Extracting prog: 4m48.551169765s Minimizing prog: 1h54m51.625453639s Simplifying prog options: 17m11.985621783s Extracting C: 5m11.875095312s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in cgroup_subtree_control_write single: successfully extracted reproducer found reproducer with 10 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000), 0x880) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x0, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, 0x0, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, 0x0, 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(0x0, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, 0x0, &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000), 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in cgroup_subtree_control_write extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in cgroup_subtree_control_write extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in cgroup_subtree_control_write validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in cgroup_subtree_control_write validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree-syz_usb_connect-syz_open_dev$ttys-pipe2$9p-mount$9p_fd detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x880) mount$9p_fd(0x0, &(0x7f0000000280)='./cgroup\x00', &(0x7f0000000340), 0x8401, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in cgroup_subtree_control_write validation run: crashed=true reproducing took 2h32m6.735267184s repro crashed as (corrupted=false): INFO: task syz.1.18:4979 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:0 pid:4979 tgid:4979 ppid:4945 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 cgroup_lock_and_drain_offline+0x490/0x604 kernel/cgroup/cgroup.c:3275 cgroup_kn_lock_live+0xbc/0x158 kernel/cgroup/cgroup.c:1715 cgroup_subtree_control_write+0x258/0x990 kernel/cgroup/cgroup.c:3577 cgroup_subtree_control_write+0x258/0x990 kernel/cgroup/cgroup.c:3577 cgroup_file_write+0x23c/0x6e4 kernel/cgroup/cgroup.c:4316 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 INFO: task syz.2.19:5017 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:0 pid:5017 tgid:5017 ppid:4981 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 cgroup_lock_and_drain_offline+0x490/0x604 kernel/cgroup/cgroup.c:3275 cgroup_kn_lock_live+0xbc/0x158 kernel/cgroup/cgroup.c:1715 cgroup_subtree_control_write+0x258/0x990 kernel/cgroup/cgroup.c:3577 cgroup_file_write+0x23c/0x6e4 kernel/cgroup/cgroup.c:4316 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffff800088cb6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffff800088cb6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffff800088cb6f20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 kernel/locking/lockdep.c:6775 2 locks held by pr/ttyAMA-1/41: 2 locks held by getty/4496: #0: ffff0000d12530a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff80009248b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x348/0xf78 drivers/tty/n_tty.c:2211 2 locks held by syz.1.18/4979: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000ce842c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.2.19/5017: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d962f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.3.20/5053: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d2f03c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.4.21/5099: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000cda36480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.5.22/5140: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d7063880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.6.23/5183: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000c8a36880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.7.24/5225: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d1814080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.8.25/5272: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000cb15c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.9.26/5315: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d7075480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.0.27/5351: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d93af880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.1.28/5387: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000f5b8cc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 ============================================= final repro crashed as (corrupted=false): INFO: task syz.1.18:4979 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:0 pid:4979 tgid:4979 ppid:4945 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 cgroup_lock_and_drain_offline+0x490/0x604 kernel/cgroup/cgroup.c:3275 cgroup_kn_lock_live+0xbc/0x158 kernel/cgroup/cgroup.c:1715 cgroup_subtree_control_write+0x258/0x990 kernel/cgroup/cgroup.c:3577 cgroup_subtree_control_write+0x258/0x990 kernel/cgroup/cgroup.c:3577 cgroup_file_write+0x23c/0x6e4 kernel/cgroup/cgroup.c:4316 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 INFO: task syz.2.19:5017 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:0 pid:5017 tgid:5017 ppid:4981 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 cgroup_lock_and_drain_offline+0x490/0x604 kernel/cgroup/cgroup.c:3275 cgroup_kn_lock_live+0xbc/0x158 kernel/cgroup/cgroup.c:1715 cgroup_subtree_control_write+0x258/0x990 kernel/cgroup/cgroup.c:3577 cgroup_file_write+0x23c/0x6e4 kernel/cgroup/cgroup.c:4316 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffff800088cb6f20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffff800088cb6f20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffff800088cb6f20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 kernel/locking/lockdep.c:6775 2 locks held by pr/ttyAMA-1/41: 2 locks held by getty/4496: #0: ffff0000d12530a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff80009248b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x348/0xf78 drivers/tty/n_tty.c:2211 2 locks held by syz.1.18/4979: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000ce842c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.2.19/5017: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d962f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.3.20/5053: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d2f03c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.4.21/5099: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000cda36480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.5.22/5140: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d7063880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.6.23/5183: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000c8a36880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.7.24/5225: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d1814080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.8.25/5272: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000cb15c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.9.26/5315: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d7075480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.0.27/5351: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d93af880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 2 locks held by syz.1.28/5387: #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d2f70450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000f5b8cc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 =============================================