Extracting prog: 2m19.662575565s
Minimizing prog: 55m45.074513998s
Simplifying prog options: 9m39.719805455s
Extracting C: 1m21.348858241s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program crashed: BUG: soft lockup in sys_sendmsg
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
sendmsg$tipc(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
sendmsg$tipc(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, 0x0)
sendmsg$tipc(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, 0x0, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
program crashed: BUG: soft lockup in sock_setsockopt
a never seen crash title: BUG: soft lockup in sock_setsockopt, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4)

program crashed: BUG: soft lockup in sys_sendmsg
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$tipc-setsockopt$sock_attach_bpf
program crashed: BUG: soft lockup in sock_setsockopt
a never seen crash title: BUG: soft lockup in sock_setsockopt, ignore
reproducing took 1h8m54.583152396s
repro crashed as (corrupted=false):
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz.0.519:5710]
Modules linked in:
irq event stamp: 5323
hardirqs last  enabled at (5322): [<ffff800011b4d490>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline]
hardirqs last  enabled at (5322): [<ffff800011b4d490>] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91
hardirqs last disabled at (5323): [<ffff800011b4d6d8>] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227
softirqs last  enabled at (560): [<ffff80000ff001b8>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last  enabled at (560): [<ffff80000ff001b8>] release_sock+0x1e4/0x270 net/core/sock.c:3279
softirqs last disabled at (566): [<ffff80000ff135f0>] spin_lock_bh include/linux/spinlock.h:368 [inline]
softirqs last disabled at (566): [<ffff80000ff135f0>] lock_sock_nested+0x108/0x1ec net/core/sock.c:3256
CPU: 0 PID: 5710 Comm: syz.0.519 Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382
lr : queued_spin_lock_slowpath+0x16c/0x938 kernel/locking/qspinlock.c:382
sp : ffff800020c775e0
x29: ffff800020c77680 x28: 1ffff0000418eec8 x27: 1fffe00019fec8d2
x26: dfff800000000000 x25: ffff70000418eec0 x24: ffff800020c77600
x23: 1fffe00019fec8d1 x22: ffff800020c77640 x21: 0000000000000001
x20: 0000000000000001 x19: ffff0000cff64688 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008305360 x15: 000000000000000a
x14: 1ffff0000296e06c x13: dfff800000000000 x12: 0000000000000001
x11: 1fffe00019fec8d1 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000101 x7 : ffff80000ff135f0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008304588
x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
 __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline]
 __cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline]
 queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
 _raw_spin_lock_bh+0x12c/0x1c4 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:368 [inline]
 lock_sock_nested+0x108/0x1ec net/core/sock.c:3256
 lock_sock include/net/sock.h:1684 [inline]
 tipc_sendstream+0x50/0x84 net/tipc/socket.c:1549
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2436
 ___sys_sendmsg+0x214/0x294 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1ac/0x25c net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

final repro crashed as (corrupted=false):
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz.0.519:5710]
Modules linked in:
irq event stamp: 5323
hardirqs last  enabled at (5322): [<ffff800011b4d490>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline]
hardirqs last  enabled at (5322): [<ffff800011b4d490>] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91
hardirqs last disabled at (5323): [<ffff800011b4d6d8>] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227
softirqs last  enabled at (560): [<ffff80000ff001b8>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last  enabled at (560): [<ffff80000ff001b8>] release_sock+0x1e4/0x270 net/core/sock.c:3279
softirqs last disabled at (566): [<ffff80000ff135f0>] spin_lock_bh include/linux/spinlock.h:368 [inline]
softirqs last disabled at (566): [<ffff80000ff135f0>] lock_sock_nested+0x108/0x1ec net/core/sock.c:3256
CPU: 0 PID: 5710 Comm: syz.0.519 Not tainted 5.15.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382
lr : queued_spin_lock_slowpath+0x16c/0x938 kernel/locking/qspinlock.c:382
sp : ffff800020c775e0
x29: ffff800020c77680 x28: 1ffff0000418eec8 x27: 1fffe00019fec8d2
x26: dfff800000000000 x25: ffff70000418eec0 x24: ffff800020c77600
x23: 1fffe00019fec8d1 x22: ffff800020c77640 x21: 0000000000000001
x20: 0000000000000001 x19: ffff0000cff64688 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800008305360 x15: 000000000000000a
x14: 1ffff0000296e06c x13: dfff800000000000 x12: 0000000000000001
x11: 1fffe00019fec8d1 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000101 x7 : ffff80000ff135f0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008304588
x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001
Call trace:
 __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline]
 __cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline]
 queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
 _raw_spin_lock_bh+0x12c/0x1c4 kernel/locking/spinlock.c:178
 spin_lock_bh include/linux/spinlock.h:368 [inline]
 lock_sock_nested+0x108/0x1ec net/core/sock.c:3256
 lock_sock include/net/sock.h:1684 [inline]
 tipc_sendstream+0x50/0x84 net/tipc/socket.c:1549
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2436
 ___sys_sendmsg+0x214/0x294 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1ac/0x25c net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584