Extracting prog: 6m36.731008429s Minimizing prog: 1h26m17.137877187s Simplifying prog options: 17m14.634564949s Extracting C: 5m5.424051852s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r2, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r2, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in blkdev_flush_mapping single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT detailed listing: executing program 0: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r2, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r2, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, 0x0, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in read_part_sector testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NBD_CMD_CONNECT(r0, 0x0, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, 0x0}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={0x0}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x14, r1, 0x1, 0xfffffffd}, 0x14}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x48, r1, 0x503, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SOCKETS={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x40080) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in read_part_sector extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in read_part_sector extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in read_part_sector validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in read_part_sector validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$nbd-socketpair$nbd-sendmsg$NBD_CMD_CONNECT-sendmsg$NBD_CMD_RECONFIGURE detailed listing: executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x14, r1, 0x503, 0x70bd28, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40080) program crashed: INFO: task hung in read_part_sector validation run: crashed=true reproducing took 2h25m59.499576717s repro crashed as (corrupted=false): INFO: task udevd:5827 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disabl "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:26168 pid:5827 tgid:5827 ppid:5147 task_flags:0x400140 flags:0x00080802 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x1259/0x6920 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7376 io_schedule+0x8a/0xf0 kernel/sched/core.c:8220 folio_wait_bit_common+0x414/0xa80 mm/filemap.c:1329 folio_put_wait_locked mm/filemap.c:1498 [inline] do_read_cache_folio+0x3bc/0x6b0 mm/filemap.c:4138 read_mapping_folio include/linux/pagemap.h:1015 [inline] read_part_sector+0xd1/0x370 block/partitions/core.c:724 adfspart_check_POWERTEC+0x8a/0x630 block/partitions/acorn.c:451 check_partition block/partitions/core.c:143 [inline] blk_add_partitions block/partitions/core.c:591 [inline] bdev_disk_changed+0x7b1/0x1260 block/partitions/core.c:695 blkdev_get_whole+0x187/0x290 block/bdev.c:793 bdev_open+0x2c7/0xe40 block/bdev.c:1002 blkdev_open+0x34e/0x4f0 block/fops.c:679 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4836 [inline] path_openat+0x1a23/0x2450 fs/namei.c:4999 do_file_open+0x20e/0x430 fs/namei.c:5028 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5659aa7407 RSP: 002b:00007fff92112120 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f565a24e880 RCX: 00007f5659aa7407 RDX: 00000000000a0800 RSI: 00005569ed799a50 RDI: ffffffffffffff9c RBP: 00005569ed780910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005569ed9fd0b0 R13: 00005569ed78e190 R14: 0000000000000000 R15: 00005569ed9fd0b0 Showing all locks held in the system: locks held by khungtaskd/45: 1, last CPU#2: #0: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871 locks held by kworker/1:2/1346: 3, on CPU#1: #0: ffff88801d0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000687fd08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff888027279250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x6330 drivers/net/netdevsim/fib.c:1490 locks held by getty/5541: 2, on CPU#3: #0: ffff888026d250a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000019b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 locks held by udevd/5827: 1, on CPU#1: #0: ffff888027f65350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:990 locks held by kworker/0:3/5959: 3, on CPU#0: #0: ffff88801d0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003217d08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff888014ec0250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x6330 