Extracting prog: 40m4.37916234s Minimizing prog: 2h9m28.623118572s Simplifying prog options: 20m41.81672401s Extracting C: 5m14.979847644s Simplifying C: 0s extracting reproducer from 51 programs testing a last program of every proc single: executing 11 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-syz_usb_connect-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-socket$inet_tcp-bind$inet-setsockopt$sock_int-socket$inet6_tcp-setsockopt$sock_int-socket$netlink-writev-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-mmap$binder-ioctl$BINDER_WRITE_READ-openat$fuse-ioctl$BINDER_WRITE_READ-read$FUSE-syz_open_dev$audion-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-syz_open_dev$loop-setsockopt$inet_MCAST_MSFILTER detailed listing: executing program 0: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES16=r0], 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f00000001c0)=[@increfs]}) r3 = dup3(r2, r1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r4, 0x1, 0x800000000f, &(0x7f0000000580)=0x7, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f00000005c0)=0x800001, 0x4) socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f00000008c0)=[{&(0x7f0000000900)="580000001400192340834b80040d8c560a067fbc45ff620540010000070058000b480400945f640094272d7061d328b92d0000000000008000f0fffeffe809000000ffd9dd000000100001000b0808004149224e06040800", 0x58}], 0x1) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0xffffffffffffdffd) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x38, 0x0, &(0x7f0000000600)=[@acquire_done={0x40106309, 0x3}, @enter_looper, @increfs={0x40046304, 0x2}, @decrefs, @clear_death={0x400c630f, 0x2, 0x1}]}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}]}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000400)}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000500)={0x8, 0x0, &(0x7f0000000540)=[@increfs={0x40046304, 0x1}]}) read$FUSE(0xffffffffffffffff, &(0x7f0000000a80)={0x2020}, 0x2020) syz_open_dev$audion(&(0x7f0000002ac0), 0x3, 0x280041) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r7, 0x0, 0x2a, &(0x7f0000002b00)={0x2, {{0x2, 0x4e21, @multicast2}}}, 0x88) syz_open_dev$loop(&(0x7f0000002bc0), 0x3ff, 0x400) setsockopt$inet_MCAST_MSFILTER(r7, 0x0, 0x30, &(0x7f0000002c00)=ANY=[@ANYBLOB="0200000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094fb07b71363b1f300"/140], 0x8c) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-syz_open_dev$usbfs-ioctl$USBDEVFS_CLEAR_HALT-socket$inet_udp-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-rseq-mmap$IORING_OFF_SQ_RING-socket$nl_route-syz_pidfd_open-openat-openat$cgroup_int-sendfile-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-openat$sysfs-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-socket$netlink-writev-ioctl$VHOST_SET_VRING_BASE-eventfd-sendmsg$NFT_BATCH-mremap-openat$uinput-madvise-mremap-getsockopt-ioctl$VHOST_SET_LOG_FD-ioctl$UBLK_U_CMD_END_USER_RECOVERY detailed listing: executing program 0: socket$netlink(0x10, 0x3, 0x8000000004) r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xffffffffffffffff, 0x61ab02) ioctl$USBDEVFS_CLEAR_HALT(r0, 0xc0105502, &(0x7f0000000040)={0x1, 0x1}) socket$inet_udp(0x2, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f00000005c0)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f0000000600)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x5, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_pidfd_open(0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x8100, 0x5a) r2 = openat$cgroup_int(r1, &(0x7f0000000180)='memory.low\x00', 0x2, 0x0) sendfile(r2, r2, 0x0, 0x85b5) recvmmsg(0xffffffffffffffff, &(0x7f0000000140), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x3, 0x0, 0x1, 0x4, 0xb47, 0x800000000009, 0x0, 0x80000001, 0x3}, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x80) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000000206010200000000006000000000000005000500000000000900020073797a3000000000100003006269746d61703a706f72740005000100270200000500040000000000"], 0x48}}, 0x8080) socket$netlink(0x10, 0x3, 0x15) writev(r2, &(0x7f0000000340)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r5 = eventfd(0x80000000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000810}, 0x24000000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) openat$uinput(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) getsockopt(r3, 0xb2, 0x1000, &(0x7f0000000440)=""/7, &(0x7f0000000480)=0x7) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f00000004c0)=r5) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r3, 0xc0207511, &(0x7f0000000500)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-syz_clone-prctl$PR_SCHED_CORE-sched_setattr-sendfile-sched_setattr-userfaultfd-timer_create-syz_io_uring_setup-mmap-madvise-mmap$IORING_OFF_SQ_RING-socket$netlink-bind$netlink-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-setsockopt$inet_tcp_int-bind$inet-connect$inet-setsockopt$inet_tcp_TCP_REPAIR_OPTIONS-setsockopt$inet_tcp_TCP_REPAIR-syz_clone-wait4-ioctl$sock_SIOCSPGRP-sendto$inet-madvise-recvfrom$inet-timer_create detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r1 = syz_clone(0x40000080, &(0x7f0000000000)='=>H', 0x3, &(0x7f0000000040), &(0x7f0000000140), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, r1, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) timer_create(0x0, 0x0, 0x0) syz_io_uring_setup(0x6c9a, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000240)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4028800) sendmsg$NFT_BATCH(r3, &(0x7f0000000480)={0x0, 0xf5, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000200a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a300000000014000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x54}, 0x20008000) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f0000000080)=0x100000001, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000200)=[@mss, @sack_perm, @window={0x3, 0x7}, @window={0x3, 0x0, 0x401}, @window], 0x5) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r4 = syz_clone(0x411, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r4, 0x0, 0x2, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f00000002c0)=r4) sendto$inet(0xffffffffffffffff, &(0x7f0000000340), 0xffffffffffffff94, 0xb, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000380)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) timer_create(0x2, 0x0, &(0x7f0000000300)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-prctl$PR_SCHED_CORE-openat$vmci-sched_setattr-setsockopt-syz_clone-sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED-openat$vim2m-ioctl$vim2m_VIDIOC_S_FMT-setsockopt$inet6_udp_encap-syz_pidfd_open-syz_ublk_setup_io_uring-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-socket$inet6_sctp-bind$rxrpc-ioctl$sock_SIOCETHTOOL-sendmsg$IPSET_CMD_ADD-syz_usb_connect-socket$inet6-fsopen-fsconfig$FSCONFIG_SET_STRING-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_START_AP-socket-openat$nullb-dup detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x10, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt(0xffffffffffffffff, 0xff, 0x24, 0x0, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x80c0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000880)={0x1, @vbi={0x174, 0xfffff800, 0x31384142, 0x31303453, [0x6, 0xa], [0x58e3, 0x741], 