Extracting prog: 44m0.422666284s Minimizing prog: 3h23m22.869814804s Simplifying prog options: 21m29.078870225s Extracting C: 2m26.96174841s Simplifying C: 0s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rdma_cm-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$F2FS_IOC_FLUSH_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_NESTED_STATE-write$tcp_congestion-read$FUSE-write$FUSE_INIT-syz_open_dev$video-ioctl$VIDIOC_G_SELECTION-dup2-syz_kvm_setup_cpu$x86-socket$can_j1939-ioctl$KVM_RUN-prctl$PR_SET_MM_MAP-openat$rdma_cm-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$F2FS_IOC_FLUSH_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_NESTED_STATE-write$tcp_congestion-read$FUSE-write$FUSE_INIT-syz_open_dev$video-ioctl$VIDIOC_G_SELECTION-dup2-syz_kvm_setup_cpu$x86-socket$can_j1939-ioctl$KVM_RUN-prctl$PR_SET_MM_MAP detailed listing: executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_FLUSH_DEVICE(0xffffffffffffffff, 0x8008b705, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd3000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xffffffffffffffff}}) write$tcp_congestion(0xffffffffffffffff, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) r3 = syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x60500) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f00000000c0)={0x4, 0x2, 0x7, {0xd44f, 0x200200, 0x6, 0xffffffdf}}) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x57}], 0x1, 0x2e, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$F2FS_IOC_FLUSH_DEVICE(0xffffffffffffffff, 0x8008b705, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd3000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xffffffffffffffff}}) (async) write$tcp_congestion(0xffffffffffffffff, 0x0, 0x0) (async) read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) (async) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x60500) (async) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f00000000c0)={0x4, 0x2, 0x7, {0xd44f, 0x200200, 0x6, 0xffffffdf}}) (async) dup2(0xffffffffffffffff, 0xffffffffffffffff) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x57}], 0x1, 0x2e, 0x0, 0x0) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socketpair$unix-connect$unix-mmap-socket$vsock_stream-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-unshare-openat$ptp0-ioctl$PTP_EXTTS_REQUEST-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-ioctl$BLKZEROOUT-fsopen-socket-gettid-timer_create-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-timer_settime-futex-userfaultfd-ioctl$UFFDIO_API-mmap-madvise-ioctl$UFFDIO_REGISTER-syz_kvm_setup_syzos_vm$x86-ioctl$UFFDIO_CONTINUE detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x5) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$vsock_stream(0x28, 0x1, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x42060680) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x40500, 0x0) ioctl$PTP_EXTTS_REQUEST(r2, 0x40103d02, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="40025a23905eb99ead1d934b20b65bfdc57b284c4e6e422e7046c1753d08fed68111681c1583e386448333d15955e0428011d73277c7f04532af25e08e26b721a22ae16b843fdf5024c0e69630a13a5aa0179c959651fe7eca1cc8ced2"], 0x28}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000880) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0x4000000a00}) fsopen(0x0, 0x0) socket(0x11, 0x6, 0xc) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00'}) timer_settime(r5, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x80, 0x2, 0x0, 0x0, 0xffffeffa) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00004b2000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r7, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_mptcp-socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_PORT_GET-socket$nl_route-setsockopt$netlink_NETLINK_ADD_MEMBERSHIP-sendmsg$nl_route-setsockopt$inet_tcp_int-bind$inet-sendmmsg$inet-shutdown detailed listing: executing program 0: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002340)=ANY=[@ANYBLOB="2000000005143101000000000000000008000100020000e107000300"], 0x20}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000005e00cb7badbd70000300000000000000", @ANYRES32=0x0, @ANYBLOB="0c2ec7"], 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="00000000b99b5c65df4bb84674d78e", 0xf}], 0x1}}], 0x1, 0x20008000) shutdown(r0, 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-openat$nvme_fabrics-write-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-madvise-socket-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-socket$pppl2tp-socket$vsock_stream-bpf$MAP_CREATE-bpf$TOKEN_CREATE-inotify_init1-inotify_add_watch-mkdirat-dup-ioctl$UFFDIO_API-inotify_rm_watch-accept4$vsock_stream-bind$vsock_stream-add_key-keyctl$KEYCTL_PKEY_QUERY-socket$vsock_stream-madvise-socket$inet6_tcp-connect$inet6 detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r2, &(0x7f0000000200)="7472616e73706f72743d6c6f6f702c6e716e3d6e716e2e323031342d30382e6f72672e6e766d657870726573732e6469736391766572788d7af0897a6c5d0a", 0x3f) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r3 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x7800, 0x8, 0xfffffffc, 0xdc65}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r4, 0x29, 0x0, 0x6, 0x7f, 0x5, @mcast2, @mcast1, 0x0, 0x40, 0x6, 0x41}}) socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000000000000000000000000000000000986835d528c96f1d306c272c20c87f29df5213378379263ed25a6d11d36797a38100000200000000772052cbcde038ff6bc8fc799860bca74d6ba1c3d27d", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r6}, 0x8) r7 = inotify_init1(0x800) r8 = inotify_add_watch(r7, &(0x7f0000000200)='.