Extracting prog: 9m35.51151793s
Minimizing prog: 9m8.928091783s
Simplifying prog options: 20m22.413584995s
Extracting C: 5m14.877639934s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program did not crash
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=9m1.084740802s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=9m1.084740802s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=9m1.084740802s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
extracting C reproducer
testing compiled C program (duration=9m1.084740802s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=9m1.084740802s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program did not crash
testing program (duration=9m1.084740802s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
validation run: crashed=true
testing program (duration=9m1.084740802s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
validation run: crashed=true
testing program (duration=9m1.084740802s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nci
detailed listing:
executing program 0:
openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

program crashed: BUG: MAX_LOCKDEP_KEYS too low!
validation run: crashed=true
reproducing took 1h0m26.432314211s
repro crashed as (corrupted=false):
BUG: MAX_LOCKDEP_KEYS too low!
turning off the locking correctness validator.
CPU: 1 PID: 31083 Comm: syz.0.6097 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 register_lock_class+0x6cf/0x8a0 kernel/locking/lockdep.c:1321
 __lock_acquire+0x188/0x7d40 kernel/locking/lockdep.c:5014
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
 touch_wq_lockdep_map kernel/workqueue.c:3138 [inline]
 __flush_workqueue+0x16b/0x13d0 kernel/workqueue.c:3168
 drain_workqueue+0xd3/0x380 kernel/workqueue.c:3332
 destroy_workqueue+0xc4/0xf20 kernel/workqueue.c:4826
 nci_unregister_device+0xd4/0x260 net/nfc/nci/core.c:1307
 virtual_ncidev_close+0x59/0x90 drivers/nfc/virtual_ncidev.c:168
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f11e9b9c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedd866a78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffedd866b60 RCX: 00007f11e9b9c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000009245f R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2cf20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f11e9e15fac R14: 00007f11e9e15fa8 R15: 00007f11e9e15fa0
 </TASK>

final repro crashed as (corrupted=false):
BUG: MAX_LOCKDEP_KEYS too low!
turning off the locking correctness validator.
CPU: 1 PID: 31083 Comm: syz.0.6097 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 register_lock_class+0x6cf/0x8a0 kernel/locking/lockdep.c:1321
 __lock_acquire+0x188/0x7d40 kernel/locking/lockdep.c:5014
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
 touch_wq_lockdep_map kernel/workqueue.c:3138 [inline]
 __flush_workqueue+0x16b/0x13d0 kernel/workqueue.c:3168
 drain_workqueue+0xd3/0x380 kernel/workqueue.c:3332
 destroy_workqueue+0xc4/0xf20 kernel/workqueue.c:4826
 nci_unregister_device+0xd4/0x260 net/nfc/nci/core.c:1307
 virtual_ncidev_close+0x59/0x90 drivers/nfc/virtual_ncidev.c:168
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f11e9b9c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedd866a78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffedd866b60 RCX: 00007f11e9b9c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000009245f R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2cf20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f11e9e15fac R14: 00007f11e9e15fa8 R15: 00007f11e9e15fa0
 </TASK>