0x1}}) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) syz_pidfd_open(0x0, 0x0) r2 = syz_ublk_setup_io_uring(0xa5f, 0x0, &(0x7f0000000680), &(0x7f0000000700), 0x0) syz_ublk_setup_io_uring(0x8001d, &(0x7f0000000040)={0x0, 0x6a8a, 0x40000, 0xfffffffe, 0x158, 0x0, r2}, &(0x7f00000003c0)=0x0, &(0x7f0000000380)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r3, r4, r5, 0x0, &(0x7f0000000480)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$rxrpc(r7, &(0x7f0000000240)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e21, 0x7, @rand_addr=' \x01\x00', 0x9}}, 0x24) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000000c0)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_pauseparam={0x3d}}) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x30000047}, 0x4000004) syz_usb_connect(0x5, 0x53, &(0x7f0000000000)=ANY=[@ANYBLOB="120110038e3ac6209406010013780102030109024100020e061003090439d8011adaa80905090000000709800904e40503b956da020927ba718c0508"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x8) r9 = fsopen(0x0, 0x1) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r7, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000800)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) socket(0x2, 0x80805, 0x0) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) dup(r10) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD-openat$vim2m-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-socket$inet-socket$netlink-socket-sendmmsg$sock-epoll_ctl$EPOLL_CTL_ADD-sendmsg$NFNL_MSG_COMPAT_GET-connect$inet-openat$ptmx-ioctl$TIOCSETD-io_setup-io_submit-socket$vsock_stream-bpf$PROG_LOAD-bpf$BPF_LINK_CREATE_XDP-socket$netlink-fsopen-fsconfig$FSCONFIG_CMD_CREATE-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-bpf$BPF_BTF_LOAD-fsmount-syz_usb_connect$uac1 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0x9, @remote, 0x10001}], 0x1c) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000002c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x0, 0x1000007b, 0x1, 0x0, 0xb47, 0xb, 0x1, 0x80000001, 0x4}, 0x0) r3 = socket$inet(0xa, 0x801, 0x84) r4 = socket$netlink(0x10, 0x3, 0x9) socket(0x1e, 0x1, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000380)=[{{&(0x7f0000000400)=@tipc=@id={0x1e, 0x3, 0x3, {0x4e22, 0x3}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, {{&(0x7f0000000480)=@tipc=@id={0x1e, 0x3, 0x0, {0x4e23, 0x3}}, 0x80, 0x0}}], 0x2, 0xea) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000500)={0x20000001}) sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14005feb49d0eeb6e8230000010000038e82650fd8fe9e7ac504c236f35cd3055bab1a2072985ddf98c710e55f66d6fbe019a97ac962152908959e8aacba4f48fc38c22cb223f28ccc8c23c8206a870979ba57bb861610837c6398d69354243fbdb60b968f50701085c64c426cd6f73184beddf4fb65692dd07bf0e8803f889607153494e95749718ff390be2779"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40) connect$inet(r3, 0x0, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0x1013) io_setup(0x40, &(0x7f0000000680)=0x0) io_submit(r6, 0x1, &(0x7f00000006c0)=[&(0x7f0000000700)={0x0, 0x0, 0x0, 0x5, 0x400, r5, 0x0}]) socket$vsock_stream(0x28, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0xe, &(0x7f0000000800)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a4f0ff00000000b7060000080000173c640000000000004504040001ffffffc604000001000a00b7040000000100006a0af2fe00000000850000002f000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000d099d9abc1242d9388b72e45ffc2a09f000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d70300000000000000d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df6c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bbfc7824be6195a66d2e17e122040e11e3bd4a69fc6e8a9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2a9e99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8be1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d1a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaa072b5d7f0a349f1a75f01b5c203d4bdde6ff14ae9a3ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a98838156ff00000000000000cdbf91f7582ab314be3e67b8c9459564c856339a80919ecf839560c62e69df8667b274cc53f83f2086cfd2664252471fad9081824d60741d663ee258705c364e162b84a09870acd0a19399103474444f4fa12dcbd10b40195b6088513029b60a34e4161fe48c092693eb07dc8ddcba2eac2efe30b285a877c862c73ff8a60c3d494239884363cc0000005664181c1f28cd2880e6872bae932eaf4b0000000000007b662c0fe22cfd6d4bd7b851ae928cebeec6375b16af342e93c39d97e5d74d"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000c80), 0x8, 0x10, &(0x7f0000000cc0), 0x3f}, 0x16) bpf$BPF_LINK_CREATE_XDP(0x25, &(0x7f0000000300)={0xffffffffffffffff, 0x0, 0x25, 0x1, @void}, 0x10) socket$netlink(0x10, 0x3, 0x10) r7 = fsopen(&(0x7f0000000d40)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000d80)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000dc0)={&(0x7f0000000e00)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000005000000050000000000000800000000050000000000000b04000000000000000000000300000000000e0000000061617f0000000000000000"], &(0x7f0000000e80)=""/173, 0x4d, 0xad, 0x0, 0x3, 0x10000}, 0x28) fsmount(r7, 0x0, 0x0) syz_usb_connect$uac1(0x3, 0x91, &(0x7f0000000f40)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x499, 0x2000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7f, 0x3, 0x1, 0x4, 0x78, 0x3b, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xc, 0x1b}, [@feature_unit={0x11, 0x24, 0x6, 0x4, 0x2, 0x5, [0x3, 0x5, 0x2, 0x7, 0x1], 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0xf1, 0x1, 0xc0, 0xf, "3fc381f3f94c"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x7, 0x0, 0x8, {0x7, 0x25, 0x1, 0xc, 0x0, 0x3b}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x0, 0x4, 0x9, {0x7, 0x25, 0x1, 0x4, 0x6, 0x7}}}}}}}}]}}, &(0x7f00000010c0)={0xa, &(0x7f0000001000)={0xa, 0x6, 0x201, 0x7, 0xa, 0x0, 0x0, 0x7}, 0x1b, &(0x7f0000001040)={0x5, 0xf, 0x1b, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x49, 0x5, 0x2, 0xf801, 0x9}, @wireless={0xb, 0x10, 0x1, 0x2, 0x88, 0x6, 0x2, 0x6, 0xee}]}, 0x1, [{0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="0500867a32fdced1d79d58f57edfecc58c38a1cd8a"]}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat$loop-openat-io_setup-io_submit-openat$nullb-prctl$PR_SCHED_CORE-socketpair$unix-sendfile-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sched_setattr-userfaultfd-syz_open_dev$usbfs-openat$vmci-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-mmap-ioctl$USBDEVFS_SUBMITURB-mremap detailed listing: executing program 0: mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1004, 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x2, 0x2) io_setup(0x202, &(0x7f00000000c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000140)=[&(0x7f0000000180)={0xfffffffe, 0x20011004, 0x4, 0x1, 0x6, r0, 0x0, 0x0, 0x8006}]) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) sendfile(r2, r2, 0x0, 0x20000005) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'veth1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x11, 0xe}]}}]}, 0x38}}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) r5 = syz_open_dev$usbfs(&(0x7f0000000040), 0x204, 0x82) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7a8, &(0x7f0000000380)={{@any, 0x2}, @hyper, 0x7, 0x8, 0xb, 0x2, 0x8000, 0x1, 0x9}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r5, 0x0) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000240)=@urb_type_control={0x2, {}, 0x20020008, 