Extracting prog: 35m12.977420844s
Minimizing prog: 1h21m6.01591702s
Simplifying prog options: 6m40.206954358s
Extracting C: 3m9.482701512s
Simplifying C: 18m31.029305054s


extracting reproducer from 34 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$cgroup_ro-mmap-mmap-getsockopt$inet_mreqn-prlimit64-prlimit64-getpid-sched_setscheduler-sched_setscheduler-ptrace$setregset-sched_setscheduler-getpgrp-getpgrp-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sched_setaffinity-sched_setaffinity-prctl$PR_SCHED_CORE-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-syz_init_net_socket$bt_hci-syz_init_net_socket$bt_hci-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-read$msr-openat$tun-ioctl$TUNSETIFF-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x2, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000208510000003000000180000000000000000000000000000019500000000000000010100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdffffffeffe85000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
mmap(&(0x7f0000146000/0x2000)=nil, 0x2000, 0xb, 0x28011, r0, 0x0) (async)
mmap(&(0x7f0000146000/0x2000)=nil, 0x2000, 0xb, 0x28011, r0, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000140)={@loopback, @initdev}, &(0x7f0000000240)=0xc)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) (async)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) (async)
sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5)
ptrace$setregset(0x4205, r1, 0x4, &(0x7f0000000540)={&(0x7f00000003c0)="892876767f79f7b8c2946fd15360319eaf53ade8b0c85cf174b34d7b1cd4f188d93dc2ed1d7b8267c8caf65cb7cadfcf0f09e7d1e462d992dcb987523c0b357fa15e31dc73cb01428bf74d58fc816ac35422a4c1e8a15c04f57b0966cfc739078f679cb52bc896a337e2a42b40284dd9bf11aecb690535f7cbefc5047dcc3952c0d7e94098a52cde133331fd63d605c2a66e9c73b4a2bb25281cb9b1a0a05d1e78b847599f654bbe8b152b217a77b8c7e3cc39d0b90b97f683ef79233e1a4b56b30a2d40fa37844696a6ecfc9da306dbfa7fc7833b1ad7167a959ab09334844183fd0ffe880eaf903623cd36cbe07d45ee7d9737b2b469e8", 0xf8})
sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7)
getpgrp(0x0) (async)
r2 = getpgrp(0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000003c0)={'veth1_to_hsr\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x4000000, {0x0, 0x0, 0x0, r4, {0x0, 0x60}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_RATE_ENABLE={0x8, 0x5, 0x4000}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x5}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000040}, 0x854) (async)
sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x4000000, {0x0, 0x0, 0x0, r4, {0x0, 0x60}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_RATE_ENABLE={0x8, 0x5, 0x4000}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x5}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000040}, 0x854)
sched_setaffinity(r2, 0x2, &(0x7f00000000c0)=0x5) (async)
sched_setaffinity(r2, 0x2, &(0x7f00000000c0)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r5 = getpid()
sched_setscheduler(r5, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0)
r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) (async)
read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8)
r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x8000, 0x0)
ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
r9 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-ioctl$sock_SIOCINQ-bpf$PROG_LOAD_XDP
detailed listing:
executing program 0:
syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x2)
r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000280)=<r2=>0x0, &(0x7f0000000300)=<r3=>0x0)
syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=<r4=>0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
r6 = dup(r5)
syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x826, 0x0, 0x0}}, 0x0)
ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f00000000c0))
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-prlimit64-syz_open_dev$radio-ioctl$VIDIOC_S_EXT_CTRLS-sched_setscheduler-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-pivot_root-read$msr-ftruncate-sched_setaffinity-socket$inet_tcp-setsockopt$IPT_SO_SET_REPLACE-socket$inet_smc-getsockopt$EBT_SO_GET_INFO-mmap-prctl$PR_SET_NO_NEW_PRIVS-syz_open_dev$media-ioctl$MEDIA_IOC_ENUM_ENTITIES
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
r0 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r1 = getpgrp(0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
pivot_root(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='./cgroup\x00')
read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8)
ftruncate(0xffffffffffffffff, 0x8800000)
sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x338, 0x0, 0xe138, 0x198, 0x0, 0x198, 0x2a0, 0x358, 0x358, 0x2a0, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0xff, '\x00', 'veth0_to_bond\x00', {}, {}, 0x21}, 0x0, 0x158, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0004000000040000000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0xc}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x398)
r6 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$EBT_SO_GET_INFO(r6, 0x0, 0x80, &(0x7f00000002c0)={'nat\x00', 0x0, 0x0, 0x0, [0x8, 0x4, 0x9, 0xfffffffffffffff7, 0x80000000, 0x100000001]}, &(0x7f0000000080)=0x78) (fail_nth: 1)
mmap(&(0x7f0000048000/0x1000)=nil, 0x1000, 0xb, 0x31, 0xffffffffffffffff, 0x0)
prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1)
r7 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x2)
ioctl$MEDIA_IOC_ENUM_ENTITIES(r7, 0xc1007c01, &(0x7f0000000480))

