Extracting prog: 42m11.327392676s Minimizing prog: 1h2m5.986518673s Simplifying prog options: 0s Extracting C: 3m8.084900049s Simplifying C: 54m9.769740289s extracting reproducer from 38 programs testing a last program of every proc single: executing 8 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_ublk_setup_io_uring-mmap$IORING_OFF_SQ_RING-socket$rxrpc-openat$comedi-ioctl$BTRFS_IOC_SUBVOL_GETFLAGS-setresuid-syz_open_dev$tty1-ioctl$KDSKBENT-ioctl$COMEDI_DEVCONFIG-openat$binderfs-ioctl$BINDER_SET_MAX_THREADS-bind$rxrpc-listen-openat$vimc0-ioctl$VIDIOC_STREAMOFF-socket$nl_netfilter-openat$vsock-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-ioctl$FAT_IOCTL_GET_VOLUME_ID-sendmsg-socket$rxrpc-sendmsg-syz_open_dev$tty1-writev-recvmsg-sendmsg$SEG6_CMD_SETHMAC-sendmsg$SEG6_CMD_GET_TUNSRC-recvmsg$can_j1939 detailed listing: executing program 0: syz_usb_connect(0x5, 0xf4, &(0x7f0000000700)=ANY=[@ANYBLOB="120110014c306f10da0b38011230010203010902e20002a60000000904b10403d7b5d25b09210400020122c705090500100004f40804072501832f08000905000040008103ff0905091b08000c078009042201040e010003090509000000030004090502020002f7810671300c458e9532438d4aae3ef0c9bf5c520b1aaab11a8cae9a60c3160adc1dfedebf5a6ead8834c7780c2eb777ef0caf96cd8b3b77f357f4aa1b662ab40651e6ae8cc63dd9f6e2d24afaed81a927ca2e0354281cfeffffffffffffffbf09aac591308e5c0c3c419bb288a21890e1af4af409050303ff030840040705a6c6"], 0x0) r0 = syz_ublk_setup_io_uring(0xa78, &(0x7f0000000080)={0x0, 0x92c1, 0x8000, 0x2000004, 0x257}, &(0x7f0000000600), &(0x7f0000000140), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x10001, 0x2000007, 0x401d031, r0, 0x0) (async) r1 = socket$rxrpc(0x21, 0x2, 0x2) (async) r2 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x7e5483, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r2, 0x80089419, &(0x7f0000000300)) (async) setresuid(0xee01, 0xee00, 0x0) (async, rerun: 32) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) (rerun: 32) ioctl$KDSKBENT(r3, 0x4b47, &(0x7f0000000180)={0x3, 0xf4, 0x20f}) (async) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, 0x0) (async, rerun: 64) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (rerun: 64) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000000100)=0x100) (async) bind$rxrpc(r1, &(0x7f0000000000)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) (async) listen(r1, 0x1) (async) r5 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_STREAMOFF(r5, 0x40045613, &(0x7f0000000580)=0xe) (async, rerun: 32) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x8900, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000000) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a6c00000006a3314663496e36591facde9d98d30e000a01040000000000000000000000010c0003400000000000000000400004803c0001800b00010074615467657400002c0002800d000100434f4e4e4d41524b000000de2c0001004d415351554552414445000008000100544545000900020073797a320000000014000000"], 0x94}, 0x1, 0x0, 0x0, 0x4000850}, 0x24008840) (async) ioctl$FAT_IOCTL_GET_VOLUME_ID(r5, 0x80047213, &(0x7f0000000340)) (async) sendmsg(r1, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300), 0x28}, 0x0) (async) r7 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r7, &(0x7f0000000040)={&(0x7f0000000800)=@caif=@rfm={0x25, 