0x0, &(0x7f00000002c0)={0x20, 0x0, 0xfffc, 0x360, 0x7}, 0x8, 0x7, 0x60000004, 0x0, 0x4, 0xfffffff9, 0x0}) mremap(&(0x7f0000139000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-mmap-syz_open_procfs-pread64-syz_open_dev$evdev-ioctl$EVIOCGMASK-getsockname$packet detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x10c000) r5 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0xffffff8c, 0x200000) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) ioctl$EVIOCGMASK(r6, 0x80104592, &(0x7f00000000c0)={0x1, 0xe4ff71c170d132d5, &(0x7f0000000400)="fccdccc6aefa"}) getsockname$packet(r3, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) program crashed: INFO: task hung in usb_stor_scan_dwork single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-mmap-syz_open_procfs-pread64-syz_open_dev$evdev-ioctl$EVIOCGMASK detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x10c000) r5 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0xffffff8c, 0x200000) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) ioctl$EVIOCGMASK(r6, 0x80104592, &(0x7f00000000c0)={0x1, 0xe4ff71c170d132d5, &(0x7f0000000400)="fccdccc6aefa"}) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-mmap-syz_open_procfs-pread64-syz_open_dev$evdev detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x10c000) r5 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0xffffff8c, 0x200000) syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x882) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-mmap-syz_open_procfs-pread64 detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x10c000) r5 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0xffffff8c, 0x200000) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-mmap-syz_open_procfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x10c000) syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs-mmap detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x10c000) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-prctl$PR_SCHED_CORE detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-openat$ttynull-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) openat$ttynull(0xffffffffffffff9c, 0x0, 0x88002, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_genetlink_get_family_id$batadv-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r3) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-socket-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket(0x10, 0x803, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-socket$inet_udp-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-bpf$BPF_GET_MAP_INFO-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r0, 0x58, &(0x7f0000000900)}, 0x10) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_mreqn-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000880)={@remote, @multicast2}, &(0x7f00000008c0)=0xc) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-getsockopt$inet6_mreq-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000000740)={@private2}, &(0x7f0000000780)=0x14) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-getsockopt$inet_pktinfo-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000006c0)={0x0, @initdev, @multicast2}, &(0x7f0000000700)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x4, 0x80, 0xae, 0x4, 0x50, @local, @ipv4={'\x00', '\xff\xff', @loopback}, 0x80, 0x8000, 0x0, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'tunl0\x00', &(0x7f0000000500)={'sit0\x00', 0x0, 0x7, 0x0, 0xfffffeff, 0x8001, {{0x28, 0x4, 0x0, 0x2, 0xa0, 0x68, 0x6, 0x9, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@cipso={0x86, 0x5d, 0x0, [{0x6, 0xb, "1ed69d0ff6914396ce"}, {0x2, 0xb, "472077550c70327580"}, {0x0, 0xc, "e257aa5358272828c31c"}, {0x1, 0xf, "2278418b2d39c470aa857b3d12"}, {0x7, 0x3, "ab"}, {0x2, 0x7, "383d4d8be2"}, {0x6, 0xa, "e3c917de7f8bde88"}, {0x1, 0x6, "4df7a35d"}, {0x2, 0x3, "10"}, {0x1, 0x9, "cd01083d1d59d7"}]}, @noop, @end, @timestamp_prespec={0x44, 0x2c, 0x54, 0x3, 0x9, [{@empty, 0x400}, {@private=0xa010101}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1e}, 0xace}, {@empty, 0x5}]}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$ifreq_SIOCGIFINDEX_team-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCGET6RD-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x80, 0x7, 0x2, 0x7, {{0x17, 0x4, 0x1, 0xe, 0x5c, 0x67, 0x0, 0x6, 0x29, 0x0, @remote, @broadcast, {[@cipso={0x86, 0x26, 0x0, [{0x1, 0x6, "16f3bd11"}, {0x0, 0x9, "b2e7080c2bbf33"}, {0x1, 0xa, "51d89d8c2009e570"}, {0x1, 0x7, "b37e2c121e"}]}, @generic={0x94, 0x12, "9dcfa7499cd05441d63514580faa5627"}, @generic={0x83, 0xe, "fbe2bb4b316bcd83ee610ece"}, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x3, 0x6, 0x1, 0x6, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0x20, 0xfffffffb, 0x31b8}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-socket$nl_generic-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") syz_usb_ep_write(r2, 0x82, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) syz_usb_ep_write(r2, 0x82, 0x1, &(0x7f0000000dc0)="03") ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-syz_usb_ep_read-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r2, 0x1, 0x1f, &(0x7f0000000a00)) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd7c, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x4, 0x9, 0x4, 0x4, 0x44, @mcast1, @mcast2, 0x40, 0x47, 0xc4, 0x6}}) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(0x0, 0x204, 0x2) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usbdev_open validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usbdev_open validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_open_dev$usbfs detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f00000009c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) program crashed: INFO: task hung in usb_stor_scan_dwork validation run: crashed=true reproducing took 3h25m18.82431097s repro crashed as (corrupted=false): INFO: task kworker/1:0:24 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:25256 pid:24 tgid:24 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/0:4:5748 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:4 state:D stack:24520 pid:5748 tgid:5748 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.5.21:5892 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.21 state:D stack:26984 pid:5892 tgid:5892 ppid:5763 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f49cf55fd8e RSP: 002b:00007f49cf94f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555563bc3500 RCX: 00007f49cf55fd8e RDX: 0000000000000002 RSI: 00007f49cf94f6c0 RDI: ffffffffffffff9c RBP: 00007f49cf94f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f49cf825fac R14: 00007f49cf825fa0 R15: 00007f49cf825fa0 INFO: task syz.3.20:5894 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:27592 pid:5894 tgid:5894 ppid:5762 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2b59b5fd8e RSP: 002b:00007f2b59f4f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055556c6e6500 RCX: 00007f2b59b5fd8e RDX: 0000000000000002 RSI: 00007f2b59f4f6c0 RDI: ffffffffffffff9c RBP: 00007f2b59f4f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f2b59e25fac R14: 00007f2b59e25fa0 R15: 00007f2b59e25fa0 INFO: task kworker/1:6:5896 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:6 state:D stack:25992 pid:5896 tgid:5896 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5904 