drivers/net/netdevsim/fib.c:1490 locks held by kworker/u33:3/5978: 2, on CPU#3: #0: ffff88801d0e4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900032d7d08 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/1:6/6342: 3, on CPU#1: #0: ffff88801d0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000c3dfd08 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff8fdf81b8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 kernel/rcu/tree.c:3904 locks held by kworker/u32:5/30629: 7, last CPU#0: #0: ffff88801e6a4940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90024867d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff91cc0048 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677 #3: ffff888025e89128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888025e89128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff888025e89128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x19e/0x370 net/devlink/core.c:581 #4: ffff8880152de258 (&devlink->lock_key#87){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:314 [inline] #4: ffff8880152de258 (&devlink->lock_key#87){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff8880152de258 (&devlink->lock_key#87){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x1b4/0x370 net/devlink/core.c:581 #5: ffffffff91cd8b80 (rtnl_mutex){+.+.}-{4:4}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1060 [inline] #5: ffffffff91cd8b80 (rtnl_mutex){+.+.}-{4:4}, at: nsim_create+0x9a2/0x1420 drivers/net/netdevsim/netdev.c:1154 #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495 locks held by syz-executor/30257: 8, last CPU#1: #0: ffffffff8ff3cc90 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8ff3cc90 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline] #0: ffffffff8ff3cc90 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x5079/0x8430 kernel/fork.c:2321 #1: ffff88801d0cf180 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88801d0cf180 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716 #2: ffff888015223440 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff888015223440 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723 #3: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290 #4: ffff888014826c78 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #4: ffff888014826c78 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #5: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #5: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290 #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1354 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range mm/memory.c:1490 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pud_range mm/memory.c:1527 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_p4d_range mm/memory.c:1551 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_page_range+0xfd0/0x57c0 mm/memory.c:1637 #7: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #7: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #7: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x11d/0x580 mm/page_table_check.c:112 locks held by syz-executor/31557: 2, last CPU#3: #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: find_inlist_lock_noload net/bridge/netfilter/ebtables.c:331 [inline] #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: find_inlist_lock net/bridge/netfilter/ebtables.c:373 [inline] #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: find_table_lock net/bridge/netfilter/ebtables.c:382 [inline] #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: compat_do_ebt_get_ctl+0x12f/0xbb0 net/bridge/netfilter/ebtables.c:2431 #1: ffff88804401a9c8 (&xt[i].compat_mutex){+.+.}-{4:4}, at: compat_do_ebt_get_ctl+0x1cd/0xbb0 net/bridge/netfilter/ebtables.c:2435 locks held by modprobe/32022: 2, last CPU#2: #0: ffff8880150c6308 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x590 mm/mmap_lock.c:310 #1: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290 locks held by syz.0.53076/32025: 2, last CPU#1: #0: ffff888051b58240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #0: ffff888051b58240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:734 #1: ffffffff91d85208 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain kernel/notifier.c:379 [inline] #1: ffffffff91d85208 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x53/0xa0 