Extracting prog: 1h1m4.850090014s Minimizing prog: 2h22m34.35365665s Simplifying prog options: 0s Extracting C: 3m51.795938625s Simplifying C: 1h2m44.017988978s extracting reproducer from 68 programs testing a last program of every proc single: executing 18 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$MPTCP_PM_CMD_GET_LIMITS-openat$kvm-ioctl$KVM_CREATE_VM-openat$cgroup_ro-syz_emit_ethernet-write$binfmt_script-mmap-preadv-sendmsg$NL80211_CMD_SET_TID_CONFIG-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_cpu$x86-ioctl$KVM_CREATE_VCPU-sendmsg$nl_route_sched-pipe-syz_kvm_setup_cpu$x86-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$KVM_RUN detailed listing: executing program 0: sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x8441}, 0x4000000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) pipe(&(0x7f00000002c0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_open_dev$char_usb-pread64 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff30"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pread64(r1, 0x0, 0x0, 0x100005ffffbff) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-mount-socket$inet6_udp-setsockopt$IP6T_SO_SET_REPLACE-syz_open_procfs$namespace-syz_genetlink_get_family_id$ipvs-socket$inet_udp detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x6) mount(0x0, &(0x7f0000000100)='./myproc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) syz_open_procfs$namespace(0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-bpf$MAP_CREATE_CONST_STR-socketpair$tipc-setsockopt$TIPC_SRC_DROPPABLE-bpf$MAP_CREATE_RINGBUF-socket$inet-bind$inet-setsockopt$inet_tcp_TCP_CONGESTION-sendto$inet-socket$nl_route-sendmsg$nl_route-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-mkdirat-openat$fuse-mount$fuse detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f00000002c0)=0x7562, 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040000}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-openat$tun-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newqdisc={0x178, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x148, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}, @TCA_GRED_MAX_P={0x8, 0x4, 0x4b}]}}]}, 0x178}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-getpid-ioprio_get$pid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_PREPARE_BUF-bpf$MAP_CREATE-sendmsg$key-setsockopt$bt_BT_DEFER_SETUP-fsopen-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() r1 = getpid() ioprio_get$pid(0x0, r1) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000002c80), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000180)={0x8, 0x1, 0x2}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r4, 0xc058565d, &(0x7f0000002dc0)=@userptr={0x2, 0x1, 0x4, 0x0, 0x1, {0x77359400}, {0x1, 0xc, 0x9, 0x4, 0x3, 0x12, "c12400"}, 0x3, 0x2, {0x0}, 0x96000}) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$key(0xffffffffffffffff, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001040)={0x2, 0x13, 0x8, 0x0, 0x2, 0x0, 0x70bd2a, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x34000}, 0x10) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-getpid-ioprio_get$pid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_PREPARE_BUF-bpf$MAP_CREATE-sendmsg$key-setsockopt$bt_BT_DEFER_SETUP-fsopen-sendmsg$IPSET_CMD_CREATE detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() r1 = getpid() ioprio_get$pid(0x0, r1) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000002c80), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000180)={0x8, 0x1, 0x2}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r4, 0xc058565d, &(0x7f0000002dc0)=@userptr={0x2, 0x1, 0x4, 0x0, 0x1, {0x77359400}, {0x1, 0xc, 0x9, 0x4, 0x3, 0x12, "c12400"}, 0x3, 0x2, {0x0}, 0x96000}) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$key(0xffffffffffffffff, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001040)={0x2, 0x13, 0x8, 0x0, 0x2, 0x0, 0x70bd2a, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x34000}, 0x10) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-syz_open_dev$sg-mount$9p_fd-listen-listen-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r1 = epoll_create1(0x80000) epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r5, 0x0) close(r4) connect$unix(r3, &(0x7f0000000140)=@abs, 0x6e) r6 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r7}, 0x4) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r8, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r9 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r9, 0xab00, r10) r11 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8401) mount$9p_fd(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r11}}) listen(0xffffffffffffffff, 0x805) listen(r6, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: INFO: task hung in __xfs_buf_submit single: successfully extracted reproducer found reproducer with 27 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-syz_open_dev$sg-mount$9p_fd-listen-listen detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r8 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r8, 0xab00, r9) r10 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8401) mount$9p_fd(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r10}}) listen(0xffffffffffffffff, 0x805) listen(r5, 0x0) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-syz_open_dev$sg-mount$9p_fd-listen detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r8 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r8, 0xab00, r9) r10 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8401) mount$9p_fd(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r10}}) listen(0xffffffffffffffff, 0x805) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-syz_open_dev$sg-mount$9p_fd detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r8 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r8, 0xab00, r9) r10 