Extracting prog: 1m10.816923811s
Minimizing prog: 11m47.062727539s
Simplifying prog options: 2m5.346136069s
Extracting C: 48.696659718s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300))
syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
syz_ublk_setup_queues(0xffffffffffffffff, r5, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180), &(0x7f0000000100), &(0x7f0000000140))
r1 = syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2)
syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r2=>0x0)
r3 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r1, 0x2)
syz_ublk_setup_queues(r3, r2, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r3, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, 0x0, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, 0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, 0x0, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, 0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, 0x0)
r4 = syz_ublk_add_dev(r1, r2, r3, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, 0x0, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, 0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r6, 0x0, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(0x0, r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, 0x0, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, 0x0, 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program did not crash
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xdc81}, &(0x7f0000000180)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x0, 0x100, 0xffffffff, 0x2000}, &(0x7f0000000800)=[{}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xde1, 0x0, 0x0, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffd, 0x10000, 0x3, 0xaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaf97, 0x800, 0x1}}], 0x1, &(0x7f0000000900)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x2, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
reproducing took 17m29.456870066s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 12 at drivers/block/ublk_drv.c:1583 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Code: 5d e9 c3 00 53 02 cc e8 9d 26 33 fe 0f 0b eb e3 e8 94 26 33 fe 0f 0b eb da e8 8b 26 33 fe 0f 0b e9 4d fe ff ff e8 7f 26 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc900000c7990 EFLAGS: 00010293
RAX: ffffffff835450c1 RBX: 1ffff11023037995 RCX: ffff888102651300
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: ffffc900000c79e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff835440a0 R12: ffff888117be5f00
R13: ffff8881181bcc80 R14: ffff888117d9b100 R15: ffff888117d9b110
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000074aa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1979
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f4/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 12 at drivers/block/ublk_drv.c:1583 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1583
Code: 5d e9 c3 00 53 02 cc e8 9d 26 33 fe 0f 0b eb e3 e8 94 26 33 fe 0f 0b eb da e8 8b 26 33 fe 0f 0b e9 4d fe ff ff e8 7f 26 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc900000c7990 EFLAGS: 00010293
RAX: ffffffff835450c1 RBX: 1ffff11023037995 RCX: ffff888102651300
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: ffffc900000c79e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff835440a0 R12: ffff888117be5f00
R13: ffff8881181bcc80 R14: ffff888117d9b100 R15: ffff888117d9b110
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000074aa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1979
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f4/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c4/0x360 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---