Extracting prog: 37m29.31210271s Minimizing prog: 1h30m34.117598658s Simplifying prog options: 21m29.452964019s Extracting C: 7m4.026087462s Simplifying C: 0s extracting reproducer from 39 programs testing a last program of every proc single: executing 9 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-bind$auto-openat$auto_kernfs_file_fops_kernfs_internal-connect$auto-io_uring_setup$auto-bpf$auto-openat$auto_evdev_fops_evdev-open-fcntl$auto-open-fcntl$auto-openat$auto_vmuser_fops_vmci_host-ioctl$auto_IOCTL_VMCI_VERSION-openat$auto_posix_clock_file_operations_posix_clock-openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs-read$auto_blk_mq_debugfs_fops_blk_mq_debugfs-recvmmsg$auto-prctl$auto-ioctl$auto_USBDEVFS_CONTROL-select$auto-sendmmsg$auto-openat$auto_rtc_dev_fops_dev-io_uring_setup$auto-mlockall$auto-mlockall$auto-openat$auto_kernfs_file_fops_kernfs_internal detailed listing: executing program 0: mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x0) r0 = socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/ram2/partscan\x00', 0x80200, 0x0) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x50) io_uring_setup$auto(0x5b, &(0x7f0000000080)={0x7fffffff, 0xe, 0x2, 0x6, 0x5, 0x8, 0xffffffffffffffff, [], {0xd74c, 0x10000, 0x1, 0x29f, 0x100, 0xfff, 0x101, 0x6, 0x2}, {0xfb, 0x20000001, 0x10001, 0x7, 0x1, 0x40, 0x176c5, 0x400005, 0x100000005}}) bpf$auto(0x9, &(0x7f0000000180)=@bpf_attr_5={@target_fd, r1, 0x10000, 0x10, r2, @relative_fd=r0, 0x7f}, 0x6) openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000140)='/dev/input/event1\x00', 0x40000, 0x0) r3 = open(&(0x7f0000000140)='./file0\x00', 0x22240, 0x18d) fcntl$auto(r3, 0x400, 0x1) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) fcntl$auto(0x3, 0x400, 0x9ec0000000000000) r4 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000040), 0x8040, 0x0) ioctl$auto_IOCTL_VMCI_VERSION(r4, 0x79f, 0x4) openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000005280), 0x0, 0x0) r5 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/block/loop9/hctx0/active\x00', 0x800, 0x0) read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r5, &(0x7f00000002c0)=""/243, 0xf3) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) r6 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$auto_USBDEVFS_CONTROL(r6, 0xc0185500, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0xe8, 0x9, 0xffffffffffffffff, 0x1, 0x5, 0x4, 0x15f4da0e, 0x8, 0x9, 0x100000000000000c, 0x8, 0x1, 0xfca, 0x9, 0x2, 0x4000000000000d]}, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, 0x0, 0x88000, 0x0) io_uring_setup$auto(0xa, 0x0) mlockall$auto(0x3) mlockall$auto(0x7) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x400, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-mmap$auto-bind$auto-io_uring_setup$auto-write$auto_fops_init_pkru_pkeys-sendmmsg$auto-mmap$auto-bpf$auto-mmap$auto-sendmsg$auto_NL80211_CMD_GET_REG-openat$auto_uinput_fops_uinput-socket-sendmsg$auto_HWSIM_CMD_NEW_RADIO-socket$nl_generic-syz_genetlink_get_family_id$auto_ovs_vport-sendmsg$auto_OVS_VPORT_CMD_DEL-socket-setsockopt$auto-futex_waitv$auto-sendmsg$auto_NL80211_CMD_GET_REG-sendmmsg$auto-prctl$auto-recvmmsg$auto-syz_genetlink_get_family_id$auto_nl80211-sendmsg$auto_NL80211_CMD_GET_REG detailed listing: executing program 0: r0 = socket(0x2, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) r1 = io_uring_setup$auto(0x1, 0x0) write$auto_fops_init_pkru_pkeys(r1, 0x0, 0x0) sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x10000}, 0x7, 0x0, 0x5, 0xb}, 0xfff}, 0x8, 0x311) mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000) r2 = bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x280801, 0x0) socket(0x10, 0x2, 0x7) sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010026bd7000ffdbdf250400000014001a80ffff04800c0001"], 0x28}, 0x1, 0x0, 0x0, 0x891}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_ovs_vport(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_OVS_VPORT_CMD_DEL(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x1c, r4, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@OVS_VPORT_ATTR_NAME={0x5, 0x3, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48801}, 0x4000000) r5 = socket(0x15, 0x5, 0x0) setsockopt$auto(r5, 0x114, 0x6, 0x0, 0x8000002) futex_waitv$auto(&(0x7f0000000000)={0xf, 0x5d94, 0x4002, 0x4}, 0x77, 0xfffffffc, 0x0, 0x62bd) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1c003b", @ANYRES8], 0x1ac}, 0x1, 0x0, 0x0, 0x800}, 0x40000) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x4ff, 0x0) r6 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), r3) sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x18, r6, 0x200, 0xbf, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_SELF_MANAGED_REG={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x22040841}, 