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8401) mount$9p_fd(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r10}}) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-syz_open_dev$sg detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r8 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r8, 0xab00, r9) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8401) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r8 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r8, 0xab00, r9) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-socketpair$nbd detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_open_dev$ndb-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) r8 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) ioctl$NBD_SET_SOCK(r8, 0xab00, 0xffffffffffffffff) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r7, 0x0, 0xe, 0x0, &(0x7f0000000800)="40b8ab3aab4700cfd1794ba75a24", 0x0, 0x1, 0x0, 0x0, 0x38, 0x0, &(0x7f00000006c0)="35011cf3a496686e444ad661d04ea6ca452602370c068db75306412f107913906d1ee5b6aadf4905d2f69bf1f61156bd46ea62ec903f0751"}, 0x50) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r7, 0xab00, r8) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r6}, 0x4) r7 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r7, 0xab00, r8) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-bpf$MAP_CREATE_CONST_STR-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r6 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r6, 0xab00, r7) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-bpf$MAP_CREATE-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r6, 0xab00, r7) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-setsockopt$sock_int-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) r6 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r6, 0xab00, r7) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-socket$inet6-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) socket$inet6(0xa, 0x5, 0x0) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r5, 0xab00, r6) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-connect$unix-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r4, 0x0) close(r3) connect$unix(r2, &(0x7f0000000140)=@abs, 0x6e) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r5, 0xab00, r6) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-close-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r3, 0x0) close(r2) r4 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r4, 0xab00, r5) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-quotactl$Q_QUOTAOFF-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) quotactl$Q_QUOTAOFF(0xffffffff80000302, &(0x7f00000001c0)=@filename='./cgroup\x00', r3, 0x0) r4 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r4, 0xab00, r5) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-getsockopt$inet6_IPV6_IPSEC_POLICY-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6, @in=@broadcast}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000440)=0xe8) r3 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r3, 0xab00, r4) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-sendmmsg$unix-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000004f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r3, 0xab00, r4) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-socketpair$unix-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r2, 0xab00, r3) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r2, 0xab00, r3) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-ioctl$VIDIOC_REQBUFS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000200)={0x203, 0xa, 0x2}) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r2, 0xab00, r3) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-openat$vicodec0-mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-epoll_wait-mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) r0 = epoll_create1(0x80000) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-epoll_create1-mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) epoll_create1(0x80000) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904"], 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, 0x0, &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(0x0, 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK program crashed: INFO: task hung in __xfs_buf_submit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program crashed: INFO: task hung in __xfs_buf_submit validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program crashed: INFO: task hung in __xfs_buf_submit validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x281841d, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) program crashed: INFO: task hung in __xfs_buf_submit validation run: crashed=true reproducing took 4h41m37.101276782s repro crashed as (corrupted=false): INFO: task syz.2.19:4360 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:27184 pid: 4360 ppid: 4309 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f6d8d07e159 RSP: 002b:00007f6d8c6de028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f6d8d305fa0 RCX: 00007f6d8d07e159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007f6d8d115024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6d8d306038 R14: 00007f6d8d305fa0 R15: 00007ffeec1c30d8 INFO: task syz.1.22:4376 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.22 state:D stack:27600 pid: 4376 ppid: 4308 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fab36f85159 RSP: 002b:00007fab365e5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fab3720cfa0 RCX: 00007fab36f85159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007fab3701c024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007fab3720d038 R14: 00007fab3720cfa0 R15: 00007ffdc1bf8278 INFO: task syz.0.17:4403 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27408 pid: 4403 ppid: 4310 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f48c56e3159 RSP: 002b:00007f48c4d43028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f48c596afa0 