kernel/notifier.c:368 ============================================= NMI backtrace for cpu 3 CPU: 3 UID: 0 PID: 45 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 3 to CPUs 0-2: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5962 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:lock_acquire kernel/locking/lockdep.c:5942 [inline] RIP: 0010:lock_acquire+0x176/0x380 kernel/locking/lockdep.c:5899 Code: 00 00 00 65 48 8b 05 d1 73 a6 13 8b 90 a4 0b 00 00 85 d2 0f 85 b0 00 00 00 9c 8f 04 24 fa 48 c7 c7 d6 7c 4d 8e e8 aa 8e eb 09 <45> 89 e8 44 89 f6 48 89 ef 65 48 8b 05 a1 73 a6 13 65 ff 05 5a ba RSP: 0018:ffffc900032374f8 EFLAGS: 00000086 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff8e4d7cd6 RDI: ffffffff8c625c80 RBP: ffffffff8fdec3e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000200 R11: 000000000001928e R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f565a24e880(0000) GS:ffff88809584a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7f2a190 CR3: 000000002606c000 CR4: 0000000000352ef0 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] class_rcu_constructor include/linux/rcupdate.h:1216 [inline] unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 slab_free_hook mm/slub.c:2709 [inline] slab_free mm/slub.c:6509 [inline] kmem_cache_free+0x424/0x6c0 mm/slub.c:6636 file_free fs/file_table.c:104 [inline] __fput_deferred+0x3e9/0x4a0 fs/file_table.c:568 fput_close+0x118/0x250 fs/file_table.c:630 path_openat+0xf77/0x2450 fs/namei.c:5008 do_file_open+0x20e/0x430 fs/namei.c:5028 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5659aa7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fff921096b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f565a24e880 RCX: 00007f5659aa7407 RDX: 0000000000080000 RSI: 00007fff92109830 RDI: ffffffffffffff9c RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005569b8d177f5 R13: 00005569b8d177f5 R14: 0000000000000001 R15: 00005569b8d32140 NMI backtrace for cpu 2 CPU: 2 UID: 0 PID: 5147 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__lock_pin_lock kernel/locking/lockdep.c:5671 [inline] RIP: 0010:lock_pin_lock kernel/locking/lockdep.c:6037 [inline] RIP: 0010:lock_pin_lock+0x62/0x150 kernel/locking/lockdep.c:6025 Code: 00 00 85 c9 0f 85 b1 00 00 00 49 89 fc 9c 41 5e fa 48 c7 c7 d6 7c 4d 8e e8 cb 10 ec 09 65 ff 05 8c 3c a7 13 8b 15 92 5f 5f 10 <85> d2 0f 84 b5 00 00 00 41 8b 85 a0 0b 00 00 85 c0 0f 8e 9a 00 00 RSP: 0018:ffffc90002d779f8 EFLAGS: 00000002 RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff8e4d7cd6 RDI: ffffffff8c625c80 RBP: 0000000000000000 R08: 0000000000000001 R09: fffff520005aef30 R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802b23c0a0 R13: ffff888026b60000 R14: 0000000000000046 R15: 000000cd5f538f4a FS: 00007f565a24e880(0000) GS:ffff88809594a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f31a83a7850 CR3: 000000004e536000 CR4: 0000000000352ef0 Call Trace: rq_pin_lock kernel/sched/sched.h:1937 [inline] rq_lock kernel/sched/sched.h:2016 [inline] __schedule+0x310/0x6920 kernel/sched/core.c:7158 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7376 schedule_hrtimeout_range_clock+0x213/0x310 kernel/time/sleep_timeout.c:216 ep_poll fs/eventpoll.c:2349 [inline] do_epoll_wait+0xfab/0x1730 fs/eventpoll.c:2829 __do_sys_epoll_wait fs/eventpoll.c:2837 [inline] __se_sys_epoll_wait fs/eventpoll.c:2832 [inline] __x64_sys_epoll_wait+0x194/0x290 fs/eventpoll.c:2832 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5659aa7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fff92112330 EFLAGS: 00000202 ORIG_RAX: 00000000000000e8 RAX: ffffffffffffffda RBX: 00007f565a24e880 RCX: 00007f5659aa7407 RDX: 0000000000000008 RSI: 00007fff92112490 RDI: 000000000000000b RBP: 00005569ed8f0600 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000bb8 R11: 0000000000000202 R12: 0000000000000000 R13: 00005569b8d32100 R14: 0000000000000169 R15: 0000000000000000 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:416 Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d e9 96 9a 24 06 e8 81 dc cd fc eb a0 e8 0a dd cd RSP: 0018:ffffc9000042f9e0 EFLAGS: 00000002 RAX: 0000000000000062 RBX: 00000000000003f8 RCX: 0000000000000000 RDX: 00000000000003f8 RSI: ffffffff85b10d15 RDI: ffffffff9cc6cba0 RBP: ffffffff9cc6cb60 R08: 0000000000000001 R09: 000000000000001f R10: 0000000000000000 R11: 2030206f68636522 