0x20008000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-mmap$auto-bind$auto-io_uring_setup$auto-write$auto_fops_init_pkru_pkeys-sendmmsg$auto-mmap$auto-bpf$auto-mmap$auto-sendmsg$auto_NL80211_CMD_GET_REG-openat$auto_uinput_fops_uinput-socket-sendmsg$auto_HWSIM_CMD_NEW_RADIO-socket$nl_generic-syz_genetlink_get_family_id$auto_ovs_vport-sendmsg$auto_OVS_VPORT_CMD_DEL-socket-setsockopt$auto-futex_waitv$auto-sendmsg$auto_NL80211_CMD_GET_REG-sendmmsg$auto-prctl$auto-recvmmsg$auto-syz_genetlink_get_family_id$auto_nl80211-sendmsg$auto_NL80211_CMD_GET_REG detailed listing: executing program 0: r0 = socket(0x2, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) r1 = io_uring_setup$auto(0x1, 0x0) write$auto_fops_init_pkru_pkeys(r1, 0x0, 0x0) sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, &(0x7f00000000c0)={0x0, 0x10000}, 0x7, 0x0, 0x5, 0xb}, 0xfff}, 0x8, 0x311) mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000) r2 = bpf$auto(0x0, &(0x7f0000000780)=@link_update={0xa, @new_map_fd=0x5, 0x4007, @old_prog_fd=0x13b}, 0xa3) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x280801, 0x0) socket(0x10, 0x2, 0x7) sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010026bd7000ffdbdf250400000014001a80ffff04800c0001"], 0x28}, 0x1, 0x0, 0x0, 0x891}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_ovs_vport(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_OVS_VPORT_CMD_DEL(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x1c, r4, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@OVS_VPORT_ATTR_NAME={0x5, 0x3, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48801}, 0x4000000) r5 = socket(0x15, 0x5, 0x0) setsockopt$auto(r5, 0x114, 0x6, 0x0, 0x8000002) futex_waitv$auto(&(0x7f0000000000)={0xf, 0x5d94, 0x4002, 0x4}, 0x77, 0xfffffffc, 0x0, 0x62bd) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1c003b", @ANYRES8], 0x1ac}, 0x1, 0x0, 0x0, 0x800}, 0x40000) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1c03, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x4ff, 0x0) r6 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), r3) sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x18, r6, 0x200, 0xbf, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_SELF_MANAGED_REG={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x22040841}, 0x20008000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-mmap$auto-close_range$auto-socket-socket-ioctl$auto_VHOST_GET_BACKEND_FEATURES-bind$auto-socket-syz_genetlink_get_family_id$auto_nfsd-socket-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_snd_rawmidi_f_ops_rawmidi-prctl$auto-write$auto-setsockopt$auto_SO_BROADCAST-socket-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_kernfs_file_fops_kernfs_internal-migrate_pages$auto-mmap$auto-mmap$auto-prctl$auto-madvise$auto-syz_genetlink_get_family_id$auto_ethtool-connect$auto-sendmsg$auto_NL80211_CMD_GET_REG-sendmsg$auto_NL802154_CMD_SET_PAN_ID-sendmsg$auto_NL80211_CMD_GET_REG detailed listing: executing program 0: mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) socket(0x10, 0x2, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) r0 = socket(0xa, 0x801, 0x84) ioctl$auto_VHOST_GET_BACKEND_FEATURES(0xffffffffffffffff, 0x8008af26, &(0x7f00000000c0)=0x5) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) r1 = socket(0x1d, 0x2, 0x2) syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000040), r1) socket(0x10, 0x2, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x189002, 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) setsockopt$auto_SO_BROADCAST(r0, 0x9, 0x6, &(0x7f0000000180)='\x00', 0x2) socket(0x2b, 0x1, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/bus/netdevsim/del_device\x00', 0x501, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f0000000040)="3290b800009c550d22350f737ca2dd0af0d849aec832ec49c034169af8fa9231c143b1a8dd292977588a83400445ddc508f3aef64488936413adba3a9cc99bdfd8e7000000", 0x45) migrate_pages$auto(0x0, 0xa, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x202000a, 0xffffffff, 0xdc, 0xfffffffffffffffa, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @loopback}, 0x54) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYRES16, @ANYBLOB="010027bd7000fddbdf250a00050007"], 0x24}, 0x1, 0x0, 0x0, 0x4008}, 0x20000010) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1c003b"], 0x1ac}, 0x1, 0x0, 0x0, 0x40c0}, 0x40810) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$auto-socket-mmap$auto-close_range$auto-socket-socket-ioctl$auto_VHOST_GET_BACKEND_FEATURES-bind$auto-socket-syz_genetlink_get_family_id$auto_nfsd-socket-openat$auto_kernfs_file_fops_kernfs_internal-openat$auto_snd_rawmidi_f_ops_rawmidi-prctl$auto-write$auto-setsockopt$auto_SO_BROADCAST-socket-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_kernfs_file_fops_kernfs_internal-migrate_pages$auto-mmap$auto-mmap$auto-prctl$auto-madvise$auto-syz_genetlink_get_family_id$auto_ethtool-connect$auto-sendmsg$auto_NL80211_CMD_GET_REG-sendmsg$auto_NL802154_CMD_SET_PAN_ID-sendmsg$auto_NL80211_CMD_GET_REG detailed listing: executing program 0: mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) socket(0x10, 0x2, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) r0 = socket(0xa, 0x801, 0x84) ioctl$auto_VHOST_GET_BACKEND_FEATURES(0xffffffffffffffff, 0x8008af26, &(0x7f00000000c0)=0x5) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) r1 = socket(0x1d, 0x2, 0x2) syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000040), r1) socket(0x10, 0x2, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x189002, 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) setsockopt$auto_SO_BROADCAST(r0, 0x9, 0x6, &(0x7f0000000180)='\x00', 0x2) socket(0x2b, 0x1, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/bus/netdevsim/del_device\x00', 0x501, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f0000000040)="3290b800009c550d22350f737ca2dd0af0d849aec832ec49c034169af8fa9231c143b1a8dd292977588a83400445ddc508f3aef64488936413adba3a9cc99bdfd8e7000000", 0x45) migrate_pages$auto(0x0, 0xa, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x202000a, 0xffffffff, 0xdc, 0xfffffffffffffffa, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @loopback}, 0x54) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYRES16, @ANYBLOB="010027bd7000fddbdf250a00050007"], 0x24}, 0x1, 0x0, 0x0, 0x4008}, 0x20000010) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1c003b"], 0x1ac}, 0x1, 0x0, 0x0, 0x40c0}, 0x40810) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto-mmap$auto-close_range$auto-socketpair$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_nbd-sendmsg$auto_NBD_CMD_CONNECT detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) program crashed: INFO: task hung in remove_one single: successfully extracted reproducer found reproducer with 15 syscalls minimizing guilty program testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto-mmap$auto-close_range$auto-socketpair$auto-socket$nl_generic-syz_genetlink_get_family_id$auto_nbd detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto-mmap$auto-close_range$auto-socketpair$auto-socket$nl_generic detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto-mmap$auto-close_range$auto-socketpair$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto-mmap$auto-close_range$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto-mmap$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto_ocfs2_control_fops_stack_user detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r1, &(0x7f0000003900)='\t', 0x1) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-openat$auto_kernfs_file_fops_kernfs_internal-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xa0002, 0x0) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r1, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-write$auto_seq_oss_f_ops_seq_oss-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) write$auto(0xffffffffffffffff, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program did not crash testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_seq_oss_f_ops_seq_oss-openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-bind$auto-openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_generic-openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: socket(0x10, 0x2, 0x0) r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, 0x0, 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program did not crash testing program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, 0x0, 0x1dd) program did not crash extracting C reproducer testing compiled C program (duration=8m13.429476006s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=8m13.429476006s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one extracting C reproducer testing compiled C program (duration=8m13.429476006s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=8m13.429476006s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program did not crash testing program (duration=8m13.429476006s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one validation run: crashed=true testing program (duration=8m13.429476006s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one validation run: crashed=true testing program (duration=8m13.429476006s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$auto_nsim_dev_health_break_fops_health-write$auto detailed listing: executing program 0: r0 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) write$auto(r0, &(0x7f00000000c0)='\xff\xff\xff\xff\x00\"\x03\xcd\x1b\x96\"\x9b\'\xcc\x16I)\fi-\x82\xed\x95\xb4\xf9\x95', 0x1dd) program crashed: INFO: task hung in remove_one validation run: crashed=true reproducing took 2h50m21.08796139s repro crashed as (corrupted=false): INFO: task kworker/u8:2:35 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:2 state:D stack:22616 pid:35 tgid:35 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 __debugfs_file_removed fs/debugfs/inode.c:751 [inline] remove_one+0x312/0x420 fs/debugfs/inode.c:758 __simple_recursive_removal+0x148/0x5c0 fs/libfs.c:624 