Extracting prog: 4m58.016829854s Minimizing prog: 2h47m41.300710533s Simplifying prog options: 0s Extracting C: 3m14.034007755s Simplifying C: 28m5.601206322s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program crashed: INFO: task hung in lookup_slow single: successfully extracted reproducer found reproducer with 10 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r1 = dup(r0) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r0 = dup(0xffffffffffffffff) write$FUSE_BMAP(r0, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r0 = dup(0xffffffffffffffff) write$FUSE_BMAP(r0, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, 0x0, 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, 0x0, 0x0) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, 0x0, 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, 0x0, &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r1 = dup(r0) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r1 = dup(r0) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, 0x0, 0x0, 0x200000, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount program crashed: INFO: task hung in lookup_slow testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program crashed: INFO: task hung in lookup_slow validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program crashed: INFO: task hung in lookup_slow validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-write$FUSE_DIRENT-mount$9p_fd-chdir-openat$cgroup_ro-mount detailed listing: executing program 0: mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff001000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENT(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="58000000000000009fed2788c5532994414b47034801d524faf416638217", @ANYRES32], 0x3f) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) chdir(&(0x7f0000000100)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200000, 0x0) program crashed: INFO: task hung in lookup_slow validation run: crashed=true reproducing took 3h33m33.965307784s repro crashed as (corrupted=false): INFO: task syz.0.17:5946 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:29048 pid:5946 ppid:5900 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x15ae/0x4660 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 rwsem_down_read_slowpath+0x517/0x880 kernel/locking/rwsem.c:1086 __down_read_common kernel/locking/rwsem.c:1250 [inline] __down_read kernel/locking/rwsem.c:1263 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1522 inode_lock_shared include/linux/fs.h:814 [inline] lookup_slow+0x46/0x70 fs/namei.c:1718 walk_component+0x2ad/0x3e0 fs/namei.c:2010 lookup_last fs/namei.c:2467 [inline] path_lookupat+0x148/0x420 fs/namei.c:2491 filename_lookup+0x22d/0x580 fs/namei.c:2520 user_path_at_empty+0x42/0x60 fs/namei.c:2917 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3723 [inline] __do_sys_mount fs/namespace.c:3935 [inline] __se_sys_mount+0x2a8/0x3d0 fs/namespace.c:3912 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd704b9de59 RSP: 002b:00007fd705ade028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fd704e26090 RCX: 00007fd704b9de59 RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 RBP: 00007fd704c33e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000200000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd704e26128 R14: 00007fd704e26090 R15: 00007ffd3b8478d8 Showing all locks held in the system: 1 lock held by khungtaskd/29: #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633 1 lock held by dhcpcd/5433: #0: ffff8880b8f3c298 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559 2 locks held by getty/5525: #0: ffff8880314120a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217 2 locks held by syz.0.17/5945: #0: ffff88802c012418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.0.17/5946: #0: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.1.19/5964: #0: ffff888030ad0418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.1.19/5965: #0: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.2.20/5989: #0: ffff888023998418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.2.20/5990: #0: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by kworker/0:4/6006: #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc90003617d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc90003617d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 2 locks held by syz.3.21/6008: #0: ffff88802707e418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.3.21/6009: #0: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.4.22/6032: #0: ffff88807cd4e418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.4.22/6033: #0: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.5.23/6056: #0: ffff88802f2ca418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.5.23/6057: #0: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.6.24/6085: #0: ffff88805a74e418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c992d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3} , at: inode_lock include/linux/fs.h:804 [inline] , at: open_last_lookups fs/namei.c:3561 [inline] , at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.6.24/6086: #0: ffff888077c992d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c992d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.7.25/6108: #0: ffff88805df54418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.7.25/6109: #0: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.8.26/6133: #0: ffff8880701a6418 (sb_writers #13 ){.+.+}-{0:0} , at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.8.26/6134: #0: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 1 lock held by syz-executor/6139: 2 locks held by dhcpcd/6143: #0: ffff888059778130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline] #0: ffff888059778130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264 #1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline] #1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xf59/0xfa0 kernel/hung_task.c:379 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 12 Comm: kworker/u4:1 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: events_unbound nsim_dev_trap_report_work RIP: 0010:__preempt_count_sub arch/x86/include/asm/preempt.h:85 [inline] RIP: 0010:preempt_count_sub+0x5c/0x160 kernel/sched/core.c:5884 Code: 05 a1 4e a7 7e 89 c1 81 e1 ff ff ff 7f 39 cf 7f 25 81 ff ff 00 00 00 0f 93 c1 84 c0 0f 95 c0 08 c8 74 53 65 8b 05 7c 4e a7 7e df 65 01 3d 73 4e a7 7e 5b 5d c3 e8 a3 52 d1 02 85 c0 74 f4 48 RSP: 0018:ffffc90000117868 EFLAGS: 00000202 RAX: 0000000080000002 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: 0000000000000001 RBP: ffffc90000117918 R08: ffffffff911e75f7 R09: 1ffffffff223cebe R10: dffffc0000000000 R11: fffffbfff223cebf R12: dffffc0000000000 R13: ffff888059157000 R14: ffffffff97575ba0 R15: 1ffff92000022f10 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdf2651450 CR3: 000000000cf32000 CR4: 00000000003506e0 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xc5/0x120 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:1037 [inline] debug_check_no_obj_freed+0x47b/0x520 