Extracting prog: 1h29m7.679976695s Minimizing prog: 36m43.728081655s Simplifying prog options: 15m3.555286541s Extracting C: 5m12.756158449s Simplifying C: 0s extracting reproducer from 66 programs testing a last program of every proc single: executing 16 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-prlimit64-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$netlink-writev detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-io_setup-socket$inet_smc-socket$nl_route-socket$inet6-connect$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-sched_setaffinity-socket$nl_xfrm-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-openat$procfs-setsockopt$inet6_IPV6_DSTOPTS-sendmsg$nl_route-io_submit-syz_open_dev$media-ioctl$MEDIA_IOC_SETUP_LINK-syz_open_dev$vcsn detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0xcad8, 0x5, 0x9, 0x5, 0x8, 0x2, 0xe22a, 0x8, 0x7, 0xe76, 0xffff, 0x14}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) io_setup(0xa42, &(0x7f00000000c0)=0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x3, 0x38) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x0, 0x4000001, @local, 0xf}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r4, 0x29, 0x3b, 0x0, 0x8) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x4040080) io_submit(r1, 0x1, &(0x7f00000001c0)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) r8 = syz_open_dev$media(&(0x7f0000000000), 0x4, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r8, 0xc0347c03, &(0x7f0000000a40)={{0x80000000, 0x0, 0x6, [0x4, 0x2]}, {0x80000000, 0x0, 0x3, [0x401, 0x4]}, 0x10000000, [0x8, 0x80000001]}) syz_open_dev$vcsn(0x0, 0x6, 0x300) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_RES_GET-recvfrom detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x30}, 0x1, 0x0, 0x0, 0xbe9b70537f851e0}, 0x0) recvfrom(r0, 0x0, 0x0, 0x20, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-dup3-openat$binderfs-prlimit64-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ detailed listing: executing program 0: syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x120a, 0x3}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000280)={0xe7, 0x4000000153f}, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x0, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000004c0)="e0"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_route_sched-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE-write$sndseq detailed listing: executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000300)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r3, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER-write-setsockopt$sock_int-recvmmsg-bpf$BPF_RAW_TRACEPOINT_OPEN-mq_notify detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) recvmmsg(r0, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00'}, 0x10) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x20000000, 0x4000000000003, 0x2}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER-write-setsockopt$sock_int-recvmmsg-bpf$BPF_RAW_TRACEPOINT_OPEN-mq_notify detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000b4bffc), 0x4) recvmmsg(r0, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00'}, 0x10) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x20000000, 0x4000000000003, 0x2}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$qrtr-accept4-prlimit64-get_mempolicy-socket$nl_generic-socket$inet6_udp-prlimit64-sched_setscheduler-getpid-openat$ocfs2_control-mmap$usbmon-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat-mount-write$sndseq-connect$inet-sendmmsg-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$qrtr(0x2a, 0x2, 0x0) accept4(r0, &(0x7f00000003c0)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000440)=0x80, 0x80000) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) get_mempolicy(&(0x7f00000002c0), &(0x7f0000000300), 0x400, &(0x7f0000ffb000/0x4000)=nil, 0x3) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() r3 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) mmap$usbmon(&(0x7f00001c2000/0x4000)=nil, 0x4000, 0x200000b, 0x810, r3, 0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) mount(&(0x7f0000000500)=@nullb, &(0x7f0000000040)='./file1\x00', &(0x7f0000000480)='cramfs\x00', 0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f00000004c0)=[{0x6, 0x2, 0x80, 0xe, @time={0x3, 0x80000001}, {0x5, 0xf}, {0x7, 0x7}, @queue={0xd0, {0x35c, 0x7}}}], 0x1c) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x358, 0x128, 0x5802, 0x294, 0x0, 0x294, 0x288, 0x378, 0x378, 0x288, 0x378, 0x3, 0x0, {[{{@uncond, 0xf202, 0x108, 0x128, 0x52020000, {0x0, 0x600}, [@common=@frag={{0x30}}, @common=@srh={{0x30}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@empty, @private0, [], [], 'team_slave_1\x00', 'erspan0\x00', {}, {}, 0x87}, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@mh={{0x28}, {"123a"}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-openat$nullb-dup-mmap-write$USERIO_CMD_REGISTER-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x5}, 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x12, r2, 0x0) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) read(r0, &(0x7f00000001c0)=""/93, 0x5d) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$qrtr-accept4-prlimit64-get_mempolicy-socket$nl_generic-socket$inet6_udp-prlimit64-sched_setscheduler-getpid-openat$ocfs2_control-mmap$usbmon-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-openat-mount-write$sndseq-connect$inet-sendmmsg-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$qrtr(0x2a, 0x2, 0x0) accept4(r0, &(0x7f00000003c0)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000440)=0x80, 0x80000) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) get_mempolicy(&(0x7f00000002c0), &(0x7f0000000300), 0x400, &(0x7f0000ffb000/0x4000)=nil, 0x3) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() r3 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) mmap$usbmon(&(0x7f00001c2000/0x4000)=nil, 0x4000, 0x200000b, 0x810, r3, 0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) mount(&(0x7f0000000500)=@nullb, &(0x7f0000000040)='./file1\x00', &(0x7f0000000480)='cramfs\x00', 0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f00000004c0)=[{0x6, 0x2, 0x80, 0xe, @time={0x3, 0x80000001}, {0x5, 0xf}, {0x7, 0x7}, @queue={0xd0, {0x35c, 0x7}}}], 0x1c) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x358, 0x128, 0x5802, 0x294, 0x0, 0x294, 0x288, 0x378, 0x378, 0x288, 0x378, 0x3, 0x0, {[{{@uncond, 0xf202, 0x108, 0x128, 0x52020000, {0x0, 0x600}, [@common=@frag={{0x30}}, @common=@srh={{0x30}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@empty, @private0, [], [], 'team_slave_1\x00', 'erspan0\x00', {}, {}, 