0x2, "c489f2bf63080f3c07adef8dc6e7dc84"}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000240)="ba07570ed84b30c28023f5b46a625b27689ed488ad3d4c073580881400c49ce20c01c33aaf1b22002082034c89ab50727f943f2b26dd1a78efbced93d4519d51f2267af3841bcce426d8e5ffd77719dc642fa9d2cb25867c9cb0b0ef12d973603a973dc56df719c5ac380787721ac692448eaf06a27a9141b6f1b3c2b81fb6af058db40863c226cb6d7abe93c3dde845c18da3bac29a71a0e951da8b1f8bb101a67f7e56669b1f5ac30dec2e94fc69df919601b159396b4509fb59f6fc9ce927", 0xc0}], 0x1, &(0x7f0000000400)}, 0x0) (async) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r8, &(0x7f0000002600)=[{&(0x7f0000001380)="cb2887319628f112b409d32ec8c81f718b6da846dc61f7752f23f847486665c6f69173aa5dcdaf6d916aa06c0bccf5b45c463eab7c0975967489472f3fcd55182ad680f43e6e611d59863fad8ade695842bd365de3e1e7b5dafe7470a5fc879b45781c8992ce85cb0e34adfce97d50203bf903a718004f469f125fd5aee0d14e099ff7036ba44e3726a723badeb878934f173f11f9e9fc433715c4f359e04503751eb643453e23c6b5ef9ea935ade25d85976f7ba1613acb1ed50568ebde7f86903fdc8043d5d3e07c8bdb0c3314096ff38a43ff0b2b919cb2b9c5d1b73fd294eb307a3137847548439e4a7b81a689c28e4e85ebc2f94abc6a9bbc7d440d16d03abefcb9fe799f28f969e04f1a320fa3b7cf595b6f37fdf7ee17ad901f8d0b7b7086c0b937d98127de2d869a05a4d324fed30cd25fcdb3bc14ee7744f4ab5e419b5b1ea41e62575b6bb3f6b0f0e9969f6a1ff7b122e9c2d2adea39e1dedfb46f5773a7f436a9bb688cffb1ecd4ab224224952633e290d238238a454f5b6bf2d1f35a7b969103373d3424c72370fc8e1887c176a84317d7247ea64ce48392c922539f4b5172fbb9bdf0eb838da9da7354d1f1197db50e0a2b0effbbaa024e3fc369c96a2650314f48ea95b50d55221a965d537cd2b24ec82bf86cca249afbfddb7afd605bb40dd28ecb8a5fe2d732ec3578841babfc0f1dbf94f74f394af14e24a02ff720a1f110ec8e1f913f385c6adcd7571d119b7d6d06d791e7b94c57e9fc7d5e1b51482b3c3976ab06637888e9b26cecdd330e430542ca48e90627f04e3094aeed181f4577b658e46cead7aae8f43e408b6b0876b7e7a02405ffa2602062c8f2518ed914fb76db801801aafe5140dc00b984562e1eea8b8446fa53397219d39840840192fd64a2c4f6501b50204f183205f89f0699acc77c5306f0c514b9ee08b6b516a43530abbd53d7c2ecea0ce08afc2f3359b193bc655c29893175b8ccee7bab4c3bda1960bbfba528526e7abd6c718227a078ef5b496b64ee267024365557e7770085efd21b27a9dd138f4cf3ba0f5945b0510aa38f7db9c31d3661542ec761e91fd5d2ae33a185e72d4ed3bc10ab9981dbbd2fc293877d1eb8e2fa1cb3d860e76e5dea91b29d1bcd56c6dc86c15e267cdac7eff23b7dbea24b1dd4e3e61d14b8848c49e115c36badb0b2dc7e199ab0116a01e2511462b1f7ed7b22b23afa89e4a89eb15180731f31b203d831214dc1c5d70be98d8911388fb579c2c79db9f05dd755fd18121f4b9f265e70ece06aa052b44e11521908eafc7a92bcab36d7245af7610560bd2c44f087647fd9e6b9d89ed977e21ae49f32b7775c417f887e33d8efc13d926d5130d4ac739a4ef3225d3b1f73fda3a60a57101b2462d4390302855fddad14226ddc607c3ff8e6acfd9aff4e2404951fffaa3ba635e3ec3f0b8155fe6e41f5271c2793367108536eac7d6ff44be3d26adea3d426f1b89c2636fbcbd124a7c578a0dd9f394e404e98868aaeaf9a55575cd73817cb3241dae61d13344f689279511e55f08f819558fe911a23d5442141314e0e5cfbd5530c76393ba122579001e3549b0d62c9527acf4c950652ae75433939bf761aae81374d7295ec0210819594ec89c17868e6aea4d0c834631a1f450218473bed56f21fdaf889e5c96ba7f6bf04df94e46fd0fc36a1df9a12df012965bccea410e92d712b7492ec9a4f536233e6493009b83842390cd461f7d94dc2d867a46a47c647328f7723ef398315c199f726a7306a3c95da31a3091f0ca42968295ea175362e019c62143f347ecfc2e9f7c29725b3156de86e3fdb06912aa65150a65909ef3ef6cf19f8b8490dab9ece0f07f643a1af250ea95e9c43c07ff130dc8f03105d8495a580fd8b349f6d717e05b44ba61825fbe94062c485590c21f70ae27227f1d5c420607b39f9a8f354e2b6353cabce9163b710ba175f52192388607253f05ce50652303303643c4028e15407163df734429674ef6fb3f102bd13528fd4de4d4bcdccb9894dc0acfc34096dc5f7eecad50cba8a0af4e7acbdbc5970fbcd0f07220af7bf868738c431829c85ee81a8e81a4ebeec3a6af884dddc736b75feaacc7fd5fc2a69acb6f4f25fe12407cbc8b8b3279c2fc9d83e