\x00', 0x44000160) mkdirat(r2, &(0x7f0000000200)='./file0\x00', 0x11e) r9 = dup(r2) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0xe3}) inotify_rm_watch(r9, r8) r10 = accept4$vsock_stream(r5, &(0x7f00000001c0)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x800) bind$vsock_stream(r10, &(0x7f0000000040)={0x28, 0x0, 0x2710, @host}, 0x10) r11 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$KEYCTL_PKEY_QUERY(0x18, r11, 0x0, &(0x7f0000000140)='\x00', 0x0) socket$vsock_stream(0x28, 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r12, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$nl_netfilter-close-socket$nl_netfilter-close-socket$inet6_tcp-setsockopt$inet6_tcp_TCP_CONGESTION-setsockopt$inet6_tcp_int-sendto$inet6-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c40703a10000010200010902270001010080500904000003080650"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='hybla', 0x5) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, &(0x7f0000001b00)="a6", 0x1001, 0x20000045, &(0x7f0000000140)={0xa, 0x4001, 0xfffc, @loopback, 0xfffffffd}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) syz_usb_connect(0x4, 0x528, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xa6, 0x13, 0x1a, 0x40, 0x6f8, 0xe033, 0x5550, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x516, 0x3, 0x4, 0x1, 0x10, 0x5a, "", [{{0x9, 0x4, 0x6f, 0x9, 0x5, 0x9c, 0xeb, 0x72, 0x6, [@uac_control={{0xa, 0x24, 0x1, 0x8, 0x2a}, [@extension_unit={0x8, 0x24, 0x8, 0x2, 0x9, 0xb, '4'}, @processing_unit={0xd, 0x24, 0x7, 0x2, 0x3, 0x8, "b01c8fbbb802"}, @processing_unit={0xb, 0x24, 0x7, 0x1, 0x1, 0x0, "a975bdcb"}]}], [{{0x9, 0x5, 0xc, 0x1, 0x10, 0x10, 0x1, 0x6}}, {{0x9, 0x5, 0x3, 0xc, 0x10, 0x2, 0xe, 0xe, [@generic={0x37, 0xf, "38e6b5cc53b921b715d949a1cc7bad55f74843aa9b5a76b75873c12fabb8228fe02e7daca4ceab655b63329728677aa05f0c14781b"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x400, 0xc, 0x9, 0x32, [@generic={0xcc, 0x2, "dd8b3a77058c49adf12ae3f18767a05c33ec71fe8f4b02b38a300b47690d7be15e5bff7b321940849e4bede26b0314797b5f11da2ba7de5e13580c5e060fb74fbf3c80d5e263e380119cf15febef95e6c95aaae5f3eb6069ff80525f9c7d095fa00b7f06e8a3b80a1beadf453691ea12cbca38b31bfefff4d80236b4aa7c6538a1a9e0ab4d396ccde4b31dc63af447254ef2271ef4f7a1820f5033146c2f78406cac9c6a9a520b298f56678cfd2d8eef129affbf2d7abc2e0e5db03395254b77ea7c5b884bd0f6231bee"}]}}, {{0x9, 0x5, 0x5, 0x3, 0x71f, 0xbb, 0x2, 0x9}}, {{0x9, 0x5, 0xc, 0x2, 0x40, 0x2, 0x8, 0x6, [@generic={0x7e, 0x10, "86a047b1f480d684821fc445027ecf616db678d4643f777bf91d4d2c90853eb0144291431f7b673b097c62079b21eb2ee82ae73b1fe38d1588dae9f676f0adc82776523c2d30d4d2af54b937343de94fcc0343791f778eb93e8b7b7082e2de2ccb8c827ebc7f8dcaa563b50aaa29b246376e8652fa8579bca3724320"}]}}]}}, {{0x9, 0x4, 0x69, 0xff, 0x10, 0x1, 0x1, 0x29, 0x8, [@uac_as={[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2, 0xd834, 0x1, 0xa5}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0xf, 0x1, 0x9, 0x6, "f07d", "08bc"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x7, 0x5, 0x6, "1b0204d3052f328e17"}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x101}, {0xd, 0x24, 0xf, 0x1, 0x400, 0xed8a, 0xffff, 0x1}, {0x6, 0x24, 0x1a, 0x200, 0x6}}], [{{0x9, 0x5, 0xf, 0x0, 0x8, 0x9, 0xb, 0x80, [@generic={0xa2, 0x6, "69d3062a6dede1735af28289f109f7e635e971a90aee4cc6c23f1f9934e94c2bb4cb125fe4c8aedf5c50d725864508fec8fc456546c1acdd2874dda86f23b16ebd5fef9e1512af36efd8b29702831c447dc226bdf39020176bc6a0d2d753bbf67dd8cb3de84de97b312fbf739bed5dec3528d48c03476fb8161c6103c88e138852c36b45a99a7fe680a923aa25d54c440e5c9c16ff693c1f6d570a3f4c44f7ce"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x4}]}}, {{0x9, 0x5, 0x0, 0x3, 0x10, 0x4, 0xff, 0x6d, [@generic={0xb4, 0x7, "a84246bbc3b6385df5f725a8525a5ed9466e477fe9ecd5d05ad16ec4ab7dd642b0c327ea2d5486bc9a5d663fd6392583bbecea44286457458be504c3ba3b61e9aeee83908e9478b6c0f61db7081070b64ae1c0527f26b3c08f4fa18062562a588183155a033d2047f045e3789f13765981daccfd3d97710ebc3fac8a5d053bf4b3d4851b07725499f775a486a8742eb216b58db4512cf550a74d2dda79d85db80ab2b8cfd3f236d39beece6ef2c892fded1d"}]}}, {{0x9, 0x5, 0x3d5823e0eba85e5f, 0x10, 0x10, 0x9, 0x9, 0x5}}, {{0x9, 0x5, 0x3, 0x3, 0x10, 0x0, 0x47, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x80, 0x5}]}}, {{0x9, 0x5, 0x4, 0x3, 0x400, 0xf, 0x9, 0x6}}, {{0x9, 0x5, 0x7, 0x10, 0x400, 0x1, 0x5d}}, {{0x9, 0x5, 0x0, 0x10, 0x400, 0x6, 0xc0, 0x9}}, {{0x9, 0x5, 0x3, 0x0, 0x3ff, 0x8, 0x4e, 0x7}}, {{0x9, 0x5, 0xd, 0x0, 0x20, 0x4, 0x81, 0xf9}}, {{0x9, 0x5, 0x0, 0x0, 0x0, 0x9, 0x9}}, {{0x9, 0x5, 0x2, 0x10, 0x200, 0x0, 0x8, 0x1e}}, {{0x9, 0x5, 0x48ad74833fecb91d, 0x8, 0x8, 0x2, 0x4f, 0x0, [@generic={0x87, 0x3, "24be642cae3162a071a6d3bd616cfda981a4f2b20f9bc7a758812a5b4e8138b9e377779e73bdfea8b8796e574fbfc4f65ca18b19e488ff1acfb916936ce9be5cb2ec51b69bf7809da8cb068e8c871ae8c50a24647bc0d6af79c3935a9f7334fc37e68802415ef13a6a0c5a5d4d929711f919afda457f1eb70989f7a5a3edc6e9f917b612a9"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x8, 0x8}]}}, {{0x9, 0x5, 0xb, 0x4, 0x20, 0x6, 0x2, 0x3, [@generic={0x2e, 0x6, "214e50665a80726a50e3670122138a22d24cfc62486e0c1d18aef58c0399562632ab76a2cd43565a5f84b193"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0x387}]}}, {{0x9, 0x5, 0x1, 0x4, 0x3ff, 0xda, 0x1, 0xe8, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xf8, 