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27592 pid:5904 tgid:5904 ppid:5753 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7141f5fd8e RSP: 002b:00007f714234f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555591a94500 RCX: 00007f7141f5fd8e RDX: 0000000000000002 RSI: 00007f714234f6c0 RDI: ffffffffffffff9c RBP: 00007f714234f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f7142225fac R14: 00007f7142225fa0 R15: 00007f7142225fa0 INFO: task syz.1.18:5905 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27168 pid:5905 tgid:5905 ppid:5764 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbd8c35fd8e RSP: 002b:00007fbd8c74f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555558e57500 RCX: 00007fbd8c35fd8e RDX: 0000000000000002 RSI: 00007fbd8c74f6c0 RDI: ffffffffffffff9c RBP: 00007fbd8c74f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fbd8c625fac R14: 00007fbd8c625fa0 R15: 00007fbd8c625fa0 INFO: task syz.2.19:5906 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:27304 pid:5906 tgid:5906 ppid:5767 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f84c535fd8e RSP: 002b:00007f84c574f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055555f48d500 RCX: 00007f84c535fd8e RDX: 0000000000000002 RSI: 00007f84c574f6c0 RDI: ffffffffffffff9c RBP: 00007f84c574f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f84c5625fac R14: 00007f84c5625fa0 R15: 00007f84c5625fa0 INFO: task kworker/1:8:5914 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:8 state:D stack:27080 pid:5914 tgid:5914 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/1:11:5921 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:11 state:D stack:25320 pid:5921 tgid:5921 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: locks held by kworker/0:0/9: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5b71d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5b71d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b4801a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b4801a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807f204ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/0:1/10: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b3401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b3401d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888023b611a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888023b611a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff8880364f4ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/1:0/24: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802678cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by pr/ttyS0/30: 2, last CPU#1: #0: ffffffff8fc34758 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc34758 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8fc34758 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9bd59df8 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bd59df8 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/31: 1, last CPU#0: #0: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/1:1/42: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802790c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802790c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807e4b8ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/0:2/50: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807f204ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/u8:5/102: 3, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888023b2b258 (&devlink->lock_key#30){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:7/159: 3, on CPU#1: #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4230 locks held by kworker/0:3/2243: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802477cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:2/3102: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805944b1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805944b1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88802678cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/u8:8/3305: 3, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88804b8a0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6906 [inline] #2: ffff88804b8a0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:550 locks held by kworker/u8:12/4089: 4, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000f167c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:928 #2: ffff8880b8426418 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x904/0xed0 kernel/time/timer.c:1117 #3: ffffffff9bc6dfc8 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0xb7/0x420 lib/debugobjects.c:873 locks held by getty/5374: 2, on CPU#1: #0: ffff8880378730a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by udevd/5667: 4, on CPU#0: #0: ffff888078330098 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807c70ac80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888035367878 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888035367878 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5670: 4, on CPU#1: #0: ffff88807828c638 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88805c64ec80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807324cd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807324cd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5671: 4, on CPU#0: #0: ffff888034491998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88803421e080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88803445fd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88803445fd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/0:4/5748: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff8880364f4ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by udevd/5765: 4, on CPU#0: #0: ffff888036d6f2d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807c709880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888035e03968 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888035e03968 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/0:5/5843: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b69b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b69b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802d2a81a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802d2a81a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88802477cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/0:7/5883: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5111d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5111d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802d2af1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802d2af1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888024778ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/1:4/5891: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b49b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b49b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805ccac1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805ccac1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807e4bcef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by