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 nsim_dev_health_exit+0x3b/0xe0 drivers/net/netdevsim/health.c:227 nsim_dev_reload_destroy+0x144/0x4a0 drivers/net/netdevsim/dev.c:1788 nsim_dev_reload_down+0x66/0xd0 drivers/net/netdevsim/dev.c:1038 devlink_reload+0x1ae/0x7a0 net/devlink/dev.c:462 devlink_pernet_pre_exit+0x247/0x370 net/devlink/core.c:558 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0xab0 net/core/net_namespace.c:234 cleanup_net+0x499/0x920 net/core/net_namespace.c:702 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302 process_scheduled_works kernel/workqueue.c:3385 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz-executor:8942 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:24168 pid:8942 tgid:8942 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 __mutex_lock_common kernel/locking/mutex.c:712 [inline] __mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:806 device_lock include/linux/device.h:1040 [inline] device_del+0xa0/0x9b0 drivers/base/core.c:3857 device_unregister+0x1d/0xe0 drivers/base/core.c:3936 nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline] del_device_store+0x346/0x480 drivers/net/netdevsim/bus.c:244 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:142 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9a615d04e RSP: 002b:00007ffed17f8e88 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055555e1bd500 RCX: 00007ff9a615d04e RDX: 0000000000000001 RSI: 00007ffed17f8f10 RDI: 0000000000000005 RBP: 00007ff9a6233514 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffed17f8f10 R14: 00007ff9a6f44620 R15: 0000000000000003 INFO: task syz.3.2850:8954 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2850 state:D stack:27608 pid:8954 tgid:8954 ppid:5991 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 __mutex_lock_common kernel/locking/mutex.c:712 [inline] __mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:806 devlink_health_report+0x66c/0xb20 net/devlink/health.c:680 nsim_dev_health_break_write+0x166/0x210 drivers/net/netdevsim/health.c:162 full_proxy_write+0x135/0x1a0 fs/debugfs/file.c:388 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8cb619c819 RSP: 002b:00007ffd14980d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f8cb6415fa0 RCX: 00007f8cb619c819 RDX: 00000000000001dd RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007f8cb6232c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8cb6415fac R14: 00007f8cb6415fa0 R15: 00007f8cb6415fa0 INFO: task syz.1.2877:8982 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.2877 state:D stack:28104 pid:8982 tgid:8982 ppid:5993 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 rwsem_down_read_slowpath+0x5af/0xb40 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0xed/0x450 kernel/locking/rwsem.c:1570 inode_lock_shared include/linux/fs.h:1044 [inline] open_last_lookups fs/namei.c:4610 [inline] path_openat+0xa16/0x31a0 fs/namei.c:4855 do_file_open+0x20e/0x430 fs/namei.c:4887 do_sys_openat2+0x10d/0x1e0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f014439c819 RSP: 002b:00007ffe888802a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f0144615fa0 RCX: 00007f014439c819 RDX: 0000000000048081 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f0144432c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0144615fac R14: 00007f0144615fa0 R15: 00007f0144615fa0 INFO: task syz.0.2878:8983 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2878 state:D stack:27888 pid:8983 tgid:8983 ppid:8490 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 rwsem_down_read_slowpath+0x5af/0xb40 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0xed/0x450 kernel/locking/rwsem.c:1570 inode_lock_shared include/linux/fs.h:1044 [inline] open_last_lookups fs/namei.c:4610 [inline] path_openat+0xa16/0x31a0 fs/namei.c:4855 do_file_open+0x20e/0x430 fs/namei.c:4887 do_sys_openat2+0x10d/0x1e0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f717fd9c819 RSP: 002b:00007ffedcad5688 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f7180015fa0 RCX: 00007f717fd9c819 RDX: 0000000000048081 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f717fe32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7180015fac R14: 00007f7180015fa0 R15: 00007f7180015fa0 Showing all locks held in the system: 2 locks held by kworker/u8:0/12: 1 lock held by khungtaskd/30: #0: ffffffff8e7e5260 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e7e5260 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e7e5260 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 6 locks held by kworker/u8:2/35: #0: ffff88801c6be140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc90000ab7d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 #2: ffffffff90619a48 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:673 #3: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline] #3: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x19e/0x370 