Extracting prog: 8m23.423156061s
Minimizing prog: 8m26.461208161s
Simplifying prog options: 16m54.60751232s
Extracting C: 5m16.775588205s
Simplifying C: 0s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=8m18.088849888s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
validation run: crashed=false
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
validation run: crashed=false
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
validation run: crashed=false
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
validation run: crashed=false
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
reproducing took 1h35m26.492251419s
repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P184/3:b..l
rcu: (detected by 1, t=10502 jiffies, g=25989, q=848 ncpus=2)
task:kworker/u8:8 state:R running task stack:20768 pid:184 tgid:184 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7553
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:679
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:228 [inline]
RIP: 0010:unwind_next_frame+0x1f6/0x2550 arch/x86/kernel/unwind_orc.c:510
Code: 08 8b 15 6d ef 4c 0c 8d 42 ff 44 39 f8 0f 86 6c 04 00 00 44 89 f8 4c 8d 2c 85 68 95 08 91 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 <84> c0 4c 89 e3 0f 85 66 1d 00 00 45 8b 6d 00 44 89 f8 ff c0 4c 8d
RSP: 0018:ffffc900041de380 EFLAGS: 00000a03
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000080000000
RDX: 00000000000a54d5 RSI: ffffffff8bcbd060 RDI: ffffffff8bcbd020
RBP: ffffffff822413ab R08: 1200000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8e3c3880 R12: dffffc0000000000
R13: ffffffff910d25b4 R14: ffffc900041de428 R15: 0000000000012413
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
save_stack+0x122/0x230 mm/page_owner.c:183
__set_page_owner+0x8d/0x4c0 mm/page_owner.c:359
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3955
__alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5394
alloc_slab_page mm/slub.c:3295 [inline]
allocate_slab+0x7c/0x5e0 mm/slub.c:3410
new_slab mm/slub.c:3456 [inline]
refill_objects+0x2d8/0x350 mm/slub.c:7321
refill_sheaf mm/slub.c:2833 [inline]
__pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699
alloc_from_pcs mm/slub.c:4775 [inline]
slab_alloc_node mm/slub.c:4909 [inline]
__do_kmalloc_node mm/slub.c:5338 [inline]
__kmalloc_noprof+0x543/0x790 mm/slub.c:5364
_kmalloc_noprof include/linux/slab.h:973 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
ieee802_11_parse_elems_full+0x14b/0x2db0 net/mac80211/parse.c:1073
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2549 [inline]
ieee80211_inform_bss+0x163/0x10d0 net/mac80211/scan.c:79
rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
cfg80211_inform_single_bss_data+0xd98/0x1bf0 net/wireless/scan.c:2382
cfg80211_inform_bss_data+0x25b/0x3d50 net/wireless/scan.c:3241
cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3333
ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
ieee80211_rx_bss_info net/mac80211/ibss.c:1063 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1544 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 net/mac80211/ibss.c:1571
ieee80211_iface_process_skb net/mac80211/iface.c:1769 [inline]
ieee80211_iface_work+0x78a/0x1010 net/mac80211/iface.c:1823
cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: rcu_preempt kthread timer wakeup didn't happen for 10402 jiffies! g25989 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=1 timer-softirq=23285
rcu: rcu_preempt kthread starved for 10403 jiffies! g25989 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27784 pid:18 tgid:18 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7323
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11c0 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 0c 74 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 66 19 00 fb f4 4c d0 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc900001e7e40 EFLAGS: 00000242
RAX: 00000000001641c1 RBX: ffffffff8199b2ec RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8d98ba58 RDI: ffffffff8bcbd080
RBP: ffffc900001e7f10 R08: ffff8880b8733d1b R09: 1ffff110170e67a3
R10: dffffc0000000000 R11: ffffed10170e67a4 R12: 0000000000000000
R13: 1ffff11003c51bb8 R14: 1ffff9200003cfd0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555588752a38 CR3: 000000003f732000 CR4: 00000000003526f0
Call Trace:
arch_safe_halt arch/x86/kernel/process.c:767 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:768
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x1cc/0x540 kernel/sched/idle.c:355
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x157
report is corrupted, running repro again
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
report is corrupted, running repro again
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
report is corrupted, running repro again
testing program (duration=8m18.088849888s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
final repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P37/6:b..l
rcu: (detected by 1, t=10502 jiffies, g=37729, q=5376 ncpus=2)
task:kworker/1:1 state:R running task stack:20704 pid:37 tgid:37 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: mld mld_ifc_work
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7410
preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
class_preempt_destructor include/linux/preempt.h:468 [inline]
raw_spin_unlock_irqrestore_wake include/linux/sched/wake_q.h:102 [inline]
rtlock_slowlock kernel/locking/rtmutex.c:1923 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x316/0x400 kernel/locking/spinlock_rt.c:57
spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
hsr_check_duplicate+0xa6/0x1a0 net/hsr/hsr_framereg.c:598
hsr_forward_do net/hsr/hsr_forward.c:550 [inline]
hsr_forward_skb+0xe1c/0x28c0 net/hsr/hsr_forward.c:743
hsr_dev_xmit+0x253/0x370 net/hsr/hsr_device.c:236
__netdev_start_xmit include/linux/netdevice.h:5439 [inline]
netdev_start_xmit include/linux/netdevice.h:5448 [inline]
xmit_one net/core/dev.c:3893 [inline]
dev_hard_start_xmit+0x2df/0x870 net/core/dev.c:3909
__dev_queue_xmit+0x14d2/0x3880 net/core/dev.c:4882
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:325
mld_sendpack+0x890/0xe10 net/ipv6/mcast.c:1870
mld_send_cr net/ipv6/mcast.c:2171 [inline]
mld_ifc_work+0x842/0xd60 net/ipv6/mcast.c:2711
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: rcu_preempt kthread timer wakeup didn't happen for 10333 jiffies! g37729 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=0 timer-softirq=19595
rcu: rcu_preempt kthread starved for 10334 jiffies! g37729 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27176 pid:18 tgid:18 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7323
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11c0 kernel/rcu/tree.c:2123
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2325
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 0c 74 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 66 19 00 fb f4 4c d0 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8e007ca0 EFLAGS: 00000242
RAX: 00000000000faf9b RBX: ffffffff8199b2ec RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8d98ba58 RDI: ffffffff8bcbd080
RBP: ffffffff8e007d78 R08: ffff8880b8633d1b R09: 1ffff110170c67a3
R10: dffffc0000000000 R11: ffffed10170c67a4 R12: 0000000000000000
R13: 1ffffffff1c1edf0 R14: 1ffffffff1c00f9c R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e09aa27138 CR3: 0000000033e6e000 CR4: 00000000003526f0
Call Trace:
arch_safe_halt arch/x86/kernel/process.c:767 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:768
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x1cc/0x540 kernel/sched/idle.c:355
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
rest_init+0x378/0x3a0 init/main.c:727
start_kernel+0x392/0x3e0 init/main.c:1185
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x157