Extracting prog: 29m35.971473592s Minimizing prog: 1h18m6.70772756s Simplifying prog options: 16m31.289322978s Extracting C: 5m15.22191824s Simplifying C: 0s 30 programs, timeouts [6m0s] extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_procfs-syz_emit_ethernet-memfd_create-mmap-dup3-socket$nl_xfrm-sendmsg$nl_xfrm detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, 0x0, 0x0) r0 = syz_open_procfs(0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = memfd_create(0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000003, 0x11, r1, 0x4000) dup3(r0, r1, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="0c0100001600c7170000000000020000ff020000000000000000000000000001e000000100"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ac1414bb0000000000000000000000000000000033000000ff0100fcffffff000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400c"], 0x10c}, 0x1, 0x0, 0x0, 0x20049080}, 0x880) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$random-syz_io_uring_setup-syz_io_uring_submit-io_uring_register$IORING_UNREGISTER_IOWQ_AFF-openat-ioctl$DRM_IOCTL_DROP_MASTER-socket$nl_netfilter-sendmsg$NFT_BATCH-openat$userio-write$USERIO_CMD_REGISTER-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-io_uring_enter-socket$pppoe-connect$pppoe-sendmmsg detailed listing: executing program 0: openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x82100, 0x0) r0 = syz_io_uring_setup(0x239, &(0x7f0000000540)={0x0, 0x0, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, 0x0, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x101901, 0x1ce) ioctl$DRM_IOCTL_DROP_MASTER(r3, 0x641f) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000240), 0x200, 0x0) write$USERIO_CMD_REGISTER(r5, &(0x7f0000000280)={0x0, 0x7e}, 0x2) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000b618856054000000000000000a38000000060a17d50000000000000000020000000900020073797a32000000000900010500000030000000000c000340000000000000000220000000020a01020000000000000000000000060900010073797a30000000001400000011000100000000000000009fb76e59b6f1429e4d32009b32411f72de6b12d80360"], 0x80}}, 0x0) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000040)={0x18, 0x0, {0x4, @empty, 'wlan0\x00'}}, 0x1e) sendmmsg(r6, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-syz_usb_connect-socket$nl_route-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$TIPC_NL_KEY_SET-setsockopt$SO_ATTACH_FILTER-socket$nl_generic-io_uring_setup-bpf$MAP_CREATE_CONST_STR-bpf$MAP_CREATE_RINGBUF-bpf$PROG_LOAD detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000400)={&(0x7f0000000280), 0xc, &(0x7f0000000540)={&(0x7f0000003140)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="010025bd7000fedbdf2517000000380007800c00040001000080ffffffff08000100ffff00000c00040005000000000000000c0003000f000000000000000800010008000000ac000680080001000400000008000100070000007c000300c592296fa819e292ef1c2c99cf130d9833437213b86392561362edb51d92282cfc0bf4d71e40ebf036e54948197821d695b07a4f635ac69c1345cb6f3606917b8858a51ccbe97fc95eb3d3f93405830ad814be0ddf44027d23bcc69e008858c0e6dae7d20a71bf8b0b3bcde072a4e9fbf765319854c872fb04000500080001004da100000b0003006a2a3894a8b11c00040005004c0005800800010065746800040002803c00028008000400010000000800020001000000080001001200000008000200070000000800010012000002080004000004000008000308060000009c1006804600040067636d28616573290000000000000000000000000000000000000000000000001e00000077c5bf9e6da0ed25fdcd77d93a89a8776b1075439220d11baabad974390a0000040002000800060005000000840f0300a7bd9265bf8dad80bd951b64431712b6766b00b30bb81952b08af235f427fc52b692f0959fe5f2f0b65c288d8081df36e81265f96aca9394a24837209c5a17d4abf0fce1bfa1eec1e0a9ae1528e1b2839fcc93e63a1c46b536cbeb6c89557087e99ff099d491f51f61267a37701684806d1925f227523a369b448933e0748aaac73cf0deba0a88d991835bddb3e35af78d3372b0d13f2394594a5971ba2067586566e3ad5d4fadc8ddef5c763e9ed91b0c1a154485ef000a9eff4a2d667f121b66da1c2980720e0002a2fc51b6589268958245cbeeb02fef5c4435fa34c5718c5f0e5c8fd2bf1bf1dd6e111535512a4602051f3c5db3ed8800429628684ed201cdfdc5d1564b96b4714aa9baedee35b397220df5bf8529c1c58805516bd4939a0f1b88cc9d8b8277058383273a7831d467749fcfdaa26215ac7dfa2915d842c611d0e5706a2a569fd06f28a9c586560e3adc8951a9319d5b9ca58465bf6b78512497853fef1fd328207dff8dd9302a77f213d8854186ade4bfb0d539f074806dccd61bdd3d4206743864b93992f3a9655230777494914ebf96c8f4ab1a882d39591650b0cb4ee700fb80ec79a378e6c0c7c8025e1f9dcef67704d9c845b522b30d98186484d089474fbca5041f74fb1d544ce65cd7c85f6edff7dfa2ba865cc2df5b42e4388f9e54ed2abb0f34be6de9f86f849f21f390369c9848854f3fd7c8863d59701b8648fcd0d491b2e66e8734d3d75c3016d3a2bf9b3388d4ca7cf4dce9fef1e254751fd7943668e14933a07887f5d465549e4cc4ef4ca6c7b94d37c4e0eb6ec0674e3fb7f7b7531fce1a9a4bb4c4e64515e8b6570071e4f608e36dfecccc4248de57b25af1b80ac77dd122eebc254b91f7097284b213b3f4b5d582e00ae2a8776a33766440e73e55bacfab698032cf85a8d1d7a8bd6f855693a9c854564e12361683522f6944dd1c8dcc0bcc05ecfd8acc11041ecbe7ec75cf13ffcf60b861d7ef15bd301cf23c49deca358fcc338a3fb6be07248bd9f08678aa1fc359442aa0665fa2f0f13ad49385147de9f5520b13235c23f79f479c762f9b16d34fdb1de1efcfbb6d25f80e8724295be4e29b81df5f1b90e7fb1a02f831f98aee0ff001dca325d3a56298843e2d5ce58a5f2ecae09384647c1bc9309ca6bbbfff87e385a6246f902a330162dc19e39439ca0028cc7454d740fa8ddfbb6da11b68487a953c90ab9c27a2a92bd1e43d970420d9c202ce081877e3f709759b106c310945f1e81c7a