RCX: 00007f48c56e3159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007f48c577a024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f48c596b038 R14: 00007f48c596afa0 R15: 00007ffdf4124f88 INFO: task syz.3.24:4429 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.24 state:D stack:27600 pid: 4429 ppid: 4312 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f47dc921159 RSP: 002b:00007f47dbf81028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f47dcba8fa0 RCX: 00007f47dc921159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007f47dc9b8024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f47dcba9038 R14: 00007f47dcba8fa0 R15: 00007ffeebe4f028 INFO: task syz.4.21:4430 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.21 state:D stack:27600 pid: 4430 ppid: 4317 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa6a963e159 RSP: 002b:00007fa6a8c9e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fa6a98c5fa0 RCX: 00007fa6a963e159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007fa6a96d5024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa6a98c6038 R14: 00007fa6a98c5fa0 R15: 00007ffdbb2dfba8 Showing all locks held in the system: 3 locks held by kworker/0:0/7: #0: ffff88802b25e138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000cc7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4120 2 locks held by kworker/1:0/21: #0: ffff888016c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000db7d00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 1 lock held by khungtaskd/27: #0: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:1/144: 2 locks held by getty/3947: #0: ffff88802cb9a098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002d032e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 3 locks held by kworker/1:3/4223: #0: ffff88802b25e138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000305fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4120 3 locks held by kworker/0:15/4293: #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000314fd00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffff88805b307240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3380 drivers/net/netdevsim/fib.c:1480 3 locks held by kworker/u5:6/4320: 1 lock held by syz.2.19/4360: #0: ffff88801b9f40e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.1.22/4376: #0: ffff88807ab780e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.0.17/4403: #0: ffff88802335e0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.3.24/4429: #0: ffff88807c1ba0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.4.21/4430: #0: ffff88802820c0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.5.33/4538: #0: ffff888077d660e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.6.26/4549: #0: ffff888075f760e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.7.37/4601: #0: ffff88805cccc0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.9.38/4636: #0: ffff88801f6cc0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.8.43/4685: #0: ffff88801fdba0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 2 locks held by syz.2.44/4717: #0: ffff8880170af010 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88801b9f40e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.2.44/4718: #0: ffff888020f3a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.1.45/4729: #0: ffff888017009210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88807ab780e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.1.45/4733: #0: ffff888020eea208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.0.46/4744: #0: ffff8880170ae450 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88802335e0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.0.46/4748: #0: ffff888020d7d208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.3.47/4762: #0: ffff8880170b0650 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88807c1ba0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.3.47/4763: #0: ffff888020f48a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.4.48/4775: #0: ffff888017009dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88802820c0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.4.48/4776: #0: ffff888020f10a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.5.49/4799: #0: ffff8880170b1210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff888077d660e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.5.49/4802: #0: ffff888020f4f208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.6.50/4824: #0: ffff88801700a990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff888075f760e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.6.50/4828: #0: ffff888020f17208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.7.51/4845: #0: ffff8880170b1dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88805cccc0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.7.51/4849: #0: ffff888021065a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.9.52/4869: #0: ffff8880170b2990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88801f6cc0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.9.52/4870: #0: ffff88802107a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.8.53/4882: #0: ffff88801700b550 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88801fdba0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.8.53/4883: #0: ffff8880210b5a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.2.54/4901: #0: ffff8880170af010 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.2.54/4902: #0: ffff888020f3a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.1.55/4919: #0: ffff888017009210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.1.55/4922: #0: ffff888020eea208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.0.56/4930: #0: ffff8880170ae450 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.0.56/4933: #0: ffff888020d7d208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.3.57/4951: #0: ffff8880170b0650 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.3.57/4953: #0: ffff888020f48a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.4.58/4967: #0: ffff888017009dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.4.58/4968: #0: ffff888020f10a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.5.59/4997: #0: ffff8880170b1210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.5.59/5000: #0: ffff888020f4f208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.6.60/5020: #0: ffff88801700a990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.6.60/5022: #0: ffff888020f17208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.7.61/5039: #0: ffff8880170b1dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.7.61/5042: #0: ffff888021065a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.9.62/5063: #0: ffff8880170b2990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.9.62/5064: #0: ffff88802107a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.8.63/5077: #0: ffff88801700b550 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.8.63/5080: #0: ffff8880210b5a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.2.64/5094: #0: ffff8880170af010 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.2.64/5095: #0: ffff888020f3a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.1.65/5111: #0: ffff888017009210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.1.65/5112: #0: ffff888020eea208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.0.66/5126: #0: ffff8880170ae450 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.0.66/5130: #0: ffff888020d7d208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.3.67/5140: #0: ffff8880170b0650 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.3.67/5142: #0: ffff888020f48a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.4.68/5162: #0: ffff888017009dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.4.68/5163: #0: ffff888020f10a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.5.69/5186: #0: ffff8880170b1210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.5.69/5187: #0: ffff888020f4f208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.6.70/5204: #0: ffff88801700a990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.6.70/5206: #0: ffff888020f17208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.7.71/5228: #0: ffff8880170b1dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.7.71/5229: #0: ffff888021065a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 3 locks held by syz-executor/5241: #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 #1: ffff88802dda53e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49 #2: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #2: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 1 lock held by syz.9.72/5249: #0: ffff8880170b2990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.9.72/5250: #0: ffff88802107a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz-executor/5262: #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/5268: #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 2 locks held by dhcpcd/5271: #0: ffff888031b74120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888031b74120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243 #1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 1 lock held by dhcpcd/5272: #0: ffff88802385a120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88802385a120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243 1 lock held by dhcpcd/5273: #0: ffff8880782b2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff8880782b2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4383 Comm: kworker/u4:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_nc_worker RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:check_preemption_disabled+0x56/0x110 lib/smp_processor_id.c:19 Code: 74 1f 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 08 0f 85 c4 00 00 00 48 83 c4 10 5b 41 5e 41 5f 5d c3 48 c7 04 24 00 00 00 00 9c <8f> 04 24 f7 04 24 00 02 00 00 74 cc 65 4c 8b 3d 16 eb 41 76 41 f6 RSP: 0018:ffffc900033cfa60 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080000000 RDX: 0000000000000000 RSI: ffffffff8a2b39e0 RDI: ffffffff8a7a4540 RBP: ffffc900033cfbc0 R08: ffffffff8d8b122f R09: 1ffffffff1b16245 R10: dffffc0000000000 R11: fffffbfff1b16246 R12: ffffffff8c31ef60 R13: 1ffff92000679f60 R14: 0000000000000246 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc90461a2c4 CR3: 0000000040e9f000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lockdep_recursion_inc kernel/locking/lockdep.c:431 [inline] lock_acquire+0x166/0x400 kernel/locking/lockdep.c:5622 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313 rcu_read_lock include/linux/rcupdate.h:740 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline] batadv_nc_worker+0xc9/0x5c0 net/batman-adv/network-coding.c:723 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 final repro crashed as (corrupted=false): INFO: task syz.2.19:4360 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:27184 pid: 4360 ppid: 4309 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f6d8d07e159 RSP: 002b:00007f6d8c6de028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f6d8d305fa0 RCX: 00007f6d8d07e159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007f6d8d115024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6d8d306038 R14: 00007f6d8d305fa0 R15: 00007ffeec1c30d8 INFO: task syz.1.22:4376 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.22 state:D stack:27600 pid: 4376 ppid: 4308 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fab36f85159 RSP: 002b:00007fab365e5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fab3720cfa0 RCX: 00007fab36f85159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007fab3701c024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007fab3720d038 R14: 00007fab3720cfa0 R15: 00007ffdc1bf8278 INFO: task syz.0.17:4403 