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_mptcp-socket$inet6_mptcp-bind$inet6-socket$inet_sctp-socket$inet_sctp-socket-getsockopt$inet_sctp_SCTP_MAX_BURST-openat$pidfd-openat$pidfd-prlimit64-sched_setscheduler-getpid-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$netlink-mount-mprotect-file_getattr-file_getattr-ioctl$BTRFS_IOC_SUBVOL_GETFLAGS-setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY-listen-listen-socket$inet_mptcp-socket$inet_mptcp-connect$inet-sendto$inet-sendto$inet
detailed listing:
executing program 0:
socket$inet6_mptcp(0xa, 0x1, 0x106) (async)
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
socket$inet_sctp(0x2, 0x5, 0x84) (async)
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
r2 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={<r3=>0x0}, &(0x7f0000000000)=0x8)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x222080, 0x0) (async)
r4 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x222080, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
getpid() (async)
r5 = getpid()
sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socket$netlink(0x10, 0x3, 0x13)
mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080)='ecryptfs\x00', 0x10005, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
file_getattr(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x18, 0x1000) (async)
file_getattr(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x18, 0x1000)
ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r4, 0x80089419, &(0x7f0000000100))
setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000000c0)={r3, 0x8}, 0x8)
listen(r0, 0xfffffffc) (async)
listen(r0, 0xfffffffc)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
r8 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
sendto$inet(r8, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) (async)
sendto$inet(r8, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-prctl$PR_SET_MM_MAP-openat$sequencer-write$P9_RSTATu-sendmsg$NFT_BATCH-io_uring_setup-bpf$PROG_LOAD-bpf$MAP_CREATE-io_uring_enter-socket$packet-mmap-mlock-sendmmsg$sock-userfaultfd-ioctl$F2FS_IOC_MOVE_RANGE-socket$inet_udp
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4242, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00004fb000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
write$P9_RSTATu(r1, &(0x7f0000000580)={0x237, 0x7d, 0x2, {{0x500, 0xf6, 0x0, 0x5000000, {0x96346fe8a85d2583, 0x0, 0x8}, 0x41400000, 0x0, 0xe5e0, 0x5, 0x1b, '\x04nodev{evoo~\x05E\xc6\x00\x05\b\x007\xd9:\x8b\x92\x00\x00\x00', 0x33, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0x37, '\xcf\xc3m\a\xc5\x00\xf0L\xd8_*p\xf5\xe9\x93\x0e^\x98\x9c\xd5\xefMQ\xf6\r\xa7X,J\x05\xc8\xf8(\xf6\x8d\xc1wM]\xe2\xe8 \x86#\x81\xf6hm\xd1\xbb\x8f\xd7\x00\x00\x00', 0x3e, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c<;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0w\xdct\x00\x00\x00\x00\x00\x00\x00\x00\a\xec!\xca\xbf\xf2\x0f\x9c\x00\x89\xf9\x06\x00\x00\x00\x00\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x13r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x237)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0xe6)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="17"], 0x50)
io_uring_enter(r2, 0x2219, 0x7721, 0x33, 0x0, 0x0)
socket$packet(0x11, 0x3, 0x300)
mmap(&(0x7f0000f5e000/0x2000)=nil, 0x2000, 0x3000007, 0x38011, r0, 0x0)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0xc004080)
r3 = userfaultfd(0x80001)
ioctl$F2FS_IOC_MOVE_RANGE(r3, 0x541b, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-move_mount-ioctl$USBDEVFS_REAPURB-mount$overlay-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$USBDEVFS_SUBMITURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0xc8000, &(0x7f0000000100)={[{@verity_on}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@nfs_export_on}, {@redirect_dir_on}], [{@uid_eq}, {@dont_appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@dont_appraise}, {@fsname={'fsname', 0x3d, '/dev/bus/usb/00#/00#\x00'}}]})
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1b, 0xe, &(0x7f00000004c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x34}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000011c0)="b9feddc1ddcccdf175537d53888e", 0x0, 0x600, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x0, 0x40, &(0x7f0000000000)={0x4b5a9da54893e123, 0x14, 0x8, 0x2}, 0x8, 0x7, 0x200, 0x0, 0x0, 0x20000, 0x0})

program crashed: INFO: task hung in usbdev_ioctl
single: successfully extracted reproducer
found reproducer with 17 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-move_mount-ioctl$USBDEVFS_REAPURB-mount$overlay-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0xc8000, &(0x7f0000000100)={[{@verity_on}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@nfs_export_on}, {@redirect_dir_on}], [{@uid_eq}, {@dont_appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@dont_appraise}, {@fsname={'fsname', 0x3d, '/dev/bus/usb/00#/00#\x00'}}]})
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1b, 0xe, &(0x7f00000004c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x34}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000011c0)="b9feddc1ddcccdf175537d53888e", 0x0, 0x600, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50)