817807363aee6ce7a9ea55a9b28319cc4923e23b10532efd96bc3965a33ab0fe70a818e6194adceab80231e0a0bb68b4deefd5edaa9d88051d30648b2ceca9a03a259bcb75c5a5f98bf1e2383da25d9dfa7ce0f22b2cbd5f380265e711c782bd323f8945128379220f71f4d0b9bf32b51e39b9e6e6ef1bb34dd7004502d6620a5c1f788bc03fee165cde9b52393d7fbec53372ffc0543c46dc697cfb0006b0e963e0a3a01f216d2d16de3bf54cd8a50293b29c413a3ec58a1ec5e5a213027031d952a7d7d8655a13a4b86f0b83a69ab4a62cc27b86b11cf0ac1a7724704353bd51a7148b40c62af5d6ef40a5abab0f336b385a2a7ef64ed91a810311bc1777eedfacad4bd853a83c89f327deaa4687693e71c4aefef33ca3ab8ad5c46a19d2598440db365bdf6dc9484a801fabb92266557019fcdc222e49e884cf74297e131a0fd0a8dfb5276faaf4da55af1c24f51c24ed384fbf2a9a28da95d48bb0a7d6d4023b641e47e6fc68c8b835356db9985a65f0af0e9ca62d427766c00607d04285e5887e960374bc278053c4fdcfcfe86629280664008f52eee5bd96fc2929523ceee226ae489f1f72d5a89d063bb7c4b70eeeb9942798cc8cf170236696b33848f285ed71d5c05343731417f0b6365e93297899434e080171e6f3938ced72755622cc25d102aada78d58fb6f903cf5fe4a44cc2178372bfb5e4e5df41824ed0e3d8ced0df69ab5233637aafcdf24f9bdc6bfb75dee77e0e683c10d7ac84ceb617937172278b17d7d0dd758afd91de6ea9997ecebbf2c981893291c5155c3c65be8ef71945cec160c54e085d9276f8872b92f2c7b1555138dbdcfe1f4697399e77942c23723d2b114312303e860fca741ff8e477757276e39225011ed96f1db709027dd6c8597890e544a94760c270842175ba7628348b7ad957e4def0ea796f228bc4f47c2aa689dde0c8f5d39e87c64db9cfd451da06fe57753b90aecebd74f7f69734cc17a1badcfee540dc25c9685681ab6cd361f173a01a735a19c71841bbb2a10359833d1e5d4f8246cdc96c303b8a94cbe6253ff1b7e1518ab7ffb3b9c2c448ede139f19fd6931fdb2c1a2850649675100b1d2e3571f8481dc3d06281742e12d24d434292b221ab1c5a531f835c4455edf8d8a80883eb5499fb41e49bbf51ae090e811cbe5778723770c16c6fd1f7e922983c1c9a7a46511a1aa9eee666d7403ea004fe8ec2ce03dcca8c1ea2dce859da216679cfbdcde8f4a99fe123f860d31ad254e0402cdda521ca9392830c791c7ab3eb87c27869141d70dfd58a94f11d9a2b50a3366eb4ad93fa14e095940fc413b3a7c4cf6473b454a57b745cc8891dee1c37d76fc710ab71fd676717dae7a5a6d07244e33142bfeb48ad674f4ddfff426f471d18f3f3df712ae9b07f6ae4b90604e9d52b041ae67e6ff61ea81f1db042148544b2c7607e58c56ec36bc7b17edc1479057d9046b78671df527043ea83e7e5cb7172a9860f39d3f92ff6aaecc755205645b379a6b53809cdc975a5296927efa3b320dd13a14d9dcba1c8400b14c68d8041d1a33d58b4b9be924f489fc7c88b448f50fef5f61f0c6944ca51614c1f251e1267cad3a6b061984236354d5a8066383d49ac3358e685870d8abd762e8e0c9bd66972bea2bb7d06f8501104936248744b4d1181c7a6946866001d86b9cfef7d897f126cd4f32a33b35729c0333650dfb808e194b13a6370ef9454ac009260921b6a94c82e85e01a1e701957be6e0049032a28db8920adb83189c408552877fac1f770d7d2d05ba359d30b2fd83630ab73b30bcc10ba1df6bc6962eef2011d1b849c2803f02d2783e2bb625fe64bf4b634e17c768794ab3a48a9f1ef565648d63f118d1de02901ec3aeba94cf021d85d74a203fbec820176fe04ff39f4504c2f956b022f9d584c5184648d88f9f5ff7e201765c31884cfe10ff7e5beafd3e6ba7a00494612b9f06febb8f863349a6367b0c58876ef0004801c9f7a8b3b53580e40c13500cd53286a23ccdb6c7f3c10295a2de2e5f5137ce976ca48fa262b9e640fc694639be14f824fcdd75dc459d3ee0b4b4e16489e8049d68f3f829b549dcaae76d6ca885ad94493e7f428c7d2e740d248473aeaf818729e2bea35d17159870c7b943cf8fa008343c57ae2a281791a302fab1d6bcce53b39ede3cf428cddf57ad726c021b635925385f37fdc0e39f48a4bacd474ee948e9abca20805b7bd399966243c61d041128a9688f132c59e65ee33056c8f0a12b16ca4cf6252f40bae8978bde97a5b791e1e1d22af7c09d691e25ccb818763c710bd4b160b650e6f04fcb15e1c498a64215252e169a5949e572c23875880e6b31f6595a5c0b954f0a81b2a6b3daef9cdcdf5c1c8e4b22af60c2f1ed4d64e6a1ec93263d8f0320dbd52fbfd6a3a99aed20f38be6a10c2b26f2db50dbb8b82a84b944ca02f247cea78e656d61ef4c6a936c37f0bdd9903028dda145aa92eb10ee2e7cf515d23b7d46dbdaa4506eaf567ff11c3af307d971ae6a5d51dfc5be38c626784604c34b192fe029a429c7f119500989363ae1606936b96fd5b6bd8fa84262526a732f3123da1555e1f14da595409b3ffb41461770501c063c141ad5c0f8c729b4e9edd1aa9c05f5c5f0bd83ceaae6c8577d3a899829f7e629445cda497523588800b14b199245a2d0a5fbcaeafe6a9cb1faafc5759c4a4e67927e5b0f4c5acca444237c0ee6ade69b941688281d2ed0a0ee195e291b2654b1e2558c0b06fccd2f5fbbd34ff5a8c77324d722f9bbca22ebfecd2e5328bde6a61c182bf6890e1061e7d19e3a96cea2efe54ce457217364c450463bfe05229abde4d0ef5cb2a5262f99718ed5b10ce9c495b7682d97806b4abbedd5fc8fec8eb8c2afbfe725175dc0baa56a9367ff66b6980983d320fb2345bbe118e84800a4ee859e51d91ded628d2e6496ba35e190cd426f433d4c9ba0c1bd0f9c5f97d749da659ffd372c7a7dfeaeae6d3d18d0d3cf7fd39a75c92cc381630405e93c4f08f087d76a42126e859684716347677195688556684da2aa6bb7b00e822eb8eafa6ded3aa433e80666e27b0b314925d0a0ab589b5f1074f42533574fd5e5459116f26d07395333e92da713489ed403bde08089fb439ce8ee9f4a577c60a903ce842b3d5d5f6ab79ee44cb51e05537878fc87d0a0d238ae334e78823ae8200980db557d4b5f8927cccf106bdb8b0886d53171cfc08c3981f142bdd4a43e46740ed711fa9e1a1a3ab6a8c9bf1ea1d1afac555c7c3aad0818a34461b6d091963340427f4034088c65c5263803bfb066bd7e16ddc208e54545de2056ce94bf97e7274b603d70316bb980b693e87ce33b728b9a3914f66d3838b570f678200ba76632b3953e0c60ac3172c854be2d35d965e332b878e0ba5bab94b077f4daaa00d7575c1614febaaff514ded6e1225c441edcebbb43828b4f73d357bd09fb6b4d5f61e4bb811983e64a39de1304f1dbdbdb1b91d4763bb2201b8b666830ab6296ba2d024d6ad37066f570ff5085710eb65be4748ff6284bba07798984022aaa4f91d01b7ae2effd2cf5527761f4811196069524f1ed95687e69c8aae87e84f6a15d38c786fdcac778f6a150fe811499e70df723ae44f449d43d16b565e812375fb845b87d8872c3bb287a8b160ff167503913258f6397657bf13a156c63f1b4d3017b52e7bd2ebb9a7b7577a1e59455cc81bbbcf2d85b17c1c6f43ca469e4fccfba2b5e39f90c2b7485f97026610b87fb0e1ccacd19113d5bcf872eb96d9665468e4468c11a51fea7ce28c3151ebf108ba19499cb69524b4640b6c1de7340ca238de9428ba88aaf05cd6271f61a37043c212ee1c85606e2b0a9dbace228fe3e1ae4db93693eb84e10a5b21fe7db7812d42c12b258a5a8761ad2ad210dd2b429e9a0b98251ca9a5c23c07e6c048f4373d020428b6406420072112a85ceb1da6667372d87820916f89c67877fbe210d58fa6"], 