqP4mGHedepG0mt2V5J3G8pHzw+5gyH9WvHb109crrb+P89VW7+zEtH9JiLmm837//6SwT+m+QBPPuT3rU+GLDCkN96vtv7trWrrL+5F/NUbf+bLxp80nunPy8efdu/6DVn/y1tD7gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICRuRMAAP//Qqto2w==")
chroot(&(0x7f0000000440)='.\x00')
bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000080)={0xffff}, 0x8) (async)
bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000080)={0xffff}, 0x8)
bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000000c0)={0x8}, 0x8) (async)
bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000000c0)={0x8}, 0x8)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001200), 0x20da00, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
dup3(r3, r4, 0x0)
sendmsg$nl_route(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="2d0000003e00000000f8ffffff0000000a000000"], 0x14}}, 0x0)
ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x1)
ioctl$TIOCL_SETVESABLANK(r0, 0x541c, 0x0) (async)
ioctl$TIOCL_SETVESABLANK(r0, 0x541c, 0x0)
executing program 1:
r0 = socket$nl_audit(0x10, 0x3, 0x9)
sendmsg$AUDIT_TRIM(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x10}, 0x10}}, 0x0)
recvmmsg(r0, &(0x7f00000021c0)=[{{&(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, 0x0}}], 0x1, 0x42, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000040))
executing program 1:
r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
dup3(r1, r0, 0x0)
executing program 1:
r0 = openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000040))
r1 = fcntl$getown(r0, 0x9)
fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x1, r1})
r2 = msgget$private(0x0, 0xa)
msgctl$MSG_STAT(r2, 0xb, &(0x7f00000000c0)=""/26)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000100)=0xef)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x200001, 0x0)
ioctl$KDGETMODE(r3, 0x4b3b, &(0x7f0000000180))
r4 = bpf$ITER_CREATE(0x21, &(0x7f00000001c0), 0x8)
openat$cgroup_pressure(r4, &(0x7f0000000200)='io.pressure\x00', 0x2, 0x0)
ioctl$RNDCLEARPOOL(r4, 0x5206, &(0x7f0000000240)=0x7f)
msgctl$MSG_STAT_ANY(r2, 0xd, &(0x7f0000000280)=""/119)
msgctl$MSG_STAT_ANY(r2, 0xd, &(0x7f0000000300)=""/240)
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x802, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={<r5=>0xffffffffffffffff})
r6 = gettid()
ioprio_set$pid(0x3, r6, 0x6000)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = accept4(r7, &(0x7f00000004c0)=@llc, &(0x7f0000000540)=0x80, 0xcb1fab46a4be3b5a)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r5, 0xc0096616, &(0x7f0000000580)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$BTRFS_IOC_QUOTA_RESCAN(r8, 0x4040942c, &(0x7f00000005c0)={0x0, 0x5, [0xe2, 0x2, 0x6, 0x0, 0x3, 0x40]})
syz_genetlink_get_family_id$devlink(&(0x7f0000000600), r8)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000680), r4)
r10 = ioctl$NS_GET_PARENT(r4, 0xb702, 0x0)
sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x80, r9, 0x1, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r6}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r10}}]}, 0x80}, 0x1, 0x0, 0x0, 0x81}, 0x10)
getpgid(r6)
getsockopt$inet6_tcp_int(r4, 0x6, 0x3, &(0x7f00000007c0), &(0x7f0000000800)=0x4)
sendmsg$AUDIT_MAKE_EQUIV(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2004000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x28, 0x3f7, 0x20, 0x70bd2c, 0x25dfdbfd, {0x7, 0x7, './file0', './file0'}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x44000)
executing program 1:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)
recvmsg(r13, &(0x7f0000000000)={&(0x7f0000000980)=@pppol2tpv3={0x18, 0x1, {0x0, <r14=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, 0x0}, 0x0)
dup3(r13, r14, 0x0)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) (async)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 2 programs separately with timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic-sendmsg$DEVLINK_CMD_RATE_SET-recvmsg-dup3-sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD-sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)
recvmsg(r13, &(0x7f0000000000)={&(0x7f0000000980)=@pppol2tpv3={0x18, 0x1, {0x0, <r14=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, 0x0}, 0x0)
dup3(r13, r14, 0x0)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) (async)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
single: successfully extracted reproducer
found reproducer with 33 syscalls
minimizing guilty program