0x40}]}}, {{0x9, 0x5, 0xf, 0x2, 0x8, 0x8, 0x4, 0x80}}, {{0x9, 0x5, 0x3, 0x8, 0x10, 0xe1, 0x4, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xcf, 0x6}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0xfe19}]}}]}}, {{0x9, 0x4, 0x6e, 0x3, 0x0, 0xff, 0x5d, 0x1, 0x5, [@hid_hid={0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xdd3}}]}}]}}]}}, &(0x7f00000009c0)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x201, 0x81, 0xa, 0x4, 0x10, 0x7}, 0x52, &(0x7f00000005c0)={0x5, 0xf, 0x52, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x0, 0x3, 0x1ff}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "4772622d1177f656c322f99fd870dc21"}, @ssp_cap={0x14, 0x10, 0xa, 0x5, 0x2, 0x0, 0xf000, 0x1, [0x0, 0x3f]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0x5, 0x78, 0x10}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "c75ea4d367737f6d1e9ddd65ec32727e"}]}, 0x9, [{0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x813}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x41a}}, {0x1a, &(0x7f00000006c0)=@string={0x1a, 0x3, "88828edd0d49c8b6590c8a488603de86d57463c6e02676d9"}}, {0xd3, &(0x7f0000000700)=@string={0xd3, 0x3, "236d6c1d5ae505761bc0762a8281155fc3f4116d8f295069defda94e41f25adfe7a604570a8fdb739aec32e3c543d41625a0d77e42ffb560bcd8d5be5e4c5e47f2056aefeb6dd5a883078452a510f2825881ea21f05dd421cfeca6532e2a586d344cf9649d696a6ef112a2d7873ccd9115461c39fbcd162739e174573cb87642008d159178117360f958e24672f15674cfe0e3010bcee3a242769fd03d65058bcde4410cac2b5b2574c0e006509c58b45b0c086eaa725f8f34181a15f174bd9e7c126b8966ee00ad14a2ae240fc52413db"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x445}}, {0x9a, &(0x7f0000000840)=@string={0x9a, 0x3, "a657f648b6db37d8b50284675b3acb01e1875301913335b90716a77e0d6b4fd4eb31205a23a06f72780ec1a858d8ccc72e9dae3ac25291caa7e8f641e55d0dd2200f5cfa08f7cf6580ef4e9c2f4a9b48ae45d59f337d76839950314ba8c99c6fab138dcf268376c788247d74c0254eede1b179701284466b6d626fc66497f6997e477734a7745a7879d89e29ff179f0c26f329396767f30c"}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x2a4a8dcb9238f30}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0x437}}, {0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x3409}}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE-getsockname$packet-socket$nl_route-sendmsg$nl_route-sendmsg$nl_route-sendmsg$nl_route_sched-fsconfig$FSCONFIG_SET_STRING detailed listing: executing program 0: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r4 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r4, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) move_mount(r5, &(0x7f0000002000)='\x00', r3, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r6, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r2, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r7 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_getmulticast={0x14, 0x3a, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r8, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r9], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r8, {}, {0xffff, 0x1}, {0xa, 0x1}}, [@TCA_CHAIN={0x8, 0xb, 0x9}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000340)='[27.0.0.1]:78\x1a:/\x00\x9cI\x84\xdd@\xd6\x8e\xabf #\xaaIl93\xa1\xe2\xba\x91\xe9\xf1', 0x0) program crashed: INFO: task hung in unbind_store single: successfully extracted reproducer found reproducer with 23 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE-getsockname$packet-socket$nl_route-sendmsg$nl_route-sendmsg$nl_route-sendmsg$nl_route_sched detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r3 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r3, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) move_mount(r4, &(0x7f0000002000)='\x00', r2, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r1, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r6 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_getmulticast={0x14, 0x3a, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r7, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r8], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r7, {}, {0xffff, 0x1}, {0xa, 0x1}}, [@TCA_CHAIN={0x8, 0xb, 0x9}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE-getsockname$packet-socket$nl_route-sendmsg$nl_route-sendmsg$nl_route detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_getmulticast={0x14, 0x3a, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r6, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r7], 0x3c}}, 0x0) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE-getsockname$packet-socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_getmulticast={0x14, 0x3a, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x20000000) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE-getsockname$packet-socket$nl_route detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) socket$nl_route(0x10, 0x3, 0x0) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE-getsockname$packet detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x3f) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket-sendmsg$NL80211_CMD_GET_COALESCE detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE-socket detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) socket(0x10, 0x803, 0x0) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write-ioctl$BTRFS_IOC_ENCODED_WRITE detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) move_mount(r3, &(0x7f0000002000)='\x00', r1, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000040)='5-1:1.0\x00', 