4bd62fc984f3a139ec16726cfe8c9b6a246c6255ac19e506f40f14bb7501edb61698b4611cae3af367329eeb1b472e9d432497f8822553cda33e31182c55182b46b151a92520221aa576e828102fbd79f0d4a25e0c3c0c4308433193407f4bb038348c7128415b80890464076b956032c74f333e1f9e18e32f4444719dcf6f85dd7b5e33868b5c2e636bb899b3db8b3b071791c466ffaca231aa7e8cdcdfe39eba939d00196bd2487ed21b5fa9a83fd7466b54db68431e5574a54a5ee6dd5e91e1ee2e8318cac1cd41d64c46f62c2c4b77ada010f57d5d966281f2578cc6d836ae076bbb5cfc092f291f67c154d83d7a791971c8fd2dee66917a24a6c45eccc6d639f4772860f422bbd78e2026159343e5429534a919d8100ae94c144b999f7a6c4dd11f245129cf33663a894e629b3d0979cb9aaa4db8f22caa6baabf7d3e08ea06fdff9cec6c1914d5cda93c1c8e9b41084a49d0cd518d563b501acc194ec91e193ccbbcaeb2427109e093a87fb3ca80fa1e8434c0670e96f7ecd346479cf25c6da184e478a7082225145d6a55197d307b4a6e3a7dcefddd887962f8501e4cbbf8486d536a0f0926c650fe8a6713820b2b11a3b56412ea6d7abc5bc16d2e98e467635ebdda6a102b39c5aada20d6078436d0e5b954758f5ea48e5c000e8b7e649b360183486eba7c69d3228b902a1577d7e8bfc2723901646bb5dcb1c38c2f7c372dc358d20c3bb25e47dd2f111f79c30b43623d204ebff7c792192a1afd3f00a29c05307629df3214e00c9ad3d263aceeea560da5f912ea822526c3b85a1f1be5ed370fa9f7847102a695136b3432fa4ae8210768b524cd3c71fd73145bda7271d1cf3c71073ea3c9a74fa667847235806ee9e4a2b5a65185c455949636c962345b3a336eb3ce4134e2081a75e4e016f46523a937464b46533e40b38281602e82256f8e5d977474c6b18a91b5c90e215d5655aa60ad184d585a907dd6174cb7989d3ae411e59ceed28127f121a0f5e817a682fdd6be99556faa637949a5b383e36a57701682d9fa173e42378c499396f6609c012fea9f65fbf5b0026e2ee5a914d8022b95bab7d380cb5f84f09bd29ad0129506772881e0fcbd2eba8ea30167f18f5b2dfeee9095440d8845576575eda1b291838e0d8b61246c6dd2730a806a17aa465216d52232524479fe0032d4398caeea65fd1089ff95a96bf4e0320a6cefc21181fb8a70fc5b5d97130657411c07a57be815821128efddf3e945e2f1c0079f933a0e71e90d8b0e12b730d340422ece0687eb61e079addea285587dcfe613f4021016515a2014fd7a5d411ec26879cbf63de0ebeeafc4e17da3e07fe8275e2913035ca21e222eeb020f30a09846d51cd1fa4b207b93dba5c86f8e13fd63899c8afba4dee0bf69cd14b993c7d62fcd51a5d43e1460617479369255d9058bde64b40611391166b5f9801716f13a11bbb78d663e7f283190db8ccdb3897f3afe2fd070718753baa6a6974f9096283838d648b0a38e4d3424a00e97d1d6ca1024a336daf1488af53447f7fdfd89815853d76cb98c183a8ee72ef63d8b2faf0b665006bc7139c2e74773d97d145af516af520032d0ba82388f7487b2104658e3b80dd5f111f4b42609fc78c6bba98ee0aa5ead3934205b6c32b2d2cb1150ee252f66ddaf7f70d2e21f43f20dba8b7819ce35fb6bc53b1e979212708fb81c90333a480868451e8eb7561487e42852b56896480db5b903f4a4e783809846fa03cca20f4f40ae1a61b076e3c03d536e2af2c9ac46c241ef2434fdaa80963af3f559553ce0036cb2882613fe0bec5c64fb63e2330e14b42a8769c14576562f62a9d2aef59b9e4bda6efab3b7cdae6da97197e0802ca62e0adcc3640a20e1f544190ba290465f327c89647366d79be0646cc071c0a566c491ad85ebe449652ce23296305502027444ebba5947b2e7d95dca7f1efc577de5f219bfa4752d672015c1e6a50b7ffe206050c64618badf178634fa96499063fe9d55d99276ceecd13c13a68af1b0c40e5652adb1acb1d2fde6897bd41acbdbc0086f688b8b37d33fc5f767dcdfb6f7f636377af42a2577e6fa3897d8b5311dea57477e9549fdcdc71913bc082a821b26a21180b2fa3bb16c863c319aa8973ba18e930f8f186919bb23553ee6ccbc5c149c1039327807c2b4fc5c6e254b7ac0ee5a624d0790a1eb6c448b5a8cf5376bb7d24cb555c355a7f6c7a97eef80f0e7bfc76e49a07c275bc26a0dfa336b7cd1850fc9459178c3b4a8cb73e65c4864857392defddeaaf92d75e6f04a2425c7b69fd6f7637e6bfc5f5766f3ed4dbdbc40819c767b95e61466705998c8afee6cc80438adc0663cc5befe484dfabdeebb228d6d95756755af8cb5e197589dcc2382ac88928a208974cb755294677df7ab3ddc48e53adba7ea3c02acf2f0cbdbd73d1483efb6db64084b2d35dba7b9dc1186b2796fc6ef7cdc36bd3fddf0a5aea6", 