Extracting prog: 8m3.955811621s Minimizing prog: 18m22.178893036s Simplifying prog options: 20m35.136363879s Extracting C: 5m15.196784536s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program crashed: INFO: rcu detected stall in corrupted single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, 0x0, 0x0) program did not crash testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES64], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=9m2.370886411s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program did not crash testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program did not crash testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program did not crash validation run: crashed=false testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program crashed: INFO: task hung in __input_unregister_device validation run: crashed=true testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program crashed: INFO: task hung in wg_netns_pre_exit validation run: crashed=true testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program crashed: INFO: task hung in corrupted validation run: crashed=true reproducing took 1h25m21.247497732s repro crashed as (corrupted=true): INFO: task kworker/1:8:6116 blocked for more than 152 seconds. Not tainted syzkaller #0 report is corrupted, running repro again testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program crashed: INFO: rcu detected stall in corrupted report is corrupted, running repro again testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program did not crash report is corrupted, running repro again testing program (duration=9m2.370886411s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0) program crashed: INFO: task hung in genl_rcv_msg final repro crashed as (corrupted=false): INFO: task dhcpcd:5487 blocked for more than 153 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:24664 pid:5487 tgid:5487 ppid:1 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 genl_lock net/netlink/genetlink.c:35 [inline] genl_op_lock net/netlink/genetlink.c:60 [inline] genl_rcv_msg+0x10d/0x790 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc36ee0f407 RSP: 002b:00007ffd356adeb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fc36ed85740 RCX: 00007fc36ee0f407 RDX: 0000000000000000 RSI: 00007ffd356adf30 RDI: 000000000000000e RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000055947a4cee10 R13: 000000000000000e R14: 00007ffd356c23f0 R15: 000055949a95e2e0 INFO: task syz-executor:6160 blocked for more than 153 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21592 pid:6160 tgid:6160 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 genl_lock net/netlink/genetlink.c:35 [inline] genl_op_lock net/netlink/genetlink.c:60 [inline] genl_rcv_msg+0x10d/0x790 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8aaf3915dc RSP: 002b:00007fff250749a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f8ab0114620 RCX: 00007f8aaf3915dc RDX: 0000000000000020 RSI: 00007f8ab0114670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007fff250749f4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 00007fff25074a48 R14: 00007f8ab0114670 R15: 0000000000000000 INFO: task syz-executor:6175 blocked for more than 154 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21592 pid:6175 tgid:6175 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 genl_lock net/netlink/genetlink.c:35 [inline] genl_op_lock net/netlink/genetlink.c:60 [inline] genl_rcv_msg+0x10d/0x790 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3dfd5915dc RSP: 002b:00007ffe15892ea0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f3dfe314620 RCX: 00007f3dfd5915dc RDX: 0000000000000024 RSI: 00007f3dfe314670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffe15892ef4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f3dfe314670 R15: 0000000000000000 INFO: task syz-executor:6456 blocked for more than 155 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:28088 pid:6456 tgid:6456 ppid:1 task_flags:0x400040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 kobject_uevent_env+0x55c/0x9f0 lib/kobject_uevent.c:608 device_add+0x557/0xb80 drivers/base/core.c:3670 hci_register_dev+0x36c/0x8b0 net/bluetooth/hci_core.c:2621 __vhci_create_device drivers/bluetooth/hci_vhci.c:451 [inline] vhci_create_device+0x39c/0x650 drivers/bluetooth/hci_vhci.c:479 vhci_get_user drivers/bluetooth/hci_vhci.c:536 [inline] vhci_write+0x3ce/0x4a0 drivers/bluetooth/hci_vhci.c:616 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f020d18e1c0 RSP: 002b:00007ffd86c5c968 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f020d18e1c0 RDX: 0000000000000002 RSI: 00007ffd86c5c97a RDI: 00000000000000ca RBP: 00007ffd86c5ca40 R08: 0000000000000000 R09: 00007f020df1d6c0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 R13: 00007ffd86c5ca48 R14: 00007ffd86c5ccc8 R15: 0000000000000000 INFO: task syz-executor:6457 blocked for more than 156 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:27160 pid:6457 tgid:6457 ppid:1 task_flags:0x400040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 kobject_uevent_env+0x55c/0x9f0 lib/kobject_uevent.c:608 device_add+0x557/0xb80 drivers/base/core.c:3670 hci_register_dev+0x36c/0x8b0 net/bluetooth/hci_core.c:2621 __vhci_create_device drivers/bluetooth/hci_vhci.c:451 [inline] vhci_create_device+0x39c/0x650 drivers/bluetooth/hci_vhci.c:479 vhci_get_user drivers/bluetooth/hci_vhci.c:536 [inline] vhci_write+0x3ce/0x4a0 drivers/bluetooth/hci_vhci.c:616 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efd9898e1c0 RSP: 002b:00007ffd2934efb8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007efd9898e1c0 RDX: 0000000000000002 RSI: 00007ffd2934efca RDI: 00000000000000ca RBP: 00007ffd2934f090 R08: 0000000000000000 R09: 00007efd9971d6c0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 R13: 00007ffd2934f098 R14: 00007ffd2934f318 R15: 0000000000000000 INFO: task syz-executor:6458 blocked for more than 156 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:28088 pid:6458 tgid:6458 ppid:1 task_flags:0x400040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0x165/0x360 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 kobject_uevent_env+0x55c/0x9f0 lib/kobject_uevent.c:608 device_add+0x557/0xb80 drivers/base/core.c:3670 hci_register_dev+0x36c/0x8b0 net/bluetooth/hci_core.c:2621 __vhci_create_device drivers/bluetooth/hci_vhci.c:451 [inline] vhci_create_device+0x39c/0x650 drivers/bluetooth/hci_vhci.c:479 vhci_get_user drivers/bluetooth/hci_vhci.c:536 [inline] vhci_write+0x3ce/0x4a0 drivers/bluetooth/hci_vhci.c:616 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd00458e1c0 RSP: 002b:00007ffdfbf99e98 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd00458e1c0 RDX: 0000000000000002 RSI: 00007ffdfbf99eaa RDI: 00000000000000ca RBP: 00007ffdfbf99f70 R08: 0000000000000000 R09: 00007fd00531d6c0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 R13: 00007ffdfbf99f78 R14: 00007ffdfbf9a1f8 R15: 0000000000000000 Showing all locks held in the system: 1 lock held by kthreadd/2: 1 lock held by khungtaskd/32: #0: ffffffff8df41aa0 (rcu_read_lock ){....}-{1:3} , at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] , at: rcu_read_lock include/linux/rcupdate.h:867 [inline] , at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 8 locks held by kworker/u8:2/37: 3 locks held by kworker/u8:4/60: 4 locks held by kworker/u8:5/136: 2 locks held by kworker/0:2/773: 3 locks held by kworker/u8:8/1947: 3 locks held by kworker/u8:9/3414: 3 locks held by kworker/u8:11/3727: 5 locks held by kworker/u9:1/5143: 1 lock held by jbd2/sda1-8/5155: 1 lock held by klogd/5182: 1 lock held by udevd/5193: 2 locks held by dhcpcd/5487: #0: ffffffff8f379ab0 (cb_lock ){++++}-{4:4} , at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f3798c8 ( genl_mutex){+.+.}-{4:4} , at: genl_lock net/netlink/genetlink.c:35 [inline] , at: genl_op_lock net/netlink/genetlink.c:60 [inline] , at: genl_rcv_msg+0x10d/0x790 net/netlink/genetlink.c:1209 2 locks held by getty/5582: #0: ffff88814e0d70a0 ( &tty->ldisc_sem ){++++}-{0:0} , at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 ( &ldata->atomic_read_lock ){+.+.}-{4:4} , at: n_tty_read+0x449/0x1460 drivers/tty/n_tty.c:2211 7 locks held by kworker/0:3/5867: 5 locks held by kworker/u9:2/5888: #0: ffff8880795b4148 ( (wq_completion)hci10 ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3232 [inline] , at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340 #1: ffffc9000425fbc0 ( (work_completion)(&hdev->cmd_sync_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3233 [inline] , at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340 #2: ffff888031a24ec0 ( &hdev->req_lock ){+.+.}-{4:4} , at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff888031a240c0 (&hdev->lock ){+.+.