net/devlink/core.c:555 #4: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline] #4: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x1b4/0x370 net/devlink/core.c:555 #5: ffff888057e74618 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1074 [inline] #5: ffff888057e74618 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0xe0/0x5c0 fs/libfs.c:620 2 locks held by getty/5602: #0: ffff888039e8f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211 5 locks held by syz-executor/8942: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888077a19880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 #4: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline] #4: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: device_del+0xa0/0x9b0 drivers/base/core.c:3857 2 locks held by syz.3.2850/8954: #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_health_report+0x66c/0xb20 net/devlink/health.c:680 2 locks held by syz.1.2877/8982: #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:4600 [inline] #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x9b1/0x31a0 fs/namei.c:4855 #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1044 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: open_last_lookups fs/namei.c:4610 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0xa16/0x31a0 fs/namei.c:4855 2 locks held by syz.0.2878/8983: #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:4600 [inline] #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x9b1/0x31a0 fs/namei.c:4855 #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1044 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: open_last_lookups fs/namei.c:4610 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0xa16/0x31a0 fs/namei.c:4855 4 locks held by syz-executor/9003: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807aeb1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9004: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88802df89c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9008: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807bd70080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9038: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807ae25480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9057: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807b89f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9060: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807573c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9063: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88806be73880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9087: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88802c45e080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9100: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888034724c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9105: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807761f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9106: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888058a5b080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 1162 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:PagePoisoned include/linux/page-flags.h:329 [inline] RIP: 0010:PageReserved include/linux/page-flags.h:569 [inline] RIP: 0010:__text_poke+0x150/0xae0 arch/x86/kernel/alternative.c:2568 Code: 06 80 3c 02 00 0f 85 21 09 00 00 48 03 1d 08 ea 72 0c 48 b8 00 00 00 00 00 fc ff df 48 89 da 49 89 dd 48 c1 ea 03 80 3c 02 00 <0f> 85 0d 09 00 00 4c 8b 33 48 c7 c7 ff ff ff ff 4c 89 f6 e8 88 ac RSP: 0018:ffffc90005a8f910 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffea000009a840 RCX: ffffffff81ad14fd RDX: 1ffffd4000013508 RSI: ffffffff81ad150a RDI: ffffffff826a1446 RBP: ffffffff826a1446 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000447 R13: ffffea000009a840 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8881243e2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005613014e8d08 CR3: 000000000e596000 CR4: 00000000003526f0 Call Trace: smp_text_poke_batch_finish+0x6b5/0xc60 arch/x86/kernel/alternative.c:3061 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x37a/0x550 kernel/jump_label.c:910 static_key_enable_cpuslocked+0x1bc/0x270 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 toggle_allocation_gate mm/kfence/core.c:906 [inline] toggle_allocation_gate+0xfe/0x2d0 mm/kfence/core.c:898 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302 process_scheduled_works kernel/workqueue.c:3385 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/u8:2:35 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:2 state:D stack:22616 pid:35 tgid:35 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 __debugfs_file_removed fs/debugfs/inode.c:751 [inline] remove_one+0x312/0x420 fs/debugfs/inode.c:758 __simple_recursive_removal+0x148/0x5c0 fs/libfs.c:624 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 nsim_dev_health_exit+0x3b/0xe0 