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic-sendmsg$DEVLINK_CMD_RATE_SET-recvmsg-dup3-sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)
recvmsg(r13, &(0x7f0000000000)={&(0x7f0000000980)=@pppol2tpv3={0x18, 0x1, {0x0, <r14=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, 0x0}, 0x0)
dup3(r13, r14, 0x0)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) (async)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic-sendmsg$DEVLINK_CMD_RATE_SET-recvmsg-dup3
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)
recvmsg(r13, &(0x7f0000000000)={&(0x7f0000000980)=@pppol2tpv3={0x18, 0x1, {0x0, <r14=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, 0x0}, 0x0)
dup3(r13, r14, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic-sendmsg$DEVLINK_CMD_RATE_SET-recvmsg
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)
recvmsg(r13, &(0x7f0000000000)={&(0x7f0000000980)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, 0x0}, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic-sendmsg$DEVLINK_CMD_RATE_SET
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_RATE_SET(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB='%'], 0x14}}, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit-socket$nl_generic
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})
socket$nl_generic(0x10, 0x3, 0x10)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
r6 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r7 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r8 = dup(r7)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r9, r10, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0xa, 0x0, r11)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r12 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r12, 0x4018f50b, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x6, 0x0, r5, 0x0, r6, 0x2, 0x0, 0x1, {0x0, r11}}) (async)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r7 = dup(r6)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r8, r9, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r10)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r11 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r11, 0x4018f50b, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet-openat$vnet
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r7 = dup(r6)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r8, r9, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r10)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-openat$vnet
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r7 = dup(r6)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r8, r9, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r10)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r7 = dup(r6)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r8, r9, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r10)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET-io_uring_register$IORING_REGISTER_PERSONALITY
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
r7 = dup(r6)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r8, r9, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)
io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET-sendmsg$RDMA_NLDEV_CMD_PORT_GET
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
dup(r6)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r7, r8, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3-sendmsg$RDMA_NLDEV_CMD_PORT_GET
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
dup(r6)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r7, r8, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x10}, 0x10}}, 0x0) (async)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs-dup3
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
dup(r6)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)
dup3(r7, r8, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route-openat$sysfs
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
dup(r6)
socket$nl_route(0x10, 0x3, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system', 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup-socket$nl_route
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
dup(r6)
socket$nl_route(0x10, 0x3, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup-dup
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
r6 = syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))