0xcda}], 0x1) recvmsg(r1, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="0d022bbd7000fedbdf2501000000050006000200000005000500041300000800030006000000140004"], 0x40}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) (async, rerun: 64) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)=ANY=[@ANYBLOB='o', @ANYRES16=0x0, @ANYBLOB="040029bd7000fddbdf250400000008000200000800000800020005000000080002000500000008000300d85400000500050002000000080003008000000005000600050000001400040008000000050000000200000000000080"], 0x60}, 0x1, 0x0, 0x0, 0x8804}, 0x40000) recvmsg$can_j1939(r1, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f0000002640)=""/4112, 0x1010}], 0x1}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_init_net_socket$bt_hci-bind$bt_hci-write-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_usb_connect$hid detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000140)=ANY=[], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="09000000010000", 0x7) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000700)=ANY=[@ANYBLOB="1201100100000008ac05620240000102030109022d0001010510010904000402030102"], 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_ep_read(r0, 0x2, 0xc, &(0x7f0000000100)=""/12) syz_usb_ep_write(r0, 0x81, 0x18, &(0x7f0000000200)='\x00'/24) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-ioctl$AUTOFS_DEV_IOCTL_CATATONIC-ioctl$sock_inet_SIOCSARP-socket$kcm-sendto$phonet-ioctl$SIOCSIFHWADDR-write$tun-syz_open_dev$amidi-ppoll-ioctl$UDMABUF_CREATE_LIST-setsockopt$inet_tcp_buf-mkdirat-syz_usb_connect$printer-socket$inet_udp-setsockopt$EBT_SO_SET_ENTRIES-mmap$IORING_OFF_SQES-syz_open_dev$cec-ioctl$CEC_DQEVENT-ioctl$CEC_DQEVENT-ioctl$CEC_S_MODE-syz_usb_control_io$printer-syz_open_dev$char_usb-write$char_usb-timer_create detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000080)={{0x2, 0x4e24, @empty}, {0x306, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}}, 0x0, {0x2, 0x4e24, @rand_addr=0x64010101}, 'veth1_to_bridge\x00'}) r2 = socket$kcm(0x2, 0xa, 0x2) sendto$phonet(r1, &(0x7f0000000240)="6337493f03b4436de06c0fc636a08b0a71bfb953b951c678c87626b7f4c2c47160168b4392920cbf13d204b5ec3c252486d59117bdbbb3e13506e40e8b3753de6980cee271dfef62296745a583280017b256549f85570fc612a951b57bc77436e86cc11786aca59f04cf4b471eea718b05f8ad5c7d7d3dac1cafff52eff8a53518337f9ddca1cbc24c4846b8c8465de8b09d369969fd3df46ae619ce16990f0b8e674744ba9d223f0b4a1de624ce0756aa1c809bbe3d1ef9c27b11db43514da36833d5ac5cc2a5f212654319a59e9c6b66cc246137ec5a72f2f8e019cbfdaedc5c9d119364061939b898e903e9e30f766a4a012dfce81e68b7e7d0d4", 0xfc, 0x808, &(0x7f0000000340)={0x23, 0x1, 0x7, 0x5}, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000001300)=ANY=[@ANYBLOB="000086dd0000110000000000000060ec970000482cff20010000000000000000000000000002ff0200000000000000000000000000013a000000fdffffff0100907809000000699951a503ff330020010000000000000000000000000000000000000000000000001100000000012f00040002200500a542e5fa78122afa"], 0x7e) r3 = syz_open_dev$amidi(&(0x7f0000000100), 0x8, 0x14002) ppoll(&(0x7f0000000140)=[{r0, 0x2}, {r2, 0x20}, {r0, 0x80}, {r1, 0x4010}, {r0}, {r3, 0x200}, {r0, 0xb1}], 0x7, &(0x7f00000001c0)={0x77359400}, &(0x7f0000000380)={[0xfffffffffffff4b6]}, 0x8) ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0xc0686611, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000000), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0xa) r4 