0x11ec}, 0x1, 0x0, 0x0, 0x44000882}, 0x810) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) io_uring_setup(0x30d0, &(0x7f00000000c0)) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000102c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f00000103c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000103b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007b9a00fe00000000b609080085ffffff7b9af0ff00000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000001500040085ffffffbf98000000000000560800000000000084fff40007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-setsockopt$sock_int-socket$igmp6-getsockopt$IP6T_SO_GET_ENTRIES-socket$inet6_mptcp-prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-socket$pppoe-connect$pppoe-sendmmsg-connect$pppoe-socket$inet6-openat$cuse-read$FUSE-openat$ttyprintk-ioctl$TCSETS2-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_CREATE_VCPU-fsopen-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-syz_emit_vhci-syz_open_procfs-syz_usb_connect-syz_open_dev$sndctrl detailed listing: executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) r1 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000440)={'filter\x00', 0xcf, "6ee32e99b7f058f2761f90f2de1a94e8e8d25121c78323e4e86b7c87bf2cf5675f9ad30811a4fdac655dfc8a1500ba54d5e866a87a097243c16ea5567698e30032e8d016113016a052bcc0a258f1c44b0f50e382f9ac5c2765429c22c86369ff1c04ad0acc3e07700973aa33f85d289d43427e277a41a800b1083c954805b59a8a9de11163515bf6802f63e91dd014f7cb150493735c26d026ccb0c6e9b9bfe327dadf77b22db92a950d336bb950add4dc08216e57be16b352237f47f943a04b8609aa6d92e70de9485fd4f45ab0ed"}, &(0x7f00000000c0)=0xf3) socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffcb2, &(0x7f0000000800)=0x9) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x3, @multicast, 'macvtap0\x00'}}, 0x1e) sendmmsg(r3, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0x0, @multicast, 'veth0_to_hsr\x00'}}, 0x1e) socket$inet6(0xa, 0x0, 0x0) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r4, 0x0, 0x0) openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) fsopen(&(0x7f0000000040)='bdev\x00', 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, &(0x7f0000000340)="0f38caa7080066b8000000000f23c80f21f866350400b0000f23f866b9920200000f32ba420066b80300000066ef660f2896070026670fae69a8ba2000b0c3eeb800008ed00f090fc7a8d200", 0x4c}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000500)=ANY=[], 0x7) syz_open_procfs(0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc3, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-write$char_usb-socket$alg-ppoll-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ppoll(&(0x7f0000000140)=[{r1, 0x410}], 0x1, &(0x7f00000001c0)={0x0, 0x3938700}, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program crashed: INFO: task hung in usb_register_dev single: successfully extracted reproducer found reproducer with 9 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-write$char_usb-socket$alg-ppoll-socket$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ppoll(&(0x7f0000000140)=[{r1, 0x410}], 0x1, &(0x7f00000001c0)={0x0, 0x3938700}, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-write$char_usb-socket$alg-ppoll-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ppoll(&(0x7f0000000140)=[{r1, 0x410}], 0x1, &(0x7f00000001c0)={0x0, 0x3938700}, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-write$char_usb-socket$alg-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program crashed: INFO: task hung in usb_deregister_dev testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program crashed: INFO: task hung in usb_deregister_dev testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-syz_usb_disconnect-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program crashed: INFO: task hung in usb_register_dev testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) write$char_usb(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x34, 0x3b, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0x11, 0x0, 0x0, @u64=0x7}]}]}, 0x34}}, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) program crashed: INFO: task hung in usb_register_dev extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$hidraw-syz_usb_connect$cdc_ncm-syz_open_dev$char_usb-write$char_usb-socket$nl_generic-sendmsg$nl_generic detailed listing: executing program 0: syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0xc000) program crashed: INFO: task hung in usb_port_suspend a never seen crash title: INFO: task hung in usb_port_suspend, ignore reproducing took 2h9m29.190466836s repro crashed as (corrupted=false): INFO: task kworker/1:3:5252 blocked for more than 143 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:3 state:D stack:20416 pid:5252 tgid:5252 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 wdm_create+0x11cf/0x16d0 drivers/usb/class/cdc-wdm.c:1113 wdm_probe+0x21e/0x300 drivers/usb/class/cdc-wdm.c:1165 usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254 usb_probe_device+0x1b8/0x380 drivers/usb/core/driver.c:294 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2d6d/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:3:5316 blocked for more than 143 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:20416 pid:5316 tgid:5316 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 wdm_create+0x11cf/0x16d0 drivers/usb/class/cdc-wdm.c:1113 wdm_probe+0x21e/0x300 drivers/usb/class/cdc-wdm.c:1165 usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254 usb_probe_device+0x1b8/0x380 drivers/usb/core/driver.c:294 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2d6d/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:6:5396 blocked for more than 144 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:6 state:D stack:20416 pid:5396 tgid:5396 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 usb_deregister_dev+0x88/0x210 drivers/usb/core/file.c:186 wdm_disconnect+0x33/0x520 drivers/usb/class/cdc-wdm.c:1214 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1296 bus_remove_device+0x34f/0x420 drivers/base/bus.c:576 device_del+0x57a/0x9b0 drivers/base/core.c:3864 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task syz.2.552:6875 blocked for more than 144 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.552 state:D stack:23808 pid:6875 tgid:6875 ppid:5334 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 rpm_resume+0x504/0x1670 drivers/base/power/runtime.c:834 rpm_resume+0x8fe/0x1670 drivers/base/power/runtime.c:892 __pm_runtime_resume+0x120/0x180 drivers/base/power/runtime.c:1172 pm_runtime_resume_and_get include/linux/pm_runtime.h:430 [inline] usb_autopm_get_interface+0x22/0xf0 drivers/usb/core/driver.c:1833 wdm_manage_power+0x1c/0xa0 drivers/usb/class/cdc-wdm.c:1134 wdm_release+0x20f/0x460 drivers/usb/class/cdc-wdm.c:779 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:228 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffa94d7dff9 RSP: 002b:00007ffa9505fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffa94f37a80 RCX: 00007ffa94d7dff9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ffa94f37a80 R08: 0000000000000000 R09: 00007ffa9505fe7f R10: 000000000003fda0 R11: 0000000000000246 R12: 000000000004240e R13: 00007ffa9505fc90 R14: 0000000000000032 R15: ffffffffffffffff INFO: task syz.0.553:6878 blocked for more than 145 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.553 state:D stack:25472 pid:6878 tgid:6877 ppid:5328 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752 wdm_open+0x56/0x550 drivers/usb/class/cdc-wdm.c:715 usb_open+0x14b/0x1d0 drivers/usb/core/file.c:47 chrdev_open+0x521/0x600 fs/char_dev.c:414 do_dentry_open+0x978/0x1460 fs/open.c:958 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1b1b57c990 RSP: 002b:00007f1b1c44ab70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1b1b57c990 RDX: 0000000000000002 RSI: 00007f1b1c44ac10 RDI: 00000000ffffff9c RBP: 00007f1b1c44ac10 R08: 0000000000000000 R09: 00007f1b1c44a987 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f1b1b735f80 R15: 00007f1b1b85fa28 INFO: task syz.4.554:6884 blocked for more than 146 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.554 state:D stack:26816 pid:6884 tgid:6883 ppid:5335 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 chrdev_open+0x521/0x600 fs/char_dev.c:414 do_dentry_open+0x978/0x1460 fs/open.c:958 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe2bd77c990 RSP: 002b:00007fe2be5b1b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fe2bd77c990 RDX: 0000000000000002 RSI: 00007fe2be5b1c10 RDI: 00000000ffffff9c RBP: 00007fe2be5b1c10 R08: 0000000000000000 R09: 00007fe2be5b1987 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fe2bd935f80 R15: 00007fe2bda5fa28 INFO: task syz.1.555:6886 blocked for more than 146 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.555 state:D stack:26816 pid:6886 tgid:6885 ppid:5327 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 chrdev_open+0x521/0x600 fs/char_dev.c:414 do_dentry_open+0x978/0x1460 fs/open.c:958 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f905ef7c990 RSP: 002b:00007f905fcabb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f905ef7c990 RDX: 0000000000000002 RSI: 00007f905fcabc10 RDI: 00000000ffffff9c RBP: 00007f905fcabc10 R08: 0000000000000000 R09: 00007f905fcab987 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f905f135f80 R15: 00007f905f25fa28 Showing all locks held in the system: 3 locks held by kworker/u8:1/12: 1 lock held by khungtaskd/30: #0: ffffffff8e937e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e937e20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6720 3 locks held by kworker/u8:6/78: #0: ffff88802dcf1148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88802dcf1148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc900020bfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc900020bfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0 net/ipv6/addrconf.c:4196 3 locks held by kworker/u8:7/81: 3 locks held by kworker/u8:8/1125: #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003de7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003de7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:276 1 lock held by klogd/4680: #0: ffff8880b863ea98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:593 2 locks held by getty/4997: #0: ffff888032c420a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211 6 locks held by kworker/1:3/5252: #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003bf7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003bf7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144748190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #2: ffff888144748190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888079468190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #3: ffff888079468190 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #4: ffff8880637a8160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #4: ffff8880637a8160 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #5: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 6 locks held by kworker/0:3/5316: #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003eb7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003eb7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144777190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #2: ffff888144777190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888028724190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #3: ffff888028724190 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #4: ffff888064dd0160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #4: ffff888064dd0160 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #5: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 3 locks held by kworker/1:5/5379: #0: ffff88801c29a148 ((wq_completion)pm){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801c29a148 ((wq_completion)pm){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003c37d00 ((work_completion)(&dev->power.work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003c37d00 ((work_completion)(&dev->power.work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144762510 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3206 [inline] #2: ffff888144762510 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_port_suspend+0x1c6/0x14d0 drivers/usb/core/hub.c:3463 6 locks held by kworker/1:6/5396: #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc9000341fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc9000341fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144767190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #2: ffff888144767190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888031a1d190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #3: ffff888031a1d190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888075741160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #4: ffff888075741160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline] #4: ffff888075741160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1293 #5: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_deregister_dev+0x88/0x210 drivers/usb/core/file.c:186 1 lock held by syz.2.552/6875: #0: ffffffff8f634668 (wdm_mutex){+.+.}-{3:3}, at: wdm_release+0x4f/0x460 drivers/usb/class/cdc-wdm.c:764 2 locks held by syz.0.553/6878: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 #1: ffffffff8f634668 (wdm_mutex){+.+.}-{3:3}, at: wdm_open+0x56/0x550 drivers/usb/class/cdc-wdm.c:715 1 lock held by syz.4.554/6884: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.555/6886: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.560/6941: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.559/6940: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.562/6949: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.563/6952: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.569/7001: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.570/7004: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.572/7010: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.571/7013: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.578/7051: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.579/7063: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.581/7068: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.582/7073: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.587/7090: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.589/7110: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.590/7126: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.592/7131: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.595/7145: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.597/7159: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.599/7184: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.601/7198: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.603/7209: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.605/7223: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.608/7239: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.610/7258: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.612/7272: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.614/7288: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.616/7302: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.619/7316: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.621/7332: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.623/7346: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.625/7363: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.628/7379: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.630/7390: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.632/7409: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz-executor/7413: #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6672 1 lock held by syz.1.634/7423: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 2 locks held by syz-executor/7427: #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6672 #1: ffffffff8e93d3b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline] #1: ffffffff8e93d3b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:976 2 locks held by syz-executor/7440: #0: ffffffff8fcc62d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:490 #1: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 net/ipv4/nexthop.c:3885 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xff4/0x1040 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: bat_events batadv_nc_worker RIP: 0010:debug_lockdep_rcu_enabled+0x2a/0x40 kernel/rcu/update.c:321 Code: f3 0f 1e fa 31 c0 83 3d 5f 70 56 04 00 74 1e 83 3d b6 a1 56 04 00 74 15 65 48 8b 0c 25 c0 d7 03 00 31 c0 83 b9 dc 0a 00 00 00 <0f> 94 c0 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 RSP: 0018:ffffc90000117b50 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888028a1ea40 RCX: ffff88801ce85a00 RDX: dffffc0000000000 RSI: ffffffff8c0adc40 RDI: ffffffff8c6101e0 RBP: ffff88802894d430 R08: ffffffff942c9807 R09: 1ffffffff2859300 R10: dffffc0000000000 R11: fffffbfff2859301 R12: ffff8880642b4cc0 R13: 0000000000000286 R14: ffff888028a1ea40 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f14cc267d60 CR3: 000000007dedc000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_lock include/linux/rcupdate.h:850 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline] batadv_nc_worker+0xf5/0x610 net/batman-adv/network-coding.c:719 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 final repro crashed as (corrupted=false): INFO: task kworker/1:3:5252 blocked for more than 143 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:3 state:D stack:20416 pid:5252 tgid:5252 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 wdm_create+0x11cf/0x16d0 drivers/usb/class/cdc-wdm.c:1113 wdm_probe+0x21e/0x300 drivers/usb/class/cdc-wdm.c:1165 usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254 usb_probe_device+0x1b8/0x380 drivers/usb/core/driver.c:294 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2d6d/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:3:5316 blocked for more than 143 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:20416 pid:5316 tgid:5316 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 wdm_create+0x11cf/0x16d0 drivers/usb/class/cdc-wdm.c:1113 wdm_probe+0x21e/0x300 drivers/usb/class/cdc-wdm.c:1165 usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2210 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254 usb_probe_device+0x1b8/0x380 drivers/usb/core/driver.c:294 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:534 device_add+0x856/0xbf0 drivers/base/core.c:3675 usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2651 hub_port_connect drivers/usb/core/hub.c:5521 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x2d6d/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:6:5396 blocked for more than 144 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:6 state:D stack:20416 pid:5396 tgid:5396 ppid:2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 usb_deregister_dev+0x88/0x210 drivers/usb/core/file.c:186 wdm_disconnect+0x33/0x520 drivers/usb/class/cdc-wdm.c:1214 usb_unbind_interface+0x25e/0x940 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1296 bus_remove_device+0x34f/0x420 drivers/base/bus.c:576 device_del+0x57a/0x9b0 drivers/base/core.c:3864 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1418 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2304 hub_port_connect drivers/usb/core/hub.c:5361 [inline] hub_port_connect_change drivers/usb/core/hub.c:5661 [inline] port_event drivers/usb/core/hub.c:5821 [inline] hub_event+0x1ebc/0x5150 drivers/usb/core/hub.c:5903 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task syz.2.552:6875 blocked for more than 144 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.552 state:D stack:23808 pid:6875 tgid:6875 ppid:5334 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 rpm_resume+0x504/0x1670 drivers/base/power/runtime.c:834 rpm_resume+0x8fe/0x1670 drivers/base/power/runtime.c:892 __pm_runtime_resume+0x120/0x180 drivers/base/power/runtime.c:1172 pm_runtime_resume_and_get include/linux/pm_runtime.h:430 [inline] usb_autopm_get_interface+0x22/0xf0 drivers/usb/core/driver.c:1833 wdm_manage_power+0x1c/0xa0 drivers/usb/class/cdc-wdm.c:1134 wdm_release+0x20f/0x460 drivers/usb/class/cdc-wdm.c:779 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:228 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffa94d7dff9 RSP: 002b:00007ffa9505fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffa94f37a80 RCX: 00007ffa94d7dff9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ffa94f37a80 R08: 0000000000000000 R09: 00007ffa9505fe7f R10: 000000000003fda0 R11: 0000000000000246 R12: 000000000004240e R13: 00007ffa9505fc90 R14: 0000000000000032 