R12: 0000000000000000 R13: 0000000000000062 R14: 000000000000000e R15: ffffc9000042fda8 FS: 0000000000000000(0000) GS:ffff88809574a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000ffa71014 CR3: 000000006ab97000 CR4: 0000000000352ef0 Call Trace: serial_port_out include/linux/serial_core.h:817 [inline] serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3287 [inline] __serial8250_console_fifo_write+0xd6/0x290 drivers/tty/serial/8250/8250_port.c:3359 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3432 [inline] serial8250_console_write+0x1108/0x14f0 drivers/tty/serial/8250/8250_port.c:3496 nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070 nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157 nbcon_kthread_func+0x613/0x7d0 kernel/printk/nbcon.c:1271 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task udevd:5827 blocked in I/O wait for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disabl "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:26168 pid:5827 tgid:5827 ppid:5147 task_flags:0x400140 flags:0x00080802 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x1259/0x6920 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7376 io_schedule+0x8a/0xf0 kernel/sched/core.c:8220 folio_wait_bit_common+0x414/0xa80 mm/filemap.c:1329 folio_put_wait_locked mm/filemap.c:1498 [inline] do_read_cache_folio+0x3bc/0x6b0 mm/filemap.c:4138 read_mapping_folio include/linux/pagemap.h:1015 [inline] read_part_sector+0xd1/0x370 block/partitions/core.c:724 adfspart_check_POWERTEC+0x8a/0x630 block/partitions/acorn.c:451 check_partition block/partitions/core.c:143 [inline] blk_add_partitions block/partitions/core.c:591 [inline] bdev_disk_changed+0x7b1/0x1260 block/partitions/core.c:695 blkdev_get_whole+0x187/0x290 block/bdev.c:793 bdev_open+0x2c7/0xe40 block/bdev.c:1002 blkdev_open+0x34e/0x4f0 block/fops.c:679 do_dentry_open+0x6ab/0x14d0 fs/open.c:996 vfs_open+0x82/0x3f0 fs/open.c:1101 do_open fs/namei.c:4836 [inline] path_openat+0x1a23/0x2450 fs/namei.c:4999 do_file_open+0x20e/0x430 fs/namei.c:5028 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5659aa7407 RSP: 002b:00007fff92112120 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f565a24e880 RCX: 00007f5659aa7407 RDX: 00000000000a0800 RSI: 00005569ed799a50 RDI: ffffffffffffff9c RBP: 00005569ed780910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005569ed9fd0b0 R13: 00005569ed78e190 R14: 0000000000000000 R15: 00005569ed9fd0b0 Showing all locks held in the system: locks held by khungtaskd/45: 1, last CPU#2: #0: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871 locks held by kworker/1:2/1346: 3, on CPU#1: #0: ffff88801d0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000687fd08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff888027279250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x6330 drivers/net/netdevsim/fib.c:1490 locks held by getty/5541: 2, on CPU#3: #0: ffff888026d250a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000019b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 locks held by udevd/5827: 1, on CPU#1: #0: ffff888027f65350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:990 locks held by kworker/0:3/5959: 3, on CPU#0: #0: ffff88801d0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003217d08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff888014ec0250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x6330 drivers/net/netdevsim/fib.c:1490 locks held by kworker/u33:3/5978: 2, on CPU#3: #0: ffff88801d0e4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900032d7d08 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/1:6/6342: 3, on CPU#1: #0: ffff88801d0aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000c3dfd08 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff8fdf81b8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 kernel/rcu/tree.c:3904 locks held by kworker/u32:5/30629: 7, last CPU#0: #0: ffff88801e6a4940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90024867d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff91cc0048 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677 #3: ffff888025e89128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888025e89128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff888025e89128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x19e/0x370 net/devlink/core.c:581 #4: ffff8880152de258 (&devlink->lock_key#87){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:314 [inline] #4: ffff8880152de258 (&devlink->lock_key#87){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff8880152de258 (&devlink->lock_key#87){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x1b4/0x370 net/devlink/core.c:581 #5: ffffffff91cd8b80 (rtnl_mutex){+.