dup(r6)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup-syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100))

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host-syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_io_uring_setup(0x1fea, &(0x7f0000001040), &(0x7f0000000000), &(0x7f0000001100)) (async)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET-openat$smackfs_ipv6host
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)
openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3-sendmsg$ETHTOOL_MSG_LINKMODES_GET
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = dup3(r4, r3, 0x0)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix-dup3
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
dup3(r4, r3, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit-socketpair$unix
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000))

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) (async)
syz_io_uring_submit(0x0, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(0x0, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
ftruncate(r1, 0x5)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
ftruncate(r1, 0x5) (async)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-memfd_secret-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
r1 = memfd_secret(0x0)
r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r2, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
syz_io_uring_setup(0x24f9, &(0x7f0000000200), &(0x7f0000000080), &(0x7f0000000140)=<r0=>0x0)
ftruncate(0xffffffffffffffff, 0x5) (async)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, 0xffffffffffffffff, 0x0)
syz_io_uring_submit(r1, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r1, r0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5) (async)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) (async)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, 0x0) (async)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program crashed: BUG: unable to handle kernel paging request in free_unref_page
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0})

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, 0x0) (async)
syz_io_uring_submit(r1, 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
extracting C reproducer
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
program did not crash
simplifying guilty program options
testing program (duration=7m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, 0x0) (async)
syz_io_uring_submit(r1, 0x0, 0x0)

program did not crash
testing program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
detailed listing:
executing program 0:
r0 = memfd_secret(0x0)
ftruncate(r0, 0x5)
r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0)
syz_io_uring_submit(r1, 0x0, 0x0) (async)
syz_io_uring_submit(r1, 0x0, 0x0)

program crashed: BUG: unable to handle kernel paging request in free_unref_page
extracting C reproducer
testing compiled C program (duration=7m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_secret-ftruncate-mmap$IORING_OFF_SQ_RING-syz_io_uring_submit-syz_io_uring_submit
program did not crash
reproducing took 2h19m50.958741605s
repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address fef0000006705000
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000042650000
[fef0000006705000] pgd=18000000bfdff003, p4d=18000000bfdfe003, pud=18000000bfdfd003, pmd=18000000bfdda003, pte=0068000046705406
Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3644 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00027-g4a4be1ad3a6e #0
Hardware name: linux,dummy-virt (DT)
pstate: 21400009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __stg_post arch/arm64/include/asm/mte-kasan.h:120 [inline]
pc : mte_set_mem_tag_range arch/arm64/include/asm/mte-kasan.h:196 [inline]
pc : kasan_poison.constprop.0+0x80/0x104 mm/kasan/kasan.h:478
lr : __kasan_poison_pages+0x50/0x80 mm/kasan/common.c:141
sp : ffff800089163b10
x29: ffff800089163b10 x28: 0000000000000000 x27: 0000000000100dc2
x26: 0000000000100cc2 x25: 0000000000000000 x24: faf0000006decbb8
x23: 00000000000000f9 x22: 0000000040000000 x21: 0000000000000000
x20: 0000000000000000 x19: ffffc1ffc019c140 x18: 0000000000000001
x17: 0000000000000000 x16: 1e9e000000c8e3c1 x15: 0000000000000001
x14: 0000000000000002 x13: 0000000000000000 x12: 00000000000702d1
x11: 0000000000000000 x10: ffff800081e3d1e8 x9 : 00000000000000f9
x8 : 0000000000000038 x7 : 0000000000000000 x6 : fef0000006706000