program crashed: INFO: task hung in reap_as
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-move_mount-ioctl$USBDEVFS_REAPURB-mount$overlay-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0xc8000, &(0x7f0000000100)={[{@verity_on}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@nfs_export_on}, {@redirect_dir_on}], [{@uid_eq}, {@dont_appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@dont_appraise}, {@fsname={'fsname', 0x3d, '/dev/bus/usb/00#/00#\x00'}}]})
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1b, 0xe, &(0x7f00000004c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x34}, 0x94)

program crashed: INFO: task hung in reap_as
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-move_mount-ioctl$USBDEVFS_REAPURB-mount$overlay
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0xc8000, &(0x7f0000000100)={[{@verity_on}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@nfs_export_on}, {@redirect_dir_on}], [{@uid_eq}, {@dont_appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@dont_appraise}, {@fsname={'fsname', 0x3d, '/dev/bus/usb/00#/00#\x00'}}]})

program crashed: INFO: task hung in reap_as
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-move_mount-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-move_mount
detailed listing:
executing program 0:
syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r1, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-open_tree-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-mkdirat-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-landlock_restrict_self-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
landlock_restrict_self(r2, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in reap_as
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-landlock_create_ruleset-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in reap_as
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-prctl$PR_SET_TAGGED_ADDR_CTRL-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-write-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='0', 0x1)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-openat-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-mount-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-mkdirat-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in reap_as
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4004550c, 0xfffffffffffffffe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(0x0, 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, 0x0, 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
program crashed: INFO: task hung in usbdev_ioctl
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_connect-ioctl$USBDEVFS_REAPURB
detailed listing:
executing program 0:
r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001fb, 0x301)
syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0)
ioctl$USBDEVFS_REAPURB(r0, 0x4004550c, 0xfffffffffffffffe)

program crashed: INFO: task hung in usbdev_ioctl
validation run: crashed=true
reproducing took 2h36m16.251422663s
repro crashed as (corrupted=false):
INFO: task syz.0.17:5840 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:26888 pid:5840  tgid:5840  ppid:5752   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7376
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821
 device_lock include/linux/device.h:1104 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2613 [inline]
 usbdev_ioctl+0x1a7/0x3a90 drivers/usb/core/devio.c:2829
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa44859e159
RSP: 002b:00007ffd05cf8a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa448825fa0 RCX: 00007fa44859e159
RDX: 9999999999999999 RSI: 000000004004550c RDI: 0000000000000003
RBP: 00007fa44863506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa448825fac R14: 00007fa448825fa0 R15: 00007fa448825fa0
 </TASK>

Showing all locks held in the system:
locks held by kworker/1:1/30: 5, on CPU#1:
 #0: ffff888023aef540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000a57d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 drivers/usb/core/hub.c:5912
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
 #4: ffff8880799ac1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #4: ffff8880799ac1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
locks held by khungtaskd/32: 1, last CPU#1:
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by kworker/u8:3/50: 2, last CPU#0:
 #0: ffff8880352b5140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000ba7d08 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
locks held by jbd2/sda1-8/4931: 1, last CPU#0:
 #0: ffffffff8effd758 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8effd758 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8effd758 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by getty/5356: 2, on CPU#0:
 #0: ffff8880392260a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by udevd/5640: 4, on CPU#0:
 #0: ffff888036a1bab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
 #1: ffff88803908c880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:165
 #2: ffff888074ceab48 (kn->active#29){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
 #2: ffff888074ceab48 (kn->active#29){.+.+}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:166
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline]
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
locks held by syz.0.17/5840: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_do_ioctl drivers/usb/core/devio.c:2613 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_ioctl+0x1a7/0x3a90 drivers/usb/core/devio.c:2829
locks held by syz.1.18/5893: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.2.19/5932: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.3.20/5967: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.4.21/6008: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.5.22/6054: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.6.23/6096: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.7.24/6137: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.8.25/6178: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.9.26/6225: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 4931 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1161 [inline]
RIP: 0010:debug_check_no_obj_freed+0x2dd/0x630 lib/debugobjects.c:1201
Code: 00 00 ad de 49 89 56 08 48 89 c7 48 89 30 48 83 c6 22 48 89 70 08 e8 72 c3 ff ff 4c 89 f0 48 89 c2 48 c1 ea 03 42 80 3c 22 00 <0f> 84 23 ff ff ff 48 89 c7 48 89 44 24 10 e8 b0 f6 49 fd 48 8b 44
RSP: 0018:ffffc90005487600 EFLAGS: 00000046
RAX: ffff888074af8f18 RBX: 0000000000000001 RCX: ffffffff81e7cf78
RDX: 1ffff1100e95f1e3 RSI: 0000000000000000 RDI: ffff888076f081d8
RBP: ffffc90005487728 R08: 0000000000000001 R09: fffff52000a90eae
R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88805cd58000 R14: ffff888074af8f18 R15: ffff88805cd60000
FS:  0000000000000000(0000) GS:ffff888123b4e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555896264e8 CR3: 00000000732e4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __free_pages_prepare mm/page_alloc.c:1425 [inline]
 __free_frozen_pages+0x409/0x10f0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010
 alloc_buffer_head+0x21/0x140 fs/buffer.c:2872
 jbd2_journal_write_metadata_buffer+0xc5/0x1150 fs/jbd2/journal.c:347
 jbd2_journal_commit_transaction+0x12c6/0x6700 fs/jbd2/commit.c:689
 kjournald2+0x200/0x760 fs/jbd2/journal.c:200
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
INFO: task syz.0.17:5840 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:26888 pid:5840  tgid:5840  ppid:5752   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7376
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821
 device_lock include/linux/device.h:1104 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2613 [inline]
 usbdev_ioctl+0x1a7/0x3a90 drivers/usb/core/devio.c:2829
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa44859e159
RSP: 002b:00007ffd05cf8a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa448825fa0 RCX: 00007fa44859e159
RDX: 9999999999999999 RSI: 000000004004550c RDI: 0000000000000003
RBP: 00007fa44863506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa448825fac R14: 00007fa448825fa0 R15: 00007fa448825fa0
 </TASK>

