Extracting prog: 7m3.479425358s
Minimizing prog: 1h12m39.530413597s
Simplifying prog options: 17m35.653371768s
Extracting C: 5m10.517154816s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program crashed: INFO: task hung in hci_cmd_sync_clear
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(0x0, 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(0x0, 0x22)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB], 0x22)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program crashed: INFO: task hung in hci_cmd_sync_clear
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program crashed: INFO: task hung in hci_cmd_sync_clear
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program crashed: INFO: task hung in hci_cmd_sync_clear
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program crashed: INFO: task hung in hci_cmd_sync_clear
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX_80211-bpf$PROG_LOAD-syz_emit_vhci-syz_emit_vhci
detailed listing:
executing program 0:
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1b, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e751d"], 0x24)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)

program crashed: INFO: task hung in hci_cmd_sync_clear
validation run: crashed=true
reproducing took 1h53m25.526329755s
repro crashed as (corrupted=false):
INFO: task syz-executor:4471 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:0     pid:4471  ppid:1      flags:0x0000000d
Call trace:
 __switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0xdb4/0x1a6c kernel/sched/core.c:6562
 schedule+0xc4/0x170 kernel/sched/core.c:6638
 schedule_timeout+0xc8/0x2f4 kernel/time/timer.c:2144
 do_wait_for_common+0x28c/0x3ec kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x44/0x5c kernel/sched/completion.c:138
 __flush_work+0x140/0x1ec kernel/workqueue.c:3076
 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163
 cancel_work_sync+0x24/0x38 kernel/workqueue.c:3199
 hci_cmd_sync_clear+0x38/0x1e8 net/bluetooth/hci_sync.c:674
 hci_unregister_dev+0x190/0x4d4 net/bluetooth/hci_core.c:2727
 vhci_release+0x7c/0xcc drivers/bluetooth/hci_vhci.c:573
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 exit_task_work include/linux/task_work.h:39 [inline]
 do_exit+0x54c/0x19ac kernel/exit.c:881
 do_group_exit+0x198/0x238 kernel/exit.c:1024
 get_signal+0x11f4/0x133c kernel/signal.c:2872
 do_signal arch/arm64/kernel/signal.c:1095 [inline]
 do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffff800015557db0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffff8000155585d0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
4 locks held by kworker/0:1/14:
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:538 [inline]
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1362 [inline]
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1652 [inline]
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2bc/0x1a6c kernel/sched/core.c:6478
 #1: ffff00019f393bc8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x35c/0x5b8 kernel/sched/psi.c:999
 #2: ffff800017a02e48 (rtnl_mutex){+.+.}-{3:3}
, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:538 [inline]
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1362 [inline]
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1652 [inline]
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2bc/0x1a6c kernel/sched/core.c:6478
1 lock held by khungtaskd/28:
 #0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
3 locks held by kworker/u5:0/47:
 #0: 
ffff0000d5da7938
 (
(wq_completion)hci1
){+.+.}-{0:0}
, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff80001f067c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000d98c9468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u4:3/1471:
3 locks held by kworker/0:3/3900:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800023ee7c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff800017a02e48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
2 locks held by getty/4083:
 #0: ffff0000d6bfb098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
 #1: ffff800020b6e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2e8/0xfa8 drivers/tty/n_tty.c:2198
3 locks held by kworker/0:4/4446:
3 locks held by kworker/u5:1/4456:
 #0: ffff0000db416938 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800021117c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000cd1d9468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:2/4458:
 #0: ffff0000d15e0138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800021207c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000fb258428 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xbc/0x7fc net/bluetooth/hci_event.c:6886
3 locks held by kworker/u5:3/5090:
 #0: ffff0000ee686138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800022d07c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000d4fad468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:4/5092:
 #0: ffff0000efee3938 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000235e7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000cfc4d468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:5/5664:
 #0: ffff0000df88d138 ((wq_completion)hci7){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800022ef7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000dc3a1468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:7/6383:
 #0: ffff0000def1f938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000231d7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ced0d468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:8/6936:
 #0: ffff0000dcbe0938 ((wq_completion)hci10){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000236f7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f8201468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:9/7550:
 #0: ffff0000ea959138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800023967c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ce25d468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:10/7584:
 #0: ffff0000d06ff938 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800023c57c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ded81468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:11/8181:
 #0: ffff0000d528c938 ((wq_completion)hci11){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800024137c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000cd7c1468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:12/8814:
 #0: ffff0000da0a7138 ((wq_completion)hci8){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000245c7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f5be5468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:13/9478:
 #0: ffff0000f0c2e938 ((wq_completion)hci9){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800025277c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f3c39468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:14/10610:
 #0: ffff0000f0fa8938 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800024fe7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f8ebc428 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xbc/0x7fc net/bluetooth/hci_event.c:6886
3 locks held by kworker/u5:15/10655:
 #0: ffff0000d15e6938 ((wq_completion)hci13){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000254f7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000fb259468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:16/11304:
 #0: ffff0000cbbd2938 ((wq_completion)hci12){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800025957c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f8ebd468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
2 locks held by syz-executor/13097:

=============================================


final repro crashed as (corrupted=false):
INFO: task syz-executor:4471 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:0     pid:4471  ppid:1      flags:0x0000000d
Call trace:
 __switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0xdb4/0x1a6c kernel/sched/core.c:6562
 schedule+0xc4/0x170 kernel/sched/core.c:6638
 schedule_timeout+0xc8/0x2f4 kernel/time/timer.c:2144
 do_wait_for_common+0x28c/0x3ec kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x44/0x5c kernel/sched/completion.c:138
 __flush_work+0x140/0x1ec kernel/workqueue.c:3076
 __cancel_work_timer+0x2f8/0x450 kernel/workqueue.c:3163
 cancel_work_sync+0x24/0x38 kernel/workqueue.c:3199
 hci_cmd_sync_clear+0x38/0x1e8 net/bluetooth/hci_sync.c:674
 hci_unregister_dev+0x190/0x4d4 net/bluetooth/hci_core.c:2727
 vhci_release+0x7c/0xcc drivers/bluetooth/hci_vhci.c:573
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 exit_task_work include/linux/task_work.h:39 [inline]
 do_exit+0x54c/0x19ac kernel/exit.c:881
 do_group_exit+0x198/0x238 kernel/exit.c:1024
 get_signal+0x11f4/0x133c kernel/signal.c:2872
 do_signal arch/arm64/kernel/signal.c:1095 [inline]
 do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffff800015557db0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffff8000155585d0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
4 locks held by kworker/0:1/14:
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:538 [inline]
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1362 [inline]
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1652 [inline]
 #0: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2bc/0x1a6c kernel/sched/core.c:6478
 #1: ffff00019f393bc8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x35c/0x5b8 kernel/sched/psi.c:999
 #2: ffff800017a02e48 (rtnl_mutex){+.+.}-{3:3}
, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:538 [inline]
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1362 [inline]
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1652 [inline]
 #3: ffff00019f3a7398 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2bc/0x1a6c kernel/sched/core.c:6478
1 lock held by khungtaskd/28:
 #0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
3 locks held by kworker/u5:0/47:
 #0: 
ffff0000d5da7938
 (
(wq_completion)hci1
){+.+.}-{0:0}
, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff80001f067c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000d98c9468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u4:3/1471:
3 locks held by kworker/0:3/3900:
 #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800023ee7c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff800017a02e48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74
2 locks held by getty/4083:
 #0: ffff0000d6bfb098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
 #1: ffff800020b6e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2e8/0xfa8 drivers/tty/n_tty.c:2198
3 locks held by kworker/0:4/4446:
3 locks held by kworker/u5:1/4456:
 #0: ffff0000db416938 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800021117c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000cd1d9468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:2/4458:
 #0: ffff0000d15e0138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800021207c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000fb258428 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xbc/0x7fc net/bluetooth/hci_event.c:6886
3 locks held by kworker/u5:3/5090:
 #0: ffff0000ee686138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800022d07c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000d4fad468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:4/5092:
 #0: ffff0000efee3938 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000235e7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000cfc4d468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:5/5664:
 #0: ffff0000df88d138 ((wq_completion)hci7){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800022ef7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000dc3a1468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:7/6383:
 #0: ffff0000def1f938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000231d7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ced0d468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:8/6936:
 #0: ffff0000dcbe0938 ((wq_completion)hci10){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000236f7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f8201468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:9/7550:
 #0: ffff0000ea959138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800023967c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ce25d468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:10/7584:
 #0: ffff0000d06ff938 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800023c57c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000ded81468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:11/8181:
 #0: ffff0000d528c938 ((wq_completion)hci11){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800024137c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000cd7c1468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:12/8814:
 #0: ffff0000da0a7138 ((wq_completion)hci8){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000245c7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f5be5468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:13/9478:
 #0: ffff0000f0c2e938 ((wq_completion)hci9){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800025277c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f3c39468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:14/10610:
 #0: ffff0000f0fa8938 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800024fe7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f8ebc428 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xbc/0x7fc net/bluetooth/hci_event.c:6886
3 locks held by kworker/u5:15/10655:
 #0: ffff0000d15e6938 ((wq_completion)hci13){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff8000254f7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000fb259468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
3 locks held by kworker/u5:16/11304:
 #0: ffff0000cbbd2938 ((wq_completion)hci12){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
 #1: ffff800025957c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x6e8/0x13bc kernel/workqueue.c:2267
 #2: ffff0000f8ebd468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x180/0x32c net/bluetooth/hci_sync.c:327
2 locks held by syz-executor/13097:

=============================================