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27408 pid: 4403 ppid: 4310 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f48c56e3159 RSP: 002b:00007f48c4d43028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f48c596afa0 RCX: 00007f48c56e3159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007f48c577a024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f48c596b038 R14: 00007f48c596afa0 R15: 00007ffdf4124f88 INFO: task syz.3.24:4429 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.24 state:D stack:27600 pid: 4429 ppid: 4312 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f47dc921159 RSP: 002b:00007f47dbf81028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f47dcba8fa0 RCX: 00007f47dc921159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007f47dc9b8024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f47dcba9038 R14: 00007f47dcba8fa0 R15: 00007ffeebe4f028 INFO: task syz.4.21:4430 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.21 state:D stack:27600 pid: 4430 ppid: 4317 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573 __xfs_buf_submit+0x3b5/0x7b0 fs/xfs/xfs_buf.c:1638 xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline] xfs_buf_read_uncached+0x15d/0x230 fs/xfs/xfs_buf.c:885 xfs_readsb+0x172/0x630 fs/xfs/xfs_mount.c:178 xfs_fs_fill_super+0x583/0x13e0 fs/xfs/xfs_super.c:1516 get_tree_bdev+0x3e6/0x610 fs/super.c:1336 vfs_get_tree+0x88/0x270 fs/super.c:1541 do_new_mount+0x247/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa6a963e159 RSP: 002b:00007fa6a8c9e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fa6a98c5fa0 RCX: 00007fa6a963e159 RDX: 00002000000002c0 RSI: 0000200000000280 RDI: 0000200000000080 RBP: 00007fa6a96d5024 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000281841d R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa6a98c6038 R14: 00007fa6a98c5fa0 R15: 00007ffdbb2dfba8 Showing all locks held in the system: 3 locks held by kworker/0:0/7: #0: ffff88802b25e138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000cc7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4120 2 locks held by kworker/1:0/21: #0: ffff888016c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000db7d00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 1 lock held by khungtaskd/27: #0: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:1/144: 2 locks held by getty/3947: #0: ffff88802cb9a098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002d032e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 3 locks held by kworker/1:3/4223: #0: ffff88802b25e138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000305fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4120 3 locks held by kworker/0:15/4293: #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000314fd00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffff88805b307240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3380 drivers/net/netdevsim/fib.c:1480 3 locks held by kworker/u5:6/4320: 1 lock held by syz.2.19/4360: #0: ffff88801b9f40e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.1.22/4376: #0: ffff88807ab780e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.0.17/4403: #0: ffff88802335e0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.3.24/4429: #0: ffff88807c1ba0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.4.21/4430: #0: ffff88802820c0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.5.33/4538: #0: ffff888077d660e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.6.26/4549: #0: ffff888075f760e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.7.37/4601: #0: ffff88805cccc0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.9.38/4636: #0: ffff88801f6cc0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 1 lock held by syz.8.43/4685: #0: ffff88801fdba0e0 (&type->s_umount_key#53/1){+.+.}-{3:3}, at: alloc_super+0x200/0x970 fs/super.c:229 2 locks held by syz.2.44/4717: #0: ffff8880170af010 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88801b9f40e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.2.44/4718: #0: ffff888020f3a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.1.45/4729: #0: ffff888017009210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88807ab780e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.1.45/4733: #0: ffff888020eea208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.0.46/4744: #0: ffff8880170ae450 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88802335e0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.0.46/4748: #0: ffff888020d7d208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.3.47/4762: #0: ffff8880170b0650 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88807c1ba0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.3.47/4763: #0: ffff888020f48a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.4.48/4775: #0: ffff888017009dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88802820c0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.4.48/4776: #0: ffff888020f10a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.5.49/4799: #0: ffff8880170b1210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff888077d660e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.5.49/4802: #0: ffff888020f4f208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.6.50/4824: #0: ffff88801700a990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff888075f760e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.6.50/4828: #0: ffff888020f17208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.7.51/4845: #0: ffff8880170b1dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88805cccc0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.7.51/4849: #0: ffff888021065a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.9.52/4869: #0: ffff8880170b2990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88801f6cc0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.9.52/4870: #0: ffff88802107a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 2 locks held by syz.8.53/4882: #0: ffff88801700b550 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 #1: ffff88801fdba0e0 (&type->s_umount_key#54){+.