Showing all locks held in the system:
locks held by kworker/1:1/30: 5, on CPU#1:
 #0: ffff888023aef540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000a57d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 drivers/usb/core/hub.c:5912
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
 #4: ffff8880799ac1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #4: ffff8880799ac1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1073
locks held by khungtaskd/32: 1, last CPU#1:
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by kworker/u8:3/50: 2, last CPU#0:
 #0: ffff8880352b5140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000ba7d08 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
locks held by jbd2/sda1-8/4931: 1, last CPU#0:
 #0: ffffffff8effd758 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8effd758 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8effd758 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by getty/5356: 2, on CPU#0:
 #0: ffff8880392260a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by udevd/5640: 4, on CPU#0:
 #0: ffff888036a1bab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
 #1: ffff88803908c880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:165
 #2: ffff888074ceab48 (kn->active#29){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
 #2: ffff888074ceab48 (kn->active#29){.+.+}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:166
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline]
 #3: ffff88802917a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
locks held by syz.0.17/5840: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_do_ioctl drivers/usb/core/devio.c:2613 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_ioctl+0x1a7/0x3a90 drivers/usb/core/devio.c:2829
locks held by syz.1.18/5893: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.2.19/5932: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.3.20/5967: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.4.21/6008: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.5.22/6054: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.6.23/6096: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.7.24/6137: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.8.25/6178: 1, on CPU#0:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054
locks held by syz.9.26/6225: 1, on CPU#1:
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #0: ffff88802b1771d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 4931 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1161 [inline]
RIP: 0010:debug_check_no_obj_freed+0x2dd/0x630 lib/debugobjects.c:1201
Code: 00 00 ad de 49 89 56 08 48 89 c7 48 89 30 48 83 c6 22 48 89 70 08 e8 72 c3 ff ff 4c 89 f0 48 89 c2 48 c1 ea 03 42 80 3c 22 00 <0f> 84 23 ff ff ff 48 89 c7 48 89 44 24 10 e8 b0 f6 49 fd 48 8b 44
RSP: 0018:ffffc90005487600 EFLAGS: 00000046
RAX: ffff888074af8f18 RBX: 0000000000000001 RCX: ffffffff81e7cf78
RDX: 1ffff1100e95f1e3 RSI: 0000000000000000 RDI: ffff888076f081d8
RBP: ffffc90005487728 R08: 0000000000000001 R09: fffff52000a90eae
R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88805cd58000 R14: ffff888074af8f18 R15: ffff88805cd60000
FS:  0000000000000000(0000) GS:ffff888123b4e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555896264e8 CR3: 00000000732e4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __free_pages_prepare mm/page_alloc.c:1425 [inline]
 __free_frozen_pages+0x409/0x10f0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010
 alloc_buffer_head+0x21/0x140 fs/buffer.c:2872
 jbd2_journal_write_metadata_buffer+0xc5/0x1150 fs/jbd2/journal.c:347
 jbd2_journal_commit_transaction+0x12c6/0x6700 fs/jbd2/commit.c:689
 kjournald2+0x200/0x760 fs/jbd2/journal.c:200
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>