0x87}, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@mh={{0x28}, {"123a"}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$userio-write$USERIO_CMD_SET_PORT_TYPE-openat$nullb-dup-mmap-write$USERIO_CMD_REGISTER-read detailed listing: executing program 0: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x5}, 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x12, r2, 0x0) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) read(r0, &(0x7f00000001c0)=""/93, 0x5d) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-mmap-socketpair$unix detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-mmap-socketpair$unix detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-timer_create-timer_settime-openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program crashed: INFO: task hung in blkdev_common_ioctl single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-timer_create-timer_settime-openat$nullb detailed listing: executing program 0: r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-timer_create-timer_settime-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-timer_create-openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program crashed: INFO: task hung in blkdev_common_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): gettid-openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: gettid() r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program crashed: INFO: task hung in blkdev_common_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program crashed: INFO: task hung in blkdev_common_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program crashed: INFO: task hung in blkdev_common_ioctl extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-ioctl$BLKZEROOUT detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0xa00, 0x1000000a00}) program did not crash reproducing took 2h26m21.700274956s repro crashed as (corrupted=false): INFO: task syz.6.22:4629 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.6.22 state:D stack:0 pid:4629 ppid:4548 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz.8.24:4630 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.24 state:D stack:0 pid:4630 ppid:4553 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz.7.23:4631 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.7.23 state:D stack:0 pid:4631 ppid:4542 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz.9.25:4654 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.9.25 state:D stack:0 pid:4654 ppid:4633 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffff800015c65530 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffff800015c65d30 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517 3 locks held by kworker/1:0/22: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff80001d2c7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000d1d7c240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 1 lock held by khungtaskd/28: #0: ffff800015c65360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349 3 locks held by kworker/u4:2/39: 3 locks held by kworker/0:2/111: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff80001de97c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000f5970240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 2 locks held by getty/4055: #0: ffff0000d6407098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff80001d8302f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1214 drivers/tty/n_tty.c:2198 3 locks held by kworker/0:6/4400: #0: ffff0000d5bd3138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021467c20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 3 locks held by kworker/0:10/4404: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000214a7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000fab0b240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 3 locks held by kworker/1:4/4432: #0: ffff0000d5bd3138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000215d7c20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 3 locks held by kworker/1:5/4472: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000216a7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000c2e76240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 2 locks held by kworker/1:7/4492: #0: ffff0000c0021938 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021797c20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 1 lock held by syz.5.21/4628: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.6.22/4629: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.8.24/4630: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.7.23/4631: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.9.25/4654: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.1.27/4935: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.2.28/5073: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.3.29/5078: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.0.26/5079: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.4.30/5082: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.5.31/5161: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.8.33/5205: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.7.34/5206: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.6.32/5207: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.9.35/5208: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.1.36/5222: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.2.37/5266: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.3.39/5287: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.0.38/5298: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.4.40/5299: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.5.41/5310: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.8.42/5354: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.7.43/5392: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.6.44/5420: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.1.46/5423: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.9.45/5427: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.2.47/5432: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 3 locks held by syz-executor/5449: #0: ffff80001811f250 (cb_lock){++++}-{3:3}, at: genl_rcv+0x28/0x50 net/netlink/genetlink.c:860 #1: ffff80001811f108 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffff80001811f108 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x114/0xc2c net/netlink/genetlink.c:848 #2: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 1 lock held by syz-executor/5459: #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 3 locks held by syz-executor/5467: #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 #1: ffff000104a593e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x208/0x420 drivers/net/wireguard/device.c:49 #2: ffff800015c6a938 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #2: ffff800015c6a938 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3e0/0x77c kernel/rcu/tree_exp.h:962 1 lock held by syz.0.48/5492: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.3.49/5527: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 ============================================= final repro crashed as (corrupted=false): INFO: task syz.6.22:4629 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.6.22 state:D stack:0 pid:4629 ppid:4548 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz.8.24:4630 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.24 state:D stack:0 pid:4630 ppid:4553 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz.7.23:4631 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.7.23 state:D stack:0 pid:4631 ppid:4542 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz.9.25:4654 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.9.25 state:D stack:0 pid:4654 ppid:4633 flags:0x00000001 Call trace: __switch_to+0x308/0x598 arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 rwsem_down_write_slowpath+0xc80/0x156c kernel/locking/rwsem.c:1189 __down_write_common kernel/locking/rwsem.c:1314 [inline] __down_write kernel/locking/rwsem.c:1323 [inline] down_write+0x84/0x88 kernel/locking/rwsem.c:1574 filemap_invalidate_lock include/linux/fs.h:803 [inline] blk_ioctl_zeroout block/ioctl.c:186 [inline] blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 blkdev_ioctl+0x380/0xb40 block/ioctl.c:613 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffff800015c65530 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffff800015c65d30 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517 3 locks held by kworker/1:0/22: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff80001d2c7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000d1d7c240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 1 lock held by khungtaskd/28: #0: ffff800015c65360 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349 3 locks held by kworker/u4:2/39: 3 locks held by kworker/0:2/111: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff80001de97c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000f5970240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 2 locks held by getty/4055: #0: ffff0000d6407098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff80001d8302f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1214 drivers/tty/n_tty.c:2198 3 locks held by kworker/0:6/4400: #0: ffff0000d5bd3138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021467c20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 3 locks held by kworker/0:10/4404: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000214a7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000fab0b240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 3 locks held by kworker/1:4/4432: #0: ffff0000d5bd3138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000215d7c20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 3 locks held by kworker/1:5/4472: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000216a7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000c2e76240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x270/0x32bc drivers/net/netdevsim/fib.c:1491 2 locks held by kworker/1:7/4492: #0: ffff0000c0021938 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021797c20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 1 lock held by syz.5.21/4628: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.6.22/4629: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.8.24/4630: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.7.23/4631: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.9.25/4654: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.1.27/4935: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.2.28/5073: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.3.29/5078: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.0.26/5079: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.4.30/5082: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.5.31/5161: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.8.33/5205: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.7.34/5206: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.6.32/5207: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.9.35/5208: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.1.36/5222: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.2.37/5266: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.3.39/5287: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.0.38/5298: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.4.40/5299: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.5.41/5310: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.8.42/5354: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.7.43/5392: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.6.44/5420: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.1.46/5423: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.9.45/5427: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.2.47/5432: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 3 locks held by syz-executor/5449: #0: ffff80001811f250 (cb_lock){++++}-{3:3}, at: genl_rcv+0x28/0x50 net/netlink/genetlink.c:860 #1: ffff80001811f108 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffff80001811f108 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x114/0xc2c net/netlink/genetlink.c:848 #2: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 1 lock held by syz-executor/5459: #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 3 locks held by syz-executor/5467: #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff8000180c4608 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 #1: ffff000104a593e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x208/0x420 drivers/net/wireguard/device.c:49 #2: ffff800015c6a938 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #2: ffff800015c6a938 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3e0/0x77c kernel/rcu/tree_exp.h:962 1 lock held by syz.0.48/5492: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 1 lock held by syz.3.49/5527: #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:803 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blk_ioctl_zeroout block/ioctl.c:186 [inline] #0: ffff0000c0539ed8 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_common_ioctl+0x1a08/0x26c8 block/ioctl.c:490 =============================================