0x8) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000640)={&(0x7f0000000540)=[{&(0x7f0000000440)="add5109b9372b7f48e918a10ce72669be6c1a693e3a91cba3e0fee7a3409518ef4a61ff49df453ffc00325b1889d36a27724cac47de3b261e02f4a94e8b7aaafbb8ff9aa3b91e9d44237274e803153fd6e7bc2f03ea2101c6a1cc1bfc0476783e31f7ca38a3bd3614a44ce3cb01c0023eb42af2d6bee1602653243b15af1df55e43f7890b15156b80963abba2d3c1a43d9f14c0313cf37e725b814286e77d27b0333ca15ada17677d84b0a659c90b0c1fe6b", 0xb2}, {&(0x7f0000000500)="2b6915ca6ef90c9e93c1600c224a0499cc6cd3a961a7826b7844104cf7bd138535de4b24a0e41b", 0x27}], 0x2, 0xae9b, 0x0, 0xb, 0x401, 0x1ff, 0x2, 0x4}) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-openat detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-nanosleep-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000005000)={0x0, 0x2faf080}, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-fsmount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0x0) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsconfig$FSCONFIG_CMD_CREATE-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) move_mount(0xffffffffffffffff, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-ioctl$AUTOFS_DEV_IOCTL_PROTOVER-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x434c}}, './sys_mnt\x00'}) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-openat-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) move_mount(r1, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-mkdirat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) move_mount(r1, &(0x7f0000002000)='\x00', 0xffffffffffffffff, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-bpf$BPF_LINK_CREATE_XDP-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x25, 0x0, @void}, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-socket$nl_route-mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: fsopen(&(0x7f0000000000)='ceph\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000002000)='\x00', r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, 0x0, 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write program did not crash simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-move_mount-syz_usb_connect-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000001000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, 0x0, r0, &(0x7f0000002000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000003000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000006000)='./sys_mnt/bus/usb/drivers/sisusb/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000040)='5-1:1.0\x00', 0x8) program crashed: INFO: task hung in unbind_store validation run: crashed=true reproducing took 4h45m36.268652174s repro crashed as (corrupted=false): INFO: task syz.4.23:6214 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.23 state:D stack:26984 pid:6214 tgid:6214 ppid:6171 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] __device_driver_lock drivers/base/dd.c:1170 [inline] device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 unbind_store+0x1a1/0x1d0 drivers/base/bus.c:244 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc2ad79e0d9 RSP: 002b:00007fc2adb4fae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fc2ada25fa0 RCX: 00007fc2ad79e0d9 RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000007 RBP: 00007fc2ad835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc2ada25fac R14: 00007fc2ada25fa0 R15: 00007fc2ada25fa0 Showing all locks held in the system: 5 locks held by kworker/0:0/9: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802b0291d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b0291d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88807737e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807737e1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888032d0c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888032d0c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 5 locks held by kworker/0:1/10: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888026cb11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888026cb11d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88803376c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88803376c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888077b351a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888077b351a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 5 locks held by kworker/1:0/24: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802b0911d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b0911d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88805ba801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805ba801d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805ba491a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805ba491a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 1 lock held by khungtaskd/31: #0: ffffffff8eb59d60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8eb59d60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8eb59d60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 5 locks held by kworker/0:2/984: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900050efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900050efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88823bf8c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88823bf8c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880339e61a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880339e61a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 