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c00009040000020701010009050102"], 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x0, 0xc0, [0x0, 0x200000000300, 0x200000000330, 0x200000000360], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000"]}, 0x136) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x4199831, 0xffffffffffffffff, 0x10000000) r6 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_DQEVENT(r6, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(r6, 0xc0506107, 0x0) ioctl$CEC_S_MODE(r6, 0x40046109, &(0x7f0000000180)=0xd0) syz_usb_control_io$printer(r4, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r7, 0x0, 0x2) timer_create(0xffffffffffffffff, 0x0, &(0x7f0000000000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-sendmsg$NL80211_CMD_DISCONNECT-sync detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DISCONNECT(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a00)={0x24, r1, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x8004) sync() program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-sendmsg$NL80211_CMD_DISCONNECT-sync detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DISCONNECT(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a00)={0x24, r1, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x8004) sync() program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT-openat$nvme_fabrics-write-ioctl$NBD_SET_SIZE detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r2, &(0x7f0000000200)='nqn=test,transport=tcp,traddr=::', 0x20) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x7f) program crashed: INFO: task hung in nbd_ioctl single: successfully extracted reproducer found reproducer with 11 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT-openat$nvme_fabrics-write detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r2, &(0x7f0000000200)='nqn=test,transport=tcp,traddr=::', 0x20) program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT-openat$nvme_fabrics detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-socketpair$nbd-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-madvise-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-madvise-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-mmap-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r0) ioctl$NBD_SET_SIZE(0xffffffffffffffff, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(0x0, 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, 0xffffffffffffffff) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT program crashed: INFO: task hung in bdev_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_SET_SIZE-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x377604e6) ioctl$NBD_DO_IT(r0, 0xab03) program crashed: INFO: task hung in bdev_open validation run: crashed=true reproducing took 2h51m7.370412949s repro crashed as (corrupted=false): INFO: task udevd:4978 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:25456 pid:4978 tgid:4978 ppid:1 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5581 [inline] __schedule+0x1b47/0x5b40 kernel/sched/core.c:7384 __schedule_loop kernel/sched/core.c:7461 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7476 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7533 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 bdev_open+0xde/0xd70 block/bdev.c:990 blkdev_open+0x461/0x600 block/fops.c:696 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4846 [inline] path_openat+0x14a6/0x1da0 fs/namei.c:5011 do_file_open+0x23e/0x4a0 fs/namei.c:5040 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f558ddd8407 RSP: 002b:00007ffec2c17910 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f558dd4c880 RCX: 00007f558ddd8407 RDX: 00000000000a0800 RSI: 000056268fa52140 RDI: ffffffffffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000562680eac100 R14: 0000000000000000 R15: 00007ffec2c17ba0 INFO: task syz.0.19:5872 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.19 state:D stack:28104 pid:5872 tgid:5871 ppid:5765 task_flags:0x400140 flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5581 [inline] __schedule+0x1b47/0x5b40 kernel/sched/core.c:7384 __schedule_loop kernel/sched/core.c:7461 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7476 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7533 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 bdev_release+0x1b8/0x690 block/bdev.c:1173 blkdev_release+0x15/0x20 block/fops.c:704 __fput+0x413/0xa50 fs/file_table.c:513 task_work_run+0x1d9/0x260 kernel/task_work.c:233 get_signal+0x117c/0x12c0 kernel/signal.c:2884 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2c84f9e159 RSP: 002b:00007f2c85de3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007f2c85225fa0 RCX: 00007f2c84f9e159 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 RBP: 00007f2c8503506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2c85226038 R14: 00007f2c85225fa0 R15: 00007ffd6928af88 Showing all locks held in the system: locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by udevd/4978: 1, on CPU#1: #0: ffff888027930350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 block/bdev.c:990 locks held by getty/5365: 2, on CPU#1: #0: ffff8880363530a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by udevd/5654: 1, on CPU#0: #0: ffff888027930350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 block/bdev.c:990 locks held by kworker/u9:2/5749: 2, on CPU#1: #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz.0.19/5872: 1, on CPU#0: #0: ffff888027930350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1b8/0x690 block/bdev.c:1173 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1058/0x10d0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b a2 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 97 29 00 fb f4 8c 18 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8ee07ca0 EFLAGS: 00000246 RAX: 0000000000200ba3 RBX: ffffffff819ccf00 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e74f1c1 RDI: ffffffff8c8f3280 RBP: ffffffff8ee07d78 R08: ffff8880b8433e5b R09: 1ffff110170867cb R10: dffffc0000000000 R11: ffffed10170867cc R12: 0000000000000000 R13: 1ffffffff1dd1df8 R14: 1ffffffff1dc0f9c R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888124623000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00002000000011c0 CR3: 0000000035cbc000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 rest_init+0x378/0x3a0 init/main.c:729 start_kernel+0x397/0x3e0 init/main.c:1188 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x157 final repro crashed as (corrupted=false): INFO: task udevd:4978 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:25456 pid:4978 tgid:4978 ppid:1 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5581 [inline] __schedule+0x1b47/0x5b40 kernel/sched/core.c:7384 __schedule_loop kernel/sched/core.c:7461 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7476 