syz.5.21/5892: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.20/5894: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/1:5/5895: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b6e21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b6e21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888057eff1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888057eff1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888057e54ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/1:6/5896: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807e4bcef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:7/5897: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b3ee1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b3ee1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880765a41a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880765a41a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807dc9cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by syz.0.17/5904: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.18/5905: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.19/5906: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by udevd/5913: 4, on CPU#1: #0: ffff88803430c098 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888028b15880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880351325a8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880351325a8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:8/5914: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807e4b8ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:9/5915: 5, last CPU#1: #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888046466530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_dad_work+0x35/0x480 net/ipv6/mcast.c:2330 #3: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x206/0xe10 net/ipv6/mcast.c:1862 #4: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 net/ipv6/ip6_output.c:236 locks held by kworker/1:10/5920: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888059458ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:11/5921: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807dc9cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:12/5922: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5ed1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5ed1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888057ccb1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888057ccb1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888059458ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by udevd/5926: 4, on CPU#0: #0: ffff88803430cab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88805a190080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880783bfc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880783bfc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5949: 4, on CPU#0: #0: ffff8880759521b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888055bca480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88801c1753c8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88801c1753c8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:14/6008: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e54ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.6.22/6009: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:9/6010: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888024778ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.7.23/6017: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.25/6018: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by udevd/6020: 4, on CPU#0: #0: ffff8880342b7f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888055698480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880772984b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880772984b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by syz.8.24/6028: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.26/6029: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by udevd/6030: 4, on CPU#0: #0: ffff888026c29e18 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88805549b880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888031009e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888031009e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/6031: 4, on CPU#0: #0: ffff888026c29f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807e664080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88805dcf34b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88805dcf34b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by syz.5.27/6099: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.28/6106: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.30/6128: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.29/6129: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.31/6130: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.32/6158: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.33/6204: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.34/6214: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.36/6215: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.35/6216: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.37/6233: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.38/6292: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.39/6305: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.40/6306: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.41/6307: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.42/6324: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.43/6347: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.44/6407: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.45/6408: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.46/6409: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.47/6410: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.48/6427: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz-executor/6430: 1, on CPU#1: #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x667/0xe00 net/ipv6/addrconf.c:5063 locks held by syz-executor/6440: 1, on CPU#1: #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 locks held by syz-executor/6448: 4, on CPU#1: #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a3d8c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acc540 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 drivers/net/netdevsim/bus.c:184 locks held by syz-executor/6450: 7, on CPU#0: #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880387a3c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acc540 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 drivers/net/netdevsim/bus.c:184 #4: ffff888046a76128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888046a76128 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888046b08258 (&devlink->lock_key#36){+.+.