2 locks held by getty/5365: #0: ffff8880361870a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 5 locks held by kworker/0:3/5623: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003927c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003927c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802b1321d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b1321d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88805ba871d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805ba871d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807f91b1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807f91b1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 6 locks held by kworker/0:4/5678: #0: ffff8880b863b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667 #1: ffff8880b8624440 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:933 #2: ffff88802a539120 (&r->consumer_lock#2){+.+.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline] #2: ffff88802a539120 (&r->consumer_lock#2){+.+.}-{3:3}, at: ptr_ring_consume_bh include/linux/ptr_ring.h:375 [inline] #2: ffff88802a539120 (&r->consumer_lock#2){+.+.}-{3:3}, at: wg_packet_decrypt_worker+0x90f/0xda0 drivers/net/wireguard/receive.c:499 #3: ffff8880b873b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667 #4: ffff8880b8724440 (psi_seq){-.-.}-{0:0}, at: psi_task_change+0xc9/0x320 kernel/sched/psi.c:919 #5: ffff8880b863b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667 5 locks held by kworker/0:5/5685: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900033a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900033a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888026bc21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888026bc21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88802b8271d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b8271d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802b8221a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802b8221a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 3 locks held by syz.4.23/6214: #0: ffff8880357b0460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff8880357b0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888059ae3480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 5 locks held by kworker/1:4/6250: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900036f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900036f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888029d1e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029d1e1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88802c14b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802c14b1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880784601a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880784601a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 5 locks held by kworker/0:6/6253: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003707c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003707c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802ab981d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802ab981d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff8880565f21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880565f21d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888032fae1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888032fae1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 3 locks held by syz.5.24/6331: #0: ffff88802277a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88802277a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88801e783880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.6.25/6358: #0: ffff88802aa38460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88802aa38460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88801ff1e480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.7.26/6378: #0: ffff8880784f4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff8880784f4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807de75080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.8.27/6397: #0: ffff88807bce0460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88807bce0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807a767080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.9.28/6419: #0: ffff888078308460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff888078308460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880336ff080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 5 locks held by kworker/0:8/6422: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003d37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003d37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888026dd81d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888026dd81d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88805bf5e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805bf5e1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888079b471a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888079b471a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 3 locks held by syz.0.29/6483: #0: ffff88805ac46460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88805ac46460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807e4ef480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.1.30/6666: #0: ffff88805c106460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88805c106460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888079a55c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.2.31/6857: #0: ffff888054e2a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff888054e2a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807421a880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 9b 7b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 2f 15 00 fb f4 0c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8e807ca0 EFLAGS: 00000242 RAX: 00000000016c5207 RBX: ffffffff819b4590 RCX: 0000000080000001 RDX: 0000000000000001 RSI: ffffffff8e22f03a RDI: ffffffff8c4bdc80 RBP: ffffffff8e807d78 R08: ffff8880b86338db R09: 1ffff110170c671b R10: dffffc0000000000 R11: ffffed10170c671c R12: 0000000000000000 R13: 1ffffffff1d11df0 R14: 1ffffffff1d00f9c R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888124f3f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055c6dff66168 CR3: 000000000e946000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 rest_init+0x378/0x3a0 init/main.c:723 start_kernel+0x392/0x3e0 init/main.c:1181 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x157 final repro crashed as (corrupted=false): INFO: task syz.4.23:6214 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.23 state:D stack:26984 pid:6214 tgid:6214 ppid:6171 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] __device_driver_lock drivers/base/dd.c:1170 [inline] device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 unbind_store+0x1a1/0x1d0 drivers/base/bus.c:244 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc2ad79e0d9 RSP: 002b:00007fc2adb4fae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fc2ada25fa0 RCX: 00007fc2ad79e0d9 RDX: 0000000000000008 RSI: 0000200000000040 RDI: 0000000000000007 RBP: 00007fc2ad835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc2ada25fac R14: 00007fc2ada25fa0 R15: 00007fc2ada25fa0 Showing all locks held in the system: 5 locks held by kworker/0:0/9: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802b0291d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b0291d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88807737e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807737e1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888032d0c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888032d0c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 5 locks held by kworker/0:1/10: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888026cb11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888026cb11d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88803376c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88803376c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888077b351a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888077b351a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 5 locks held by kworker/1:0/24: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802b0911d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b0911d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88805ba801d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805ba801d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805ba491a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805ba491a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 1 lock held by khungtaskd/31: #0: ffffffff8eb59d60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8eb59d60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8eb59d60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 5 locks held by kworker/0:2/984: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900050efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900050efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88823bf8c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88823bf8c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880339e61a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880339e61a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 2 locks held by getty/5365: #0: ffff8880361870a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 5 locks held by kworker/0:3/5623: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003927c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003927c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802b1321d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b1321d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88805ba871d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805ba871d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807f91b1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807f91b1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 6 locks held by kworker/0:4/5678: #0: ffff8880b863b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667 #1: ffff8880b8624440 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:933 #2: ffff88802a539120 (&r->consumer_lock#2){+.+.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:348 [inline] #2: ffff88802a539120 (&r->consumer_lock#2){+.+.}-{3:3}, at: ptr_ring_consume_bh include/linux/ptr_ring.h:375 [inline] #2: ffff88802a539120 (&r->consumer_lock#2){+.+.}-{3:3}, at: wg_packet_decrypt_worker+0x90f/0xda0 drivers/net/wireguard/receive.c:499 #3: ffff8880b873b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667 #4: ffff8880b8724440 (psi_seq){-.-.