Extracting prog: 1m28.277289449s
Minimizing prog: 12m51.446162898s
Simplifying prog options: 0s
Extracting C: 29.405037592s
Simplifying C: 4m46.667436212s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300))
syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r6=>0x0)
syz_ublk_setup_queues(0xffffffffffffffff, r6, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r5, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
r1 = syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2)
syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r0}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, 0x0, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r3=>0x0)
r4 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r1, 0x2)
syz_ublk_setup_queues(r4, r3, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r4, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r2, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r0}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r5, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, 0x0, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), 0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, 0x0, r2, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r5, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, 0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r5, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, 0x0)
r4 = syz_ublk_add_dev(r1, r2, r3, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r5, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, 0x0, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r0}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, 0x0, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, 0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, 0x0, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(0x0, r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, 0x0, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, 0x0, 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000180), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=<r7=>0x0)
r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r8, r7, &(0x7f0000000340)={0x0, 0x7193, 0x400, 0x2, 0x219}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x4000002, 0x30c, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1887, 0x40, 0x10003, 0x393}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x8, 0x1, 0xc5, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7a, 0x44, 0x0, 0x20a, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x50, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r6, '\x00', {0x4, 0xe52, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
reproducing took 21m36.836947964s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 12 at drivers/block/ublk_drv.c:1583 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 75cf1182868b3cd79cf46cb8e3663149a2f402b8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Code: 5d c3 cc cc cc cc cc e8 0d 5f 32 fe 0f 0b eb e3 e8 04 5f 32 fe 0f 0b eb da e8 fb 5e 32 fe 0f 0b e9 4d fe ff ff e8 ef 5e 32 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc900000c7990 EFLAGS: 00010293
RAX: ffffffff8356f011 RBX: 1ffff11022a01805 RCX: ffff8881026513c0
RDX: 0000000000000000 RSI: 000000000000009f RDI: 0000000000000104
RBP: ffffc900000c79e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff8356dff0 R12: ffff888113d493c0
R13: ffff88811500c000 R14: ffff8881153b4000 R15: ffff8881153b4010
FS:  0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000007caa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1979
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 12 at drivers/block/ublk_drv.c:1583 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 75cf1182868b3cd79cf46cb8e3663149a2f402b8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Code: 5d c3 cc cc cc cc cc e8 0d 5f 32 fe 0f 0b eb e3 e8 04 5f 32 fe 0f 0b eb da e8 fb 5e 32 fe 0f 0b e9 4d fe ff ff e8 ef 5e 32 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc900000c7990 EFLAGS: 00010293
RAX: ffffffff8356f011 RBX: 1ffff11022a01805 RCX: ffff8881026513c0
RDX: 0000000000000000 RSI: 000000000000009f RDI: 0000000000000104
RBP: ffffc900000c79e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff8356dff0 R12: ffff888113d493c0
R13: ffff88811500c000 R14: ffff8881153b4000 R15: ffff8881153b4010
FS:  0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000007caa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1979
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---