+.}-{4:4}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1060 [inline] #5: ffffffff91cd8b80 (rtnl_mutex){+.+.}-{4:4}, at: nsim_create+0x9a2/0x1420 drivers/net/netdevsim/netdev.c:1154 #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #6: ffff88801e6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495 locks held by syz-executor/30257: 8, last CPU#1: #0: ffffffff8ff3cc90 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8ff3cc90 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline] #0: ffffffff8ff3cc90 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x5079/0x8430 kernel/fork.c:2321 #1: ffff88801d0cf180 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88801d0cf180 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716 #2: ffff888015223440 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff888015223440 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723 #3: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290 #4: ffff888014826c78 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #4: ffff888014826c78 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404 #5: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #5: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290 #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1354 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range mm/memory.c:1490 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pud_range mm/memory.c:1527 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_p4d_range mm/memory.c:1551 [inline] #6: ffff888028b9bb58 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_page_range+0xfd0/0x57c0 mm/memory.c:1637 #7: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #7: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #7: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x11d/0x580 mm/page_table_check.c:112 locks held by syz-executor/31557: 2, last CPU#3: #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: find_inlist_lock_noload net/bridge/netfilter/ebtables.c:331 [inline] #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: find_inlist_lock net/bridge/netfilter/ebtables.c:373 [inline] #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: find_table_lock net/bridge/netfilter/ebtables.c:382 [inline] #0: ffffffff91f2a4e0 (ebt_mutex){+.+.}-{4:4}, at: compat_do_ebt_get_ctl+0x12f/0xbb0 net/bridge/netfilter/ebtables.c:2431 #1: ffff88804401a9c8 (&xt[i].compat_mutex){+.+.}-{4:4}, at: compat_do_ebt_get_ctl+0x1cd/0xbb0 net/bridge/netfilter/ebtables.c:2435 locks held by modprobe/32022: 2, last CPU#2: #0: ffff8880150c6308 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x590 mm/mmap_lock.c:310 #1: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fdec3e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290 locks held by syz.0.53076/32025: 2, last CPU#1: #0: ffff888051b58240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #0: ffff888051b58240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:734 #1: ffffffff91d85208 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain kernel/notifier.c:379 [inline] #1: ffffffff91d85208 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x53/0xa0 kernel/notifier.c:368 ============================================= NMI backtrace for cpu 3 CPU: 3 UID: 0 PID: 45 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 3 to CPUs 0-2: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5962 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:lock_acquire kernel/locking/lockdep.c:5942 [inline] RIP: 0010:lock_acquire+0x176/0x380 kernel/locking/lockdep.c:5899 Code: 00 00 00 65 48 8b 05 d1 73 a6 13 8b 90 a4 0b 00 00 85 d2 0f 85 b0 00 00 00 9c 8f 04 24 fa 48 c7 c7 d6 7c 4d 8e e8 aa 8e eb 09 <45> 89 e8 44 89 f6 48 89 ef 65 48 8b 05 a1 73 a6 13 65 ff 05 5a ba RSP: 0018:ffffc900032374f8 EFLAGS: 00000086 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff8e4d7cd6 RDI: ffffffff8c625c80 RBP: ffffffff8fdec3e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000200 R11: 000000000001928e