x5 : fef000000670503f x4 : 0000000000000040 x3 : fef0000006706000
x2 : 0000000000000000 x1 : 0000000000001000 x0 : fef0000006705000
Call trace:
 mte_set_mem_tag_range arch/arm64/include/asm/mte-kasan.h:196 [inline]
 kasan_poison.constprop.0+0x80/0x104 mm/kasan/kasan.h:478
 kasan_poison_pages include/linux/kasan.h:114 [inline]
 free_pages_prepare mm/page_alloc.c:1110 [inline]
 free_unref_page+0x10c/0x488 mm/page_alloc.c:2565
 __folio_put+0xb0/0x104 mm/swap.c:129
 folio_put include/linux/mm.h:1508 [inline]
 secretmem_fault+0x1e8/0x23c mm/secretmem.c:87
 __do_fault+0x3c/0x214 mm/memory.c:4562
 do_read_fault mm/memory.c:4926 [inline]
 do_fault+0x310/0x650 mm/memory.c:5056
 do_pte_missing mm/memory.c:3903 [inline]
 handle_pte_fault mm/memory.c:5380 [inline]
 __handle_mm_fault+0x4d0/0xc20 mm/memory.c:5523
 handle_mm_fault+0x68/0x27c mm/memory.c:5688
 do_page_fault+0x168/0x480 arch/arm64/mm/fault.c:613
 do_translation_fault+0xac/0xbc arch/arm64/mm/fault.c:690
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:826
 el0_da+0x6c/0xb8 arch/arm64/kernel/entry-common.c:580
 el0t_64_sync_handler+0xb8/0x12c arch/arm64/kernel/entry-common.c:733
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: b5000247 eb04043f 54000203 d503201f (d9201400) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	b5000247 	cbnz	x7, 0x48
   4:	eb04043f 	cmp	x1, x4, lsl #1
   8:	54000203 	b.cc	0x48  // b.lo, b.ul, b.last
   c:	d503201f 	nop
* 10:	d9201400 	stg	x0, [x0], #16 <-- trapping instruction

final repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address fef0000006705000
Mem abort info:
  ESR = 0x0000000096000047
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x07: level 3 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000042650000
[fef0000006705000] pgd=18000000bfdff003, p4d=18000000bfdfe003, pud=18000000bfdfd003, pmd=18000000bfdda003, pte=0068000046705406
Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3644 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00027-g4a4be1ad3a6e #0
Hardware name: linux,dummy-virt (DT)
pstate: 21400009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __stg_post arch/arm64/include/asm/mte-kasan.h:120 [inline]
pc : mte_set_mem_tag_range arch/arm64/include/asm/mte-kasan.h:196 [inline]
pc : kasan_poison.constprop.0+0x80/0x104 mm/kasan/kasan.h:478
lr : __kasan_poison_pages+0x50/0x80 mm/kasan/common.c:141
sp : ffff800089163b10
x29: ffff800089163b10 x28: 0000000000000000 x27: 0000000000100dc2
x26: 0000000000100cc2 x25: 0000000000000000 x24: faf0000006decbb8
x23: 00000000000000f9 x22: 0000000040000000 x21: 0000000000000000
x20: 0000000000000000 x19: ffffc1ffc019c140 x18: 0000000000000001
x17: 0000000000000000 x16: 1e9e000000c8e3c1 x15: 0000000000000001
x14: 0000000000000002 x13: 0000000000000000 x12: 00000000000702d1
x11: 0000000000000000 x10: ffff800081e3d1e8 x9 : 00000000000000f9
x8 : 0000000000000038 x7 : 0000000000000000 x6 : fef0000006706000
x5 : fef000000670503f x4 : 0000000000000040 x3 : fef0000006706000
x2 : 0000000000000000 x1 : 0000000000001000 x0 : fef0000006705000
Call trace:
 mte_set_mem_tag_range arch/arm64/include/asm/mte-kasan.h:196 [inline]
 kasan_poison.constprop.0+0x80/0x104 mm/kasan/kasan.h:478
 kasan_poison_pages include/linux/kasan.h:114 [inline]
 free_pages_prepare mm/page_alloc.c:1110 [inline]
 free_unref_page+0x10c/0x488 mm/page_alloc.c:2565
 __folio_put+0xb0/0x104 mm/swap.c:129
 folio_put include/linux/mm.h:1508 [inline]
 secretmem_fault+0x1e8/0x23c mm/secretmem.c:87
 __do_fault+0x3c/0x214 mm/memory.c:4562
 do_read_fault mm/memory.c:4926 [inline]
 do_fault+0x310/0x650 mm/memory.c:5056
 do_pte_missing mm/memory.c:3903 [inline]
 handle_pte_fault mm/memory.c:5380 [inline]
 __handle_mm_fault+0x4d0/0xc20 mm/memory.c:5523
 handle_mm_fault+0x68/0x27c mm/memory.c:5688
 do_page_fault+0x168/0x480 arch/arm64/mm/fault.c:613
 do_translation_fault+0xac/0xbc arch/arm64/mm/fault.c:690
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:826
 el0_da+0x6c/0xb8 arch/arm64/kernel/entry-common.c:580
 el0t_64_sync_handler+0xb8/0x12c arch/arm64/kernel/entry-common.c:733
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: b5000247 eb04043f 54000203 d503201f (d9201400) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	b5000247 	cbnz	x7, 0x48
   4:	eb04043f 	cmp	x1, x4, lsl #1
   8:	54000203 	b.cc	0x48  // b.lo, b.ul, b.last
   c:	d503201f 	nop
* 10:	d9201400 	stg	x0, [x0], #16 <-- trapping instruction