}-{4:4}, at: nsim_drv_probe+0xfb/0xbb0 drivers/net/netdevsim/dev.c:1583 #6: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1060 [inline] #6: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: nsim_create+0x87f/0x1150 drivers/net/netdevsim/netdev.c:1154 locks held by syz-executor/6482: 3, on CPU#0: #0: ffffffff917aa080 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff917aa080 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff917aa080 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:595 #1: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #1: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 #2: ffffffff8fbf7460 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa4f/0x1fe0 kernel/workqueue.c:5982 locks held by dhcpcd/6484: 2, on CPU#0: #0: ffff88807c7f0260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1715 [inline] #0: ffff88807c7f0260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3270 #1: ffffffff8fd60ee8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #1: ffffffff8fd60ee8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 kernel/rcu/tree_exp.h:966 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd2/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:rdtsc_ordered arch/x86/include/asm/tsc.h:57 [inline] RIP: 0010:delay_tsc+0x73/0xd0 arch/x86/lib/delay.c:70 Code: e8 82 7a ac f5 65 48 8b 05 1a f9 ad 08 48 85 c0 74 1c f3 90 bf 01 00 00 00 e8 19 79 ac f5 e8 f4 7c 01 00 39 c5 75 0e 0f 01 f9 <66> 90 eb bb e8 44 6e 4a f5 eb dd 4c 29 fb e8 da 7c 01 00 89 c5 0f RSP: 0018:ffffc90000a678b8 EFLAGS: 00000046 RAX: 00000000520faec8 RBX: 0000000000000899 RCX: 0000000000000001 RDX: 000000000000009f RSI: ffffffff8c6de060 RDI: ffffffff8c6de020 RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff8be8f6a0 R12: 1ffffffff37ab419 R13: 00000000ffffffff R14: 0000009f520fa812 R15: 0000000000000634 FS: 0000000000000000(0000) GS:ffff888123bb1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558dc9d9b8 CR3: 000000007f79e000 CR4: 00000000003526f0 Call Trace: udelay include/asm-generic/delay.h:62 [inline] wait_for_lsr+0x147/0x2f0 drivers/tty/serial/8250/8250_port.c:2019 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3432 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3496 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/1:0:24 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:25256 pid:24 tgid:24 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/0:4:5748 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:4 state:D stack:24520 pid:5748 tgid:5748 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.5.21:5892 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.21 state:D stack:26984 pid:5892 tgid:5892 ppid:5763 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f49cf55fd8e RSP: 002b:00007f49cf94f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555563bc3500 RCX: 00007f49cf55fd8e RDX: 0000000000000002 RSI: 00007f49cf94f6c0 RDI: ffffffffffffff9c RBP: 00007f49cf94f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f49cf825fac R14: 00007f49cf825fa0 R15: 00007f49cf825fa0 INFO: task syz.3.20:5894 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:27592 pid:5894 tgid:5894 ppid:5762 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2b59b5fd8e RSP: 002b:00007f2b59f4f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055556c6e6500 RCX: 00007f2b59b5fd8e RDX: 0000000000000002 RSI: 00007f2b59f4f6c0 RDI: ffffffffffffff9c RBP: 00007f2b59f4f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f2b59e25fac R14: 00007f2b59e25fa0 R15: 00007f2b59e25fa0 INFO: task kworker/1:6:5896 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:6 state:D stack:25992 pid:5896 tgid:5896 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5904 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27592 pid:5904 tgid:5904 ppid:5753 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7141f5fd8e RSP: 002b:00007f714234f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555591a94500 RCX: 00007f7141f5fd8e RDX: 0000000000000002 RSI: 00007f714234f6c0 RDI: ffffffffffffff9c RBP: 00007f714234f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f7142225fac R14: 00007f7142225fa0 R15: 00007f7142225fa0 INFO: task syz.1.18:5905 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27168 pid:5905 tgid:5905 ppid:5764 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbd8c35fd8e RSP: 002b:00007fbd8c74f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000555558e57500 RCX: 00007fbd8c35fd8e RDX: 0000000000000002 RSI: 00007fbd8c74f6c0 RDI: ffffffffffffff9c RBP: 00007fbd8c74f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fbd8c625fac R14: 00007fbd8c625fa0 R15: 00007fbd8c625fa0 INFO: task syz.2.19:5906 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:27304 pid:5906 tgid:5906 ppid:5767 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1104 [inline] usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4845 [inline] path_openat+0x1700/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f84c535fd8e RSP: 002b:00007f84c574f5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055555f48d500 RCX: 00007f84c535fd8e RDX: 0000000000000002 RSI: 00007f84c574f6c0 RDI: ffffffffffffff9c RBP: 00007f84c574f6c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f84c5625fac R14: 00007f84c5625fa0 R15: 00007f84c5625fa0 INFO: task kworker/1:8:5914 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:8 state:D stack:27080 pid:5914 tgid:5914 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/1:11:5921 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:11 state:D stack:25320 pid:5921 tgid:5921 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: locks held by kworker/0:0/9: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5b71d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5b71d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88807b4801a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88807b4801a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807f204ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/0:1/10: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b3401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b3401d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888023b611a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888023b611a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff8880364f4ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/1:0/24: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900001e7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802678cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by pr/ttyS0/30: 2, last CPU#1: #0: ffffffff8fc34758 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc34758 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8fc34758 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9bd59df8 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bd59df8 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/31: 1, last CPU#0: #0: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/1:1/42: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000b27c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802790c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802790c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807e4b8ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/0:2/50: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807f204ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/u8:5/102: 3, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002517c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888023b2b258 (&devlink->lock_key#30){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:7/159: 3, on CPU#1: #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88802c6be940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002e1fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4230 locks held by kworker/0:3/2243: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90006b87c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802477cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:2/3102: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000db97c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b42d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805944b1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805944b1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88802678cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/u8:8/3305: 3, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000e047c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88804b8a0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6906 [inline] #2: ffff88804b8a0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:550 locks held by kworker/u8:12/4089: 4, last CPU#0: #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000f167c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:928 #2: ffff8880b8426418 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x904/0xed0 kernel/time/timer.c:1117 #3: ffffffff9bc6dfc8 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0xb7/0x420 lib/debugobjects.c:873 locks held by getty/5374: 2, on CPU#1: #0: ffff8880378730a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by udevd/5667: 4, on CPU#0: #0: ffff888078330098 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807c70ac80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888035367878 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888035367878 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5670: 4, on CPU#1: #0: ffff88807828c638 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88805c64ec80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807324cd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807324cd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5671: 4, on CPU#0: #0: ffff888034491998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88803421e080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88803445fd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88803445fd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff8880797431d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/0:4/5748: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000378fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff8880364f4ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by udevd/5765: 4, on CPU#0: #0: ffff888036d6f2d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807c709880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888035e03968 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888035e03968 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88807d7171d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/0:5/5843: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900039bfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b69b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b69b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802d2a81a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802d2a81a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88802477cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/0:7/5883: 6, on CPU#0: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000331fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5111d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5111d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88802d2af1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88802d2af1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888024778ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/1:4/5891: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000379fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b49b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b49b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff888056a561d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff88805ccac1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff88805ccac1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807e4bcef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by syz.5.21/5892: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.20/5894: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/1:5/5895: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000333fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b6e21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b6e21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888057eff1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888057eff1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888057e54ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by kworker/1:6/5896: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000334fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807e4bcef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:7/5897: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000335fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b3ee1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b3ee1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88807d7301d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff8880765a41a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880765a41a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff88807dc9cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by syz.0.17/5904: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.18/5905: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.19/5906: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by udevd/5913: 4, on CPU#1: #0: ffff88803430c098 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888028b15880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880351325a8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880351325a8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff888057aed1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:8/5914: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035bfc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807e4b8ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:9/5915: 5, last CPU#1: #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880340af940 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035cfc40 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888046466530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_dad_work+0x35/0x480 net/ipv6/mcast.c:2330 #3: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x206/0xe10 net/ipv6/mcast.c:1862 #4: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff8fd5ab20 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 net/ipv6/ip6_output.c:236 locks held by kworker/1:10/5920: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900035ffc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888059458ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:11/5921: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000367fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807dc9cef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:12/5922: 6, on CPU#1: #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880202c5540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900036afc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b5ed1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff88802b5ed1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #4: ffff888057ccb1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888057ccb1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888059458ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x34e/0x5f0 drivers/usb/storage/ene_ub6250.c:2360 locks held by udevd/5926: 4, on CPU#0: #0: ffff88803430cab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88805a190080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880783bfc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880783bfc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88801cf7c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5949: 4, on CPU#0: #0: ffff8880759521b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888055bca480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88801c1753c8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88801c1753c8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88802765c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:14/6008: 3, on CPU#1: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003b7fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e54ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.6.22/6009: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by kworker/0:9/6010: 3, on CPU#0: #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c06a140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90003bafc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888024778ef0 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.7.23/6017: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.25/6018: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by udevd/6020: 4, on CPU#0: #0: ffff8880342b7f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888055698480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880772984b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880772984b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff8880580d01d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by syz.8.24/6028: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.26/6029: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by udevd/6030: 4, on CPU#0: #0: ffff888026c29e18 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88805549b880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888031009e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888031009e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88802b95f1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/6031: 4, on CPU#0: #0: ffff888026c29f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807e664080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88805dcf34b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88805dcf34b8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline] #3: ffff88802b95a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by syz.5.27/6099: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.28/6106: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.30/6128: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.29/6129: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.31/6130: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.32/6158: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.33/6204: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.34/6214: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.36/6215: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.35/6216: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.37/6233: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.38/6292: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.2.39/6305: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.1.40/6306: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.3.41/6307: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.6.42/6324: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.7.43/6347: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.8.44/6407: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.9.45/6408: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.4.46/6409: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.5.47/6410: 1, on CPU#1: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz.0.48/6427: 1, on CPU#0: #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff88802b5401d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 drivers/usb/core/devio.c:1054 locks held by syz-executor/6430: 1, on CPU#1: #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x667/0xe00 net/ipv6/addrconf.c:5063 locks held by syz-executor/6440: 1, on CPU#1: #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 locks held by syz-executor/6448: 4, on CPU#1: #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a3d8c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acc540 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 drivers/net/netdevsim/bus.c:184 locks held by syz-executor/6450: 7, on CPU#0: #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff8880379f6460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880387a3c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a8d5c38 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90acc540 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 drivers/net/netdevsim/bus.c:184 #4: ffff888046a76128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff888046a76128 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073 #5: ffff888046b08258 (&devlink->lock_key#36){+.+.}-{4:4}, at: nsim_drv_probe+0xfb/0xbb0 drivers/net/netdevsim/dev.c:1583 #6: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1060 [inline] #6: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: nsim_create+0x87f/0x1150 drivers/net/netdevsim/netdev.c:1154 locks held by syz-executor/6482: 3, on CPU#0: #0: ffffffff917aa080 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff917aa080 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff917aa080 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:595 #1: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #1: ffffffff912550c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219 #2: ffffffff8fbf7460 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa4f/0x1fe0 kernel/workqueue.c:5982 locks held by dhcpcd/6484: 2, on CPU#0: #0: ffff88807c7f0260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1715 [inline] #0: ffff88807c7f0260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3270 #1: ffffffff8fd60ee8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #1: ffffffff8fd60ee8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 kernel/rcu/tree_exp.h:966 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd2/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:rdtsc_ordered arch/x86/include/asm/tsc.h:57 [inline] RIP: 0010:delay_tsc+0x73/0xd0 arch/x86/lib/delay.c:70 Code: e8 82 7a ac f5 65 48 8b 05 1a f9 ad 08 48 85 c0 74 1c f3 90 bf 01 00 00 00 e8 19 79 ac f5 e8 f4 7c 01 00 39 c5 75 0e 0f 01 f9 <66> 90 eb bb e8 44 6e 4a f5 eb dd 4c 29 fb e8 da 7c 01 00 89 c5 0f RSP: 0018:ffffc90000a678b8 EFLAGS: 00000046 RAX: 00000000520faec8 RBX: 0000000000000899 RCX: 0000000000000001 RDX: 000000000000009f RSI: ffffffff8c6de060 RDI: ffffffff8c6de020 RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff8be8f6a0 R12: 1ffffffff37ab419 R13: 00000000ffffffff R14: 0000009f520fa812 R15: 0000000000000634 FS: 0000000000000000(0000) GS:ffff888123bb1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558dc9d9b8 CR3: 000000007f79e000 CR4: 00000000003526f0 Call Trace: udelay include/asm-generic/delay.h:62 [inline] wait_for_lsr+0x147/0x2f0 drivers/tty/serial/8250/8250_port.c:2019 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3432 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3496 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245