lib/debugobjects.c:1058 slab_free_hook mm/slub.c:1786 [inline] slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 skb_kfree_head net/core/skbuff.c:946 [inline] skb_free_head net/core/skbuff.c:958 [inline] skb_release_data+0x609/0x7f0 net/core/skbuff.c:988 skb_release_all net/core/skbuff.c:1054 [inline] __kfree_skb net/core/skbuff.c:1068 [inline] consume_skb+0xb2/0x110 net/core/skbuff.c:1284 nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline] nsim_dev_trap_report_work+0x723/0xa90 drivers/net/netdevsim/dev.c:851 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 final repro crashed as (corrupted=false): INFO: task syz.0.17:5946 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:29048 pid:5946 ppid:5900 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x15ae/0x4660 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 rwsem_down_read_slowpath+0x517/0x880 kernel/locking/rwsem.c:1086 __down_read_common kernel/locking/rwsem.c:1250 [inline] __down_read kernel/locking/rwsem.c:1263 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1522 inode_lock_shared include/linux/fs.h:814 [inline] lookup_slow+0x46/0x70 fs/namei.c:1718 walk_component+0x2ad/0x3e0 fs/namei.c:2010 lookup_last fs/namei.c:2467 [inline] path_lookupat+0x148/0x420 fs/namei.c:2491 filename_lookup+0x22d/0x580 fs/namei.c:2520 user_path_at_empty+0x42/0x60 fs/namei.c:2917 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3723 [inline] __do_sys_mount fs/namespace.c:3935 [inline] __se_sys_mount+0x2a8/0x3d0 fs/namespace.c:3912 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd704b9de59 RSP: 002b:00007fd705ade028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fd704e26090 RCX: 00007fd704b9de59 RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 RBP: 00007fd704c33e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000200000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd704e26128 R14: 00007fd704e26090 R15: 00007ffd3b8478d8 Showing all locks held in the system: 1 lock held by khungtaskd/29: #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633 1 lock held by dhcpcd/5433: #0: ffff8880b8f3c298 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559 2 locks held by getty/5525: #0: ffff8880314120a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217 2 locks held by syz.0.17/5945: #0: ffff88802c012418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.0.17/5946: #0: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e920160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.1.19/5964: #0: ffff888030ad0418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.1.19/5965: #0: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e920730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.2.20/5989: #0: ffff888023998418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.2.20/5990: #0: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e920d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by kworker/0:4/6006: #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc90003617d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc90003617d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 2 locks held by syz.3.21/6008: #0: ffff88802707e418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.3.21/6009: #0: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c98730 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.4.22/6032: #0: ffff88807cd4e418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.4.22/6033: #0: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c98160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.5.23/6056: #0: ffff88802f2ca418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.5.23/6057: #0: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c98d00 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.6.24/6085: #0: ffff88805a74e418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c992d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3} , at: inode_lock include/linux/fs.h:804 [inline] , at: open_last_lookups fs/namei.c:3561 [inline] , at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.6.24/6086: #0: ffff888077c992d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c992d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.7.25/6108: #0: ffff88805df54418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.7.25/6109: #0: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805e9212d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 2 locks held by syz.8.26/6133: #0: ffff8880701a6418 (sb_writers #13 ){.+.+}-{0:0} , at: mnt_want_write+0x41/0x90 fs/namespace.c:412 #1: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline] #1: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: open_last_lookups fs/namei.c:3561 [inline] #1: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: path_openat+0x7f4/0x3270 fs/namei.c:3794 1 lock held by syz.8.26/6134: #0: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff888077c998a0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: lookup_slow+0x46/0x70 fs/namei.c:1718 1 lock held by syz-executor/6139: 2 locks held by dhcpcd/6143: #0: ffff888059778130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline] #0: ffff888059778130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264 #1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline] #1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xf59/0xfa0 kernel/hung_task.c:379 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 12 Comm: kworker/u4:1 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: events_unbound nsim_dev_trap_report_work RIP: 0010:__preempt_count_sub arch/x86/include/asm/preempt.h:85 [inline] RIP: 0010:preempt_count_sub+0x5c/0x160 kernel/sched/core.c:5884 Code: 05 a1 4e a7 7e 89 c1 81 e1 ff ff ff 7f 39 cf 7f 25 81 ff ff 00 00 00 0f 93 c1 84 c0 0f 95 c0 08 c8 74 53 65 8b 05 7c 4e a7 7e df 65 01 3d 73 4e a7 7e 5b 5d c3 e8 a3 52 d1 02 85 c0 74 f4 48 RSP: 0018:ffffc90000117868 EFLAGS: 00000202 RAX: 0000000080000002 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: 0000000000000001 RBP: ffffc90000117918 R08: ffffffff911e75f7 R09: 1ffffffff223cebe R10: dffffc0000000000 R11: fffffbfff223cebf R12: dffffc0000000000 R13: ffff888059157000 R14: ffffffff97575ba0 R15: 1ffff92000022f10 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdf2651450 CR3: 000000000cf32000 CR4: 00000000003506e0 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xc5/0x120 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:1037 [inline] debug_check_no_obj_freed+0x47b/0x520 lib/debugobjects.c:1058 slab_free_hook mm/slub.c:1786 [inline] slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 skb_kfree_head net/core/skbuff.c:946 [inline] skb_free_head net/core/skbuff.c:958 [inline] skb_release_data+0x609/0x7f0 net/core/skbuff.c:988 skb_release_all net/core/skbuff.c:1054 [inline] __kfree_skb net/core/skbuff.c:1068 [inline] consume_skb+0xb2/0x110 net/core/skbuff.c:1284 nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline] nsim_dev_trap_report_work+0x723/0xa90 drivers/net/netdevsim/dev.c:851 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293