Extracting prog: 7m30.838379661s
Minimizing prog: 1h12m36.243487392s
Simplifying prog options: 13m30.777230501s
Extracting C: 5m9.318358208s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
single: successfully extracted reproducer
found reproducer with 11 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-openat$loop_ctrl-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-socketpair$unix-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-getpid-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
getpid()
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-recvmmsg-openat$loop_ctrl-ioctl$LOOP_CTL_GET_FREE-ioctl$LOOP_CTL_REMOVE-bpf$PROG_BIND_MAP-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1)
bpf$PROG_BIND_MAP(0xa, 0x0, 0x0)
writev(0xffffffffffffffff, 0x0, 0x0)

program crashed: WARNING in blk_mq_free_tag_set
validation run: crashed=true
reproducing took 1h46m43.459601163s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x350/0x744 kernel/rcu/srcutree.c:708, CPU#0: syz.1.5983/11555
Modules linked in:
CPU: 0 UID: 0 PID: 11555 Comm: syz.1.5983 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : cleanup_srcu_struct+0x350/0x744 kernel/rcu/srcutree.c:708
lr : cleanup_srcu_struct+0x2f0/0x744 kernel/rcu/srcutree.c:706
sp : ffff800092947b50
x29: ffff800092947b80 x28: 1fffe0001b45ce5f x27: 1ffff000110bec4a
x26: dfff800000000000 x25: ffff800088a5a960 x24: ffffffffffffffff
x23: ffff80008e782ba0 x22: ffff0000da2e72f8 x21: fffffdffbf6d5900
x20: fffffdffbf6d5700 x19: 0000000000000000 x18: 1fffe00035bd9428
x17: 0000000000000003 x16: ffffffffffffffff x15: 0000000000000000
x14: 000000000097f043 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000000
x8 : 0000000000000003 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800080533194
x2 : 0000000000000001 x1 : ffff0000c70abb00 x0 : 0000000000000001
Call trace:
 cleanup_srcu_struct+0x350/0x744 kernel/rcu/srcutree.c:708 (P)
 blk_mq_free_tag_set+0x33c/0x438 block/blk-mq.c:4976
 loop_remove+0x4c/0xcc drivers/block/loop.c:2145
 loop_control_remove drivers/block/loop.c:2203 [inline]
 loop_control_ioctl+0x44c/0x510 drivers/block/loop.c:2245
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 3832
hardirqs last  enabled at (3831): [<ffff80008688206c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last  enabled at (3831): [<ffff80008688206c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (3832): [<ffff80008685dbf4>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (3678): [<ffff800084bb85e4>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (3676): [<ffff800084bb85cc>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (3676): [<ffff800084bb85cc>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x350/0x744 kernel/rcu/srcutree.c:708, CPU#0: syz.1.5983/11555
Modules linked in:
CPU: 0 UID: 0 PID: 11555 Comm: syz.1.5983 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : cleanup_srcu_struct+0x350/0x744 kernel/rcu/srcutree.c:708
lr : cleanup_srcu_struct+0x2f0/0x744 kernel/rcu/srcutree.c:706
sp : ffff800092947b50
x29: ffff800092947b80 x28: 1fffe0001b45ce5f x27: 1ffff000110bec4a
x26: dfff800000000000 x25: ffff800088a5a960 x24: ffffffffffffffff
x23: ffff80008e782ba0 x22: ffff0000da2e72f8 x21: fffffdffbf6d5900
x20: fffffdffbf6d5700 x19: 0000000000000000 x18: 1fffe00035bd9428
x17: 0000000000000003 x16: ffffffffffffffff x15: 0000000000000000
x14: 000000000097f043 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000000
x8 : 0000000000000003 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800080533194
x2 : 0000000000000001 x1 : ffff0000c70abb00 x0 : 0000000000000001
Call trace:
 cleanup_srcu_struct+0x350/0x744 kernel/rcu/srcutree.c:708 (P)
 blk_mq_free_tag_set+0x33c/0x438 block/blk-mq.c:4976
 loop_remove+0x4c/0xcc drivers/block/loop.c:2145
 loop_control_remove drivers/block/loop.c:2203 [inline]
 loop_control_ioctl+0x44c/0x510 drivers/block/loop.c:2245
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 3832
hardirqs last  enabled at (3831): [<ffff80008688206c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last  enabled at (3831): [<ffff80008688206c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (3832): [<ffff80008685dbf4>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (3678): [<ffff800084bb85e4>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (3676): [<ffff800084bb85cc>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (3676): [<ffff800084bb85cc>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---