R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f565a24e880(0000) GS:ffff88809584a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7f2a190 CR3: 000000002606c000 CR4: 0000000000352ef0 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] class_rcu_constructor include/linux/rcupdate.h:1216 [inline] unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 slab_free_hook mm/slub.c:2709 [inline] slab_free mm/slub.c:6509 [inline] kmem_cache_free+0x424/0x6c0 mm/slub.c:6636 file_free fs/file_table.c:104 [inline] __fput_deferred+0x3e9/0x4a0 fs/file_table.c:568 fput_close+0x118/0x250 fs/file_table.c:630 path_openat+0xf77/0x2450 fs/namei.c:5008 do_file_open+0x20e/0x430 fs/namei.c:5028 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5659aa7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fff921096b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f565a24e880 RCX: 00007f5659aa7407 RDX: 0000000000080000 RSI: 00007fff92109830 RDI: ffffffffffffff9c RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005569b8d177f5 R13: 00005569b8d177f5 R14: 0000000000000001 R15: 00005569b8d32140 NMI backtrace for cpu 2 CPU: 2 UID: 0 PID: 5147 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__lock_pin_lock kernel/locking/lockdep.c:5671 [inline] RIP: 0010:lock_pin_lock kernel/locking/lockdep.c:6037 [inline] RIP: 0010:lock_pin_lock+0x62/0x150 kernel/locking/lockdep.c:6025 Code: 00 00 85 c9 0f 85 b1 00 00 00 49 89 fc 9c 41 5e fa 48 c7 c7 d6 7c 4d 8e e8 cb 10 ec 09 65 ff 05 8c 3c a7 13 8b 15 92 5f 5f 10 <85> d2 0f 84 b5 00 00 00 41 8b 85 a0 0b 00 00 85 c0 0f 8e 9a 00 00 RSP: 0018:ffffc90002d779f8 EFLAGS: 00000002 RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff8e4d7cd6 RDI: ffffffff8c625c80 RBP: 0000000000000000 R08: 0000000000000001 R09: fffff520005aef30 R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802b23c0a0 R13: ffff888026b60000 R14: 0000000000000046 R15: 000000cd5f538f4a FS: 00007f565a24e880(0000) GS:ffff88809594a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f31a83a7850 CR3: 000000004e536000 CR4: 0000000000352ef0 Call Trace: rq_pin_lock kernel/sched/sched.h:1937 [inline] rq_lock kernel/sched/sched.h:2016 [inline] __schedule+0x310/0x6920 kernel/sched/core.c:7158 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7376 schedule_hrtimeout_range_clock+0x213/0x310 kernel/time/sleep_timeout.c:216 ep_poll fs/eventpoll.c:2349 [inline] do_epoll_wait+0xfab/0x1730 fs/eventpoll.c:2829 __do_sys_epoll_wait fs/eventpoll.c:2837 [inline] __se_sys_epoll_wait fs/eventpoll.c:2832 [inline] __x64_sys_epoll_wait+0x194/0x290 fs/eventpoll.c:2832 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5659aa7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fff92112330 EFLAGS: 00000202 ORIG_RAX: 00000000000000e8 RAX: ffffffffffffffda RBX: 00007f565a24e880 RCX: 00007f5659aa7407 RDX: 0000000000000008 RSI: 00007fff92112490 RDI: 000000000000000b RBP: 00005569ed8f0600 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000bb8 R11: 0000000000000202 R12: 0000000000000000 R13: 00005569b8d32100 R14: 0000000000000169 R15: 0000000000000000 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:416 Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d e9 96 9a 24 06 e8 81 dc cd fc eb a0 e8 0a dd cd RSP: 0018:ffffc9000042f9e0 EFLAGS: 00000002 RAX: 0000000000000062 RBX: 00000000000003f8 RCX: 0000000000000000 RDX: 00000000000003f8 RSI: ffffffff85b10d15 RDI: ffffffff9cc6cba0 RBP: ffffffff9cc6cb60 R08: 0000000000000001 R09: 000000000000001f R10: 0000000000000000 R11: 2030206f68636522 R12: 0000000000000000 R13: 0000000000000062 R14: 000000000000000e R15: ffffc9000042fda8 FS: 0000000000000000(0000) GS:ffff88809574a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000ffa71014 CR3: 000000006ab97000 CR4: 0000000000352ef0 Call Trace: serial_port_out include/linux/serial_core.h:817 [inline] serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3287 [inline] __serial8250_console_fifo_write+0xd6/0x290 drivers/tty/serial/8250/8250_port.c:3359 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3432 [inline] serial8250_console_write+0x1108/0x14f0 drivers/tty/serial/8250/8250_port.c:3496 nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070 nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157 nbcon_kthread_func+0x613/0x7d0 kernel/printk/nbcon.c:1271 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245