}-{4:4} , at: hci_abort_conn_sync+0x242/0xe30 net/bluetooth/hci_sync.c:5702 #4: ffffffff8f483a08 (hci_cb_list_lock ){+.+.}-{4:4} , at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] , at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:4/5951: #0: ffff88807959e948 ((wq_completion)hci11 ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3232 [inline] , at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340 #1: ffffc90003c6fbc0 ( (work_completion)(&hdev->cmd_sync_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3233 [inline] , at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340 #2: ffff88807eaa8ec0 ( &hdev->req_lock ){+.+.}-{4:4} , at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88807eaa80c0 (&hdev->lock ){+.+.}-{4:4} , at: hci_abort_conn_sync+0x242/0xe30 net/bluetooth/hci_sync.c:5702 #4: ffffffff8f483a08 (hci_cb_list_lock ){+.+.}-{4:4} , at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] , at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:5/5954: #0: ffff88802f6e8148 ( (wq_completion)hci6 ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3232 [inline] , at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340 #1: ffffc90003c4fbc0 ( (work_completion)(&hdev->cmd_sync_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3233 [inline] , at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340 #2: ffff888029cf0ec0 ( &hdev->req_lock ){+.+.}-{4:4} , at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff888029cf00c0 (&hdev->lock ){+.+.}-{4:4} , at: hci_abort_conn_sync+0x242/0xe30 net/bluetooth/hci_sync.c:5702 #4: ffffffff8f483a08 (hci_cb_list_lock ){+.+.}-{4:4} , at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] , at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:6/5957: #0: ffff888031d84148 ( (wq_completion)hci9 ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3232 [inline] , at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340 #1: ffffc90003bffbc0 ((work_completion)(&hdev->cmd_sync_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3233 [inline] , at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340 #2: ffff888060f60ec0 ( &hdev->req_lock ){+.+.}-{4:4} , at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff888060f600c0 (&hdev->lock ){+.+.}-{4:4} , at: hci_abort_conn_sync+0x242/0xe30 net/bluetooth/hci_sync.c:5702 #4: ffffffff8df475f8 ( rcu_state.exp_mutex ){+.+.}-{4:4} , at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] , at: synchronize_rcu_expedited+0x2b1/0x6e0 kernel/rcu/tree_exp.h:956 5 locks held by kworker/u9:7/5958: #0: ffff88805c368948 ( (wq_completion)hci8 ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3232 [inline] , at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340 #1: ffffc90003befbc0 ( (work_completion)(&hdev->cmd_sync_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3233 [inline] , at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340 #2: ffff8880748ecec0 (&hdev->req_lock ){+.+.}-{4:4} , at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880748ec0c0 (&hdev->lock ){+.+.}-{4:4} , at: hci_abort_conn_sync+0x242/0xe30 net/bluetooth/hci_sync.c:5702 #4: ffffffff8f483a08 ( hci_cb_list_lock ){+.+.}-{4:4} , at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] , at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 6 locks held by kworker/1:5/6051: 2 locks held by kworker/0:7/6145: 4 locks held by kworker/u8:15/6149: 6 locks held by kworker/1:10/6157: #0: ffff888142a96148 ( (wq_completion)usb_hub_wq ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3232 [inline] , at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340 #1: ffffc90003a77bc0 ((work_completion)(&hub->events) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3233 [inline] , at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340 #2: ffff888028241198 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: hub_event+0x187/0x4ef0 drivers/usb/core/hub.c:5899 #3: ffff8880292b7198 ( &dev->mutex){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: usb_disconnect+0xf8/0x990 drivers/usb/core/hub.c:2336 #4: ffff88807925f160 ( &dev->mutex ){....}-{4:4} , at: device_lock include/linux/device.h:895 [inline] , at: __device_driver_lock drivers/base/dd.c:1104 [inline] , at: device_release_driver_internal+0xb6/0x800 drivers/base/dd.c:1302 #5: ffffffff8ed97fe8 ( input_mutex){+.+.