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7533 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 bdev_open+0xde/0xd70 block/bdev.c:990 blkdev_open+0x461/0x600 block/fops.c:696 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4846 [inline] path_openat+0x14a6/0x1da0 fs/namei.c:5011 do_file_open+0x23e/0x4a0 fs/namei.c:5040 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f558ddd8407 RSP: 002b:00007ffec2c17910 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f558dd4c880 RCX: 00007f558ddd8407 RDX: 00000000000a0800 RSI: 000056268fa52140 RDI: ffffffffffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000562680eac100 R14: 0000000000000000 R15: 00007ffec2c17ba0 INFO: task syz.0.19:5872 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.19 state:D stack:28104 pid:5872 tgid:5871 ppid:5765 task_flags:0x400140 flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5581 [inline] __schedule+0x1b47/0x5b40 kernel/sched/core.c:7384 __schedule_loop kernel/sched/core.c:7461 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7476 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7533 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 bdev_release+0x1b8/0x690 block/bdev.c:1173 blkdev_release+0x15/0x20 block/fops.c:704 __fput+0x413/0xa50 fs/file_table.c:513 task_work_run+0x1d9/0x260 kernel/task_work.c:233 get_signal+0x117c/0x12c0 kernel/signal.c:2884 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2c84f9e159 RSP: 002b:00007f2c85de3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007f2c85225fa0 RCX: 00007f2c84f9e159 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 RBP: 00007f2c8503506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2c85226038 R14: 00007f2c85225fa0 R15: 00007ffd6928af88 Showing all locks held in the system: locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by udevd/4978: 1, on CPU#1: #0: ffff888027930350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 block/bdev.c:990 locks held by getty/5365: 2, on CPU#1: #0: ffff8880363530a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by udevd/5654: 1, on CPU#0: #0: ffff888027930350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 block/bdev.c:990 locks held by kworker/u9:2/5749: 2, on CPU#1: #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888027b27148 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90003977c40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz.0.19/5872: 1, on CPU#0: #0: ffff888027930350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1b8/0x690 block/bdev.c:1173 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1058/0x10d0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b a2 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 97 29 00 fb f4 8c 18 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8ee07ca0 EFLAGS: 00000246 RAX: 0000000000200ba3 RBX: ffffffff819ccf00 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e74f1c1 RDI: ffffffff8c8f3280 RBP: ffffffff8ee07d78 R08: ffff8880b8433e5b R09: 1ffff110170867cb R10: dffffc0000000000 R11: ffffed10170867cc R12: 0000000000000000 R13: 1ffffffff1dd1df8 R14: 1ffffffff1dc0f9c R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888124623000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00002000000011c0 CR3: 0000000035cbc000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 rest_init+0x378/0x3a0 init/main.c:729 start_kernel+0x397/0x3e0 init/main.c:1188 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x157