+.}-{3:3}, at: grab_super+0x53/0x190 fs/super.c:389 1 lock held by syz.8.53/4883: #0: ffff8880210b5a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.2.54/4901: #0: ffff8880170af010 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.2.54/4902: #0: ffff888020f3a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.1.55/4919: #0: ffff888017009210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.1.55/4922: #0: ffff888020eea208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.0.56/4930: #0: ffff8880170ae450 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.0.56/4933: #0: ffff888020d7d208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.3.57/4951: #0: ffff8880170b0650 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.3.57/4953: #0: ffff888020f48a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.4.58/4967: #0: ffff888017009dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.4.58/4968: #0: ffff888020f10a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.5.59/4997: #0: ffff8880170b1210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.5.59/5000: #0: ffff888020f4f208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.6.60/5020: #0: ffff88801700a990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.6.60/5022: #0: ffff888020f17208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.7.61/5039: #0: ffff8880170b1dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.7.61/5042: #0: ffff888021065a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.9.62/5063: #0: ffff8880170b2990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.9.62/5064: #0: ffff88802107a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.8.63/5077: #0: ffff88801700b550 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.8.63/5080: #0: ffff8880210b5a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.2.64/5094: #0: ffff8880170af010 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.2.64/5095: #0: ffff888020f3a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.1.65/5111: #0: ffff888017009210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.1.65/5112: #0: ffff888020eea208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.0.66/5126: #0: ffff8880170ae450 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.0.66/5130: #0: ffff888020d7d208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.3.67/5140: #0: ffff8880170b0650 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.3.67/5142: #0: ffff888020f48a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.4.68/5162: #0: ffff888017009dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.4.68/5163: #0: ffff888020f10a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.5.69/5186: #0: ffff8880170b1210 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.5.69/5187: #0: ffff888020f4f208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.6.70/5204: #0: ffff88801700a990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.6.70/5206: #0: ffff888020f17208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz.7.71/5228: #0: ffff8880170b1dd0 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.7.71/5229: #0: ffff888021065a08 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 3 locks held by syz-executor/5241: #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 #1: ffff88802dda53e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49 #2: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #2: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 1 lock held by syz.9.72/5249: #0: ffff8880170b2990 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0x194/0x610 fs/super.c:1296 1 lock held by syz.9.72/5250: #0: ffff88802107a208 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x13e/0xe80 drivers/block/nbd.c:1475 1 lock held by syz-executor/5262: #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/5268: #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44d008 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 2 locks held by dhcpcd/5271: #0: ffff888031b74120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888031b74120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243 #1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 1 lock held by dhcpcd/5272: #0: ffff88802385a120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88802385a120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243 1 lock held by dhcpcd/5273: #0: ffff8880782b2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff8880782b2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4383 Comm: kworker/u4:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_nc_worker RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:check_preemption_disabled+0x56/0x110 lib/smp_processor_id.c:19 Code: 74 1f 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 08 0f 85 c4 00 00 00 48 83 c4 10 5b 41 5e 41 5f 5d c3 48 c7 04 24 00 00 00 00 9c <8f> 04 24 f7 04 24 00 02 00 00 74 cc 65 4c 8b 3d 16 eb 41 76 41 f6 RSP: 0018:ffffc900033cfa60 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080000000 RDX: 0000000000000000 RSI: ffffffff8a2b39e0 RDI: ffffffff8a7a4540 RBP: ffffc900033cfbc0 R08: ffffffff8d8b122f R09: 1ffffffff1b16245 R10: dffffc0000000000 R11: fffffbfff1b16246 R12: ffffffff8c31ef60 R13: 1ffff92000679f60 R14: 0000000000000246 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc90461a2c4 CR3: 0000000040e9f000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lockdep_recursion_inc kernel/locking/lockdep.c:431 [inline] lock_acquire+0x166/0x400 kernel/locking/lockdep.c:5622 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313 rcu_read_lock include/linux/rcupdate.h:740 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline] batadv_nc_worker+0xc9/0x5c0 net/batman-adv/network-coding.c:723 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287