}-{4:4} , at: class_mutex_constructor include/linux/mutex.h:253 [inline] , at: __input_unregister_device+0x328/0x640 drivers/input/input.c:2187 2 locks held by syz-executor/6160: #0: ffffffff8f379ab0 (cb_lock ){++++}-{4:4} , at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f3798c8 (genl_mutex ){+.+.}-{4:4} , at: genl_lock net/netlink/genetlink.c:35 [inline] , at: genl_op_lock net/netlink/genetlink.c:60 [inline] , at: genl_rcv_msg+0x10d/0x790 net/netlink/genetlink.c:1209 2 locks held by kworker/u8:16/6163: 2 locks held by syz-executor/6175: #0: ffffffff8f379ab0 ( cb_lock ){++++}-{4:4} , at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f3798c8 ( genl_mutex ){+.+.}-{4:4} , at: genl_lock net/netlink/genetlink.c:35 [inline] , at: genl_op_lock net/netlink/genetlink.c:60 [inline] , at: genl_rcv_msg+0x10d/0x790 net/netlink/genetlink.c:1209 3 locks held by syz-executor/6178: 4 locks held by udevd/6408: #0: ffff88807837b668 ( &p->lock ){+.+.}-{4:4} , at: seq_read_iter+0xb7/0xe20 fs/seq_file.c:182 #1: ffff88805bc64088 (&of->mutex #2){+.+.}-{4:4} , at: kernfs_seq_start+0x5c/0x420 fs/kernfs/file.c:172 #2: ffff88807647a008 ( kn->active #28 ){.+.+}-{0:0} , at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] , at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:173 #3: ffff88807af07198 (&dev->mutex ){....}-{4:4} , at: device_lock_interruptible include/linux/device.h:900 [inline] , at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 1 lock held by syz.8.30/6433: 2 locks held by syz.7.29/6436: 1 lock held by syz.2.31/6438: 2 locks held by syz-executor/6456: #0: ffff888028804918 (&data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6457: #0: ffff8880313f3918 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6458: #0: ffff8880313f6918 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6460: #0: ffff88805b74c918 (&data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6463: #0: ffff88807f71a918 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 (uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6464: #0: ffff8880278f5118 (&data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6468: #0: ffff88807b849918 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6469: #0: ffff888033f32118 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 (uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6470: #0: ffff888032bdf118 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 (uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6472: #0: ffff888058164918 ( &data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6475: #0: ffff88805e232118 (&data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 (uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 2 locks held by syz-executor/6476: #0: ffff88805e235118 (&data->open_mutex ){+.+.}-{4:4} , at: vhci_create_device+0x34/0x650 drivers/bluetooth/hci_vhci.c:478 #1: ffffffff8f68e5e8 ( uevent_sock_mutex ){+.+.}-{4:4} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xf95/0xfe0 kernel/hung_task.c:515 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: yealink 3-1:36.0: urb_irq_callback - urb status -71 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 37 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:_prb_read_valid+0xa2e/0xa90 kernel/printk/printk_ringbuffer.c:-1 Code: d9 1e 00 31 c0 49 bc 00 00 00 00 00 fc ff df eb 19 e8 66 d9 1e 00 31 c0 eb 10 e8 5d d9 1e 00 31 c0 eb 07 e8 54 d9 1e 00 b0 01 <48> 8b 4c 24 40 48 c7 84 24 c0 00 00 00 0e 36 e0 45 4a c7 04 21 00 RSP: 0018:ffffc900000070c0 EFLAGS: 00000046 RAX: ffffffff81a21f01 RBX: 00000000002633d8 RCX: ffff888141ac9e80 RDX: 0000000000000100 RSI: 00000000002633d8 RDI: 0000000000000001 RBP: ffffc90000007240 R08: ffff888141ac9e80 R09: 0000000000000003 R10: 00000000ffffffff R11: 0000000000000100 R12: dffffc0000000000 R13: ffffffff8de59700 R14: 0000000000000002 R15: ffffc90000007250 FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74be30e286 CR3: 000000000dd3a000 CR4: 0000000000350ef0 Call Trace: prb_read_valid+0x3c/0x60 kernel/printk/printk_ringbuffer.c:2242 printk_get_next_message+0x15c/0x7b0 kernel/printk/printk.c:2999 console_emit_next_record kernel/printk/printk.c:3083 [inline] console_flush_one_record kernel/printk/printk.c:3215 [inline] console_flush_all+0x4fb/0xb00 kernel/printk/printk.c:3289 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0xbb/0x190 kernel/printk/printk.c:3359 vprintk_emit+0x47b/0x550 kernel/printk/printk.c:2426 dev_vprintk_emit+0x337/0x3f0 drivers/base/core.c:4914