}-{0:0}, at: psi_task_change+0xc9/0x320 kernel/sched/psi.c:919 #5: ffff8880b863b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667 5 locks held by kworker/0:5/5685: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900033a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900033a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888026bc21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888026bc21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88802b8271d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b8271d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802b8221a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802b8221a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 3 locks held by syz.4.23/6214: #0: ffff8880357b0460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff8880357b0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888059ae3480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 5 locks held by kworker/1:4/6250: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900036f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900036f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888029d1e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888029d1e1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88802c14b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802c14b1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880784601a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880784601a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 5 locks held by kworker/0:6/6253: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003707c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003707c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802ab981d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802ab981d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff8880565f21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880565f21d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888032fae1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888032fae1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 3 locks held by syz.5.24/6331: #0: ffff88802277a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88802277a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88801e783880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.6.25/6358: #0: ffff88802aa38460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88802aa38460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88801ff1e480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.7.26/6378: #0: ffff8880784f4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff8880784f4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807de75080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.8.27/6397: #0: ffff88807bce0460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88807bce0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807a767080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.9.28/6419: #0: ffff888078308460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff888078308460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880336ff080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 5 locks held by kworker/0:8/6422: #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888022688940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003d37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003d37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888026dd81d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff888026dd81d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5907 #3: ffff88805bf5e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88805bf5e1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888079b471a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888079b471a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 3 locks held by syz.0.29/6483: #0: ffff88805ac46460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88805ac46460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807e4ef480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.1.30/6666: #0: ffff88805c106460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff88805c106460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888079a55c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 3 locks held by syz.2.31/6857: #0: ffff888054e2a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2739 [inline] #0: ffff888054e2a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807421a880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1170 [inline] #2: ffff88806b58c1d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0x93/0x880 drivers/base/dd.c:1369 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 9b 7b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 2f 15 00 fb f4 0c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8e807ca0 EFLAGS: 00000242 RAX: 00000000016c5207 RBX: ffffffff819b4590 RCX: 0000000080000001 RDX: 0000000000000001 RSI: ffffffff8e22f03a RDI: ffffffff8c4bdc80 RBP: ffffffff8e807d78 R08: ffff8880b86338db R09: 1ffff110170c671b R10: dffffc0000000000 R11: ffffed10170c671c R12: 0000000000000000 R13: 1ffffffff1d11df0 R14: 1ffffffff1d00f9c R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888124f3f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055c6dff66168 CR3: 000000000e946000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 rest_init+0x378/0x3a0 init/main.c:723 start_kernel+0x392/0x3e0 init/main.c:1181 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x157