drivers/net/netdevsim/health.c:227 nsim_dev_reload_destroy+0x144/0x4a0 drivers/net/netdevsim/dev.c:1788 nsim_dev_reload_down+0x66/0xd0 drivers/net/netdevsim/dev.c:1038 devlink_reload+0x1ae/0x7a0 net/devlink/dev.c:462 devlink_pernet_pre_exit+0x247/0x370 net/devlink/core.c:558 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0xab0 net/core/net_namespace.c:234 cleanup_net+0x499/0x920 net/core/net_namespace.c:702 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302 process_scheduled_works kernel/workqueue.c:3385 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz-executor:8942 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:24168 pid:8942 tgid:8942 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 __mutex_lock_common kernel/locking/mutex.c:712 [inline] __mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:806 device_lock include/linux/device.h:1040 [inline] device_del+0xa0/0x9b0 drivers/base/core.c:3857 device_unregister+0x1d/0xe0 drivers/base/core.c:3936 nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline] del_device_store+0x346/0x480 drivers/net/netdevsim/bus.c:244 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:142 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9a615d04e RSP: 002b:00007ffed17f8e88 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055555e1bd500 RCX: 00007ff9a615d04e RDX: 0000000000000001 RSI: 00007ffed17f8f10 RDI: 0000000000000005 RBP: 00007ff9a6233514 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffed17f8f10 R14: 00007ff9a6f44620 R15: 0000000000000003 INFO: task syz.3.2850:8954 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2850 state:D stack:27608 pid:8954 tgid:8954 ppid:5991 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 __mutex_lock_common kernel/locking/mutex.c:712 [inline] __mutex_lock+0xced/0x1b10 kernel/locking/mutex.c:806 devlink_health_report+0x66c/0xb20 net/devlink/health.c:680 nsim_dev_health_break_write+0x166/0x210 drivers/net/netdevsim/health.c:162 full_proxy_write+0x135/0x1a0 fs/debugfs/file.c:388 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8cb619c819 RSP: 002b:00007ffd14980d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f8cb6415fa0 RCX: 00007f8cb619c819 RDX: 00000000000001dd RSI: 00002000000000c0 RDI: 0000000000000003 RBP: 00007f8cb6232c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8cb6415fac R14: 00007f8cb6415fa0 R15: 00007f8cb6415fa0 INFO: task syz.1.2877:8982 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.2877 state:D stack:28104 pid:8982 tgid:8982 ppid:5993 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 rwsem_down_read_slowpath+0x5af/0xb40 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0xed/0x450 kernel/locking/rwsem.c:1570 inode_lock_shared include/linux/fs.h:1044 [inline] open_last_lookups fs/namei.c:4610 [inline] path_openat+0xa16/0x31a0 fs/namei.c:4855 do_file_open+0x20e/0x430 fs/namei.c:4887 do_sys_openat2+0x10d/0x1e0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f014439c819 RSP: 002b:00007ffe888802a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f0144615fa0 RCX: 00007f014439c819 RDX: 0000000000048081 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f0144432c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0144615fac R14: 00007f0144615fa0 R15: 00007f0144615fa0 INFO: task syz.0.2878:8983 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2878 state:D stack:27888 pid:8983 tgid:8983 ppid:8490 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5387 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7188 __schedule_loop kernel/sched/core.c:7267 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7282 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7339 rwsem_down_read_slowpath+0x5af/0xb40 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0xed/0x450 kernel/locking/rwsem.c:1570 inode_lock_shared include/linux/fs.h:1044 [inline] open_last_lookups fs/namei.c:4610 [inline] path_openat+0xa16/0x31a0 fs/namei.c:4855 do_file_open+0x20e/0x430 fs/namei.c:4887 do_sys_openat2+0x10d/0x1e0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f717fd9c819 RSP: 002b:00007ffedcad5688 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f7180015fa0 RCX: 00007f717fd9c819 RDX: 0000000000048081 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f717fe32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7180015fac R14: 00007f7180015fa0 R15: 00007f7180015fa0 Showing all locks held in the system: 2 locks held by kworker/u8:0/12: 1 lock held by khungtaskd/30: #0: ffffffff8e7e5260 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e7e5260 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e7e5260 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 6 locks held by kworker/u8:2/35: #0: ffff88801c6be140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc90000ab7d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 #2: ffffffff90619a48 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:673 #3: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline] #3: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x19e/0x370 net/devlink/core.c:555 #4: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline] #4: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x1b4/0x370 net/devlink/core.c:555 #5: ffff888057e74618 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1074 [inline] #5: ffff888057e74618 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0xe0/0x5c0 fs/libfs.c:620 2 locks held by getty/5602: #0: ffff888039e8f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211 5 locks held by syz-executor/8942: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888077a19880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 #4: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline] #4: ffff888059bda128 (&dev->mutex){....}-{4:4}, at: device_del+0xa0/0x9b0 drivers/base/core.c:3857 2 locks held by syz.3.2850/8954: #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888059b3b258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_health_report+0x66c/0xb20 net/devlink/health.c:680 2 locks held by syz.1.2877/8982: #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:4600 [inline] #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x9b1/0x31a0 fs/namei.c:4855 #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1044 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: open_last_lookups fs/namei.c:4610 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0xa16/0x31a0 fs/namei.c:4855 2 locks held by syz.0.2878/8983: #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:4600 [inline] #0: ffff8880202a0410 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x9b1/0x31a0 fs/namei.c:4855 #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1044 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: open_last_lookups fs/namei.c:4610 [inline] #1: ffff888057e74618 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0xa16/0x31a0 fs/namei.c:4855 4 locks held by syz-executor/9003: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807aeb1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9004: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88802df89c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9008: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807bd70080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9038: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807ae25480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9057: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807b89f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9060: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807573c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9063: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88806be73880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9087: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88802c45e080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9100: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888034724c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9105: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff88807761f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/9106: #0: ffff888036db0410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888058a5b080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88802aeef788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb82340 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 1162 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:PagePoisoned include/linux/page-flags.h:329 [inline] RIP: 0010:PageReserved include/linux/page-flags.h:569 [inline] RIP: 0010:__text_poke+0x150/0xae0 arch/x86/kernel/alternative.c:2568 Code: 06 80 3c 02 00 0f 85 21 09 00 00 48 03 1d 08 ea 72 0c 48 b8 00 00 00 00 00 fc ff df 48 89 da 49 89 dd 48 c1 ea 03 80 3c 02 00 <0f> 85 0d 09 00 00 4c 8b 33 48 c7 c7 ff ff ff ff 4c 89 f6 e8 88 ac RSP: 0018:ffffc90005a8f910 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffea000009a840 RCX: ffffffff81ad14fd RDX: 1ffffd4000013508 RSI: ffffffff81ad150a RDI: ffffffff826a1446 RBP: ffffffff826a1446 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000447 R13: ffffea000009a840 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8881243e2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005613014e8d08 CR3: 000000000e596000 CR4: 00000000003526f0 Call Trace: smp_text_poke_batch_finish+0x6b5/0xc60 arch/x86/kernel/alternative.c:3061 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 jump_label_update+0x37a/0x550 kernel/jump_label.c:910 static_key_enable_cpuslocked+0x1bc/0x270 kernel/jump_label.c:210 static_key_enable+0x1a/0x20 kernel/jump_label.c:223 toggle_allocation_gate mm/kfence/core.c:906 [inline] toggle_allocation_gate+0xfe/0x2d0 mm/kfence/core.c:898 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302 process_scheduled_works kernel/workqueue.c:3385 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245