R15: ffffffffffffffff INFO: task syz.0.553:6878 blocked for more than 145 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.553 state:D stack:25472 pid:6878 tgid:6877 ppid:5328 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752 wdm_open+0x56/0x550 drivers/usb/class/cdc-wdm.c:715 usb_open+0x14b/0x1d0 drivers/usb/core/file.c:47 chrdev_open+0x521/0x600 fs/char_dev.c:414 do_dentry_open+0x978/0x1460 fs/open.c:958 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1b1b57c990 RSP: 002b:00007f1b1c44ab70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1b1b57c990 RDX: 0000000000000002 RSI: 00007f1b1c44ac10 RDI: 00000000ffffff9c RBP: 00007f1b1c44ac10 R08: 0000000000000000 R09: 00007f1b1c44a987 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f1b1b735f80 R15: 00007f1b1b85fa28 INFO: task syz.4.554:6884 blocked for more than 146 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.554 state:D stack:26816 pid:6884 tgid:6883 ppid:5335 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 chrdev_open+0x521/0x600 fs/char_dev.c:414 do_dentry_open+0x978/0x1460 fs/open.c:958 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe2bd77c990 RSP: 002b:00007fe2be5b1b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fe2bd77c990 RDX: 0000000000000002 RSI: 00007fe2be5b1c10 RDI: 00000000ffffff9c RBP: 00007fe2be5b1c10 R08: 0000000000000000 R09: 00007fe2be5b1987 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fe2bd935f80 R15: 00007fe2bda5fa28 INFO: task syz.1.555:6886 blocked for more than 146 seconds. Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.555 state:D stack:26816 pid:6886 tgid:6885 ppid:5327 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 chrdev_open+0x521/0x600 fs/char_dev.c:414 do_dentry_open+0x978/0x1460 fs/open.c:958 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f905ef7c990 RSP: 002b:00007f905fcabb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f905ef7c990 RDX: 0000000000000002 RSI: 00007f905fcabc10 RDI: 00000000ffffff9c RBP: 00007f905fcabc10 R08: 0000000000000000 R09: 00007f905fcab987 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f905f135f80 R15: 00007f905f25fa28 Showing all locks held in the system: 3 locks held by kworker/u8:1/12: 1 lock held by khungtaskd/30: #0: ffffffff8e937e20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937e20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e937e20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6720 3 locks held by kworker/u8:6/78: #0: ffff88802dcf1148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88802dcf1148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc900020bfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc900020bfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0 net/ipv6/addrconf.c:4196 3 locks held by kworker/u8:7/81: 3 locks held by kworker/u8:8/1125: #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003de7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003de7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:276 1 lock held by klogd/4680: #0: ffff8880b863ea98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:593 2 locks held by getty/4997: #0: ffff888032c420a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211 6 locks held by kworker/1:3/5252: #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003bf7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003bf7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144748190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #2: ffff888144748190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888079468190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #3: ffff888079468190 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #4: ffff8880637a8160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #4: ffff8880637a8160 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #5: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 6 locks held by kworker/0:3/5316: #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003eb7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003eb7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144777190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #2: ffff888144777190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888028724190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #3: ffff888028724190 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #4: ffff888064dd0160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #4: ffff888064dd0160 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #5: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_register_dev+0x13a/0x5a0 drivers/usb/core/file.c:134 3 locks held by kworker/1:5/5379: #0: ffff88801c29a148 ((wq_completion)pm){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801c29a148 ((wq_completion)pm){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc90003c37d00 ((work_completion)(&dev->power.work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90003c37d00 ((work_completion)(&dev->power.work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144762510 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3206 [inline] #2: ffff888144762510 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_port_suspend+0x1c6/0x14d0 drivers/usb/core/hub.c:3463 6 locks held by kworker/1:6/5396: #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888020ab0148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc9000341fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc9000341fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffff888144767190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #2: ffff888144767190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5849 #3: ffff888031a1d190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #3: ffff888031a1d190 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0x103/0x950 drivers/usb/core/hub.c:2295 #4: ffff888075741160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1014 [inline] #4: ffff888075741160 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline] #4: ffff888075741160 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1293 #5: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_deregister_dev+0x88/0x210 drivers/usb/core/file.c:186 1 lock held by syz.2.552/6875: #0: ffffffff8f634668 (wdm_mutex){+.+.}-{3:3}, at: wdm_release+0x4f/0x460 drivers/usb/class/cdc-wdm.c:764 2 locks held by syz.0.553/6878: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 #1: ffffffff8f634668 (wdm_mutex){+.+.}-{3:3}, at: wdm_open+0x56/0x550 drivers/usb/class/cdc-wdm.c:715 1 lock held by syz.4.554/6884: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.555/6886: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.560/6941: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.559/6940: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.562/6949: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.563/6952: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.569/7001: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.570/7004: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.572/7010: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.571/7013: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.578/7051: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.579/7063: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.581/7068: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.582/7073: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.587/7090: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.589/7110: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.590/7126: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.592/7131: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.595/7145: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.597/7159: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.599/7184: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.601/7198: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.603/7209: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.605/7223: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.608/7239: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.610/7258: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.612/7272: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.614/7288: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.616/7302: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.619/7316: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.621/7332: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.623/7346: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.1.625/7363: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.4.628/7379: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.0.630/7390: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz.2.632/7409: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 1 lock held by syz-executor/7413: #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6672 1 lock held by syz.1.634/7423: #0: ffffffff8f5ac8f0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 2 locks held by syz-executor/7427: #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6672 #1: ffffffff8e93d3b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline] #1: ffffffff8e93d3b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:976 2 locks held by syz-executor/7440: #0: ffffffff8fcc62d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:490 #1: ffffffff8fcd2dc8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 net/ipv4/nexthop.c:3885 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xff4/0x1040 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: bat_events batadv_nc_worker RIP: 0010:debug_lockdep_rcu_enabled+0x2a/0x40 kernel/rcu/update.c:321 Code: f3 0f 1e fa 31 c0 83 3d 5f 70 56 04 00 74 1e 83 3d b6 a1 56 04 00 74 15 65 48 8b 0c 25 c0 d7 03 00 31 c0 83 b9 dc 0a 00 00 00 <0f> 94 c0 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 RSP: 0018:ffffc90000117b50 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888028a1ea40 RCX: ffff88801ce85a00 RDX: dffffc0000000000 RSI: ffffffff8c0adc40 RDI: ffffffff8c6101e0 RBP: ffff88802894d430 R08: ffffffff942c9807 R09: 1ffffffff2859300 R10: dffffc0000000000 R11: fffffbfff2859301 R12: ffff8880642b4cc0 R13: 0000000000000286 R14: ffff888028a1ea40 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f14cc267d60 CR3: 000000007dedc000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_lock include/linux/rcupdate.h:850 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline] batadv_nc_worker+0xf5/0x610 net/batman-adv/network-coding.c:719 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244