Extracting prog: 6m5.179419763s
Minimizing prog: 1h35m14.651301593s
Simplifying prog options: 23m26.112002316s
Extracting C: 9m6.367516339s
Simplifying C: 0s


1 programs, 3 VMs, timeouts [15s 6m0s]
extracting reproducer from 1 programs
single: executing 1 programs separately with timeout 15s
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START-ioctl$SNDRV_TIMER_IOCTL_PAUSE-ioctl$SNDRV_TIMER_IOCTL_CONTINUE
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)
ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START-ioctl$SNDRV_TIMER_IOCTL_PAUSE-ioctl$SNDRV_TIMER_IOCTL_CONTINUE
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)
ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)

program crashed: BUG: soft lockup in smp_call_function
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START-ioctl$SNDRV_TIMER_IOCTL_PAUSE
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)
ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3)

program crashed: BUG: soft lockup in smp_call_function
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program crashed: BUG: soft lockup in smp_call_function
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$SNDRV_TIMER_IOCTL_START-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x3, 0x20000006, 0x0, 0x0, 0xd})
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program crashed: BUG: workqueue lockup
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program crashed: BUG: soft lockup in smp_call_function
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0)
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program did not crash
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
program did not crash
simplifying guilty program options
testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program crashed: BUG: soft lockup in smp_call_function
extracting C reproducer
testing compiled C program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
program did not crash
testing program (duration=9m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_START-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START
detailed listing:
executing program 0:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}})
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

program did not crash
reproducing took 2h13m52.339946028s
repro crashed as (corrupted=false):
watchdog: BUG: soft lockup - CPU#1 stuck for 226s! [kworker/u4:1:10]
Modules linked in:
CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted 5.15.149-syzkaller-00165-g85445b5a2107 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_many_cond+0x843/0x9b0 kernel/smp.c:969
Code: 45 8b 7d 00 44 89 fe 83 e6 01 31 ff e8 76 a8 0a 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 07 e8 b1 a4 0a 00 eb 38 f3 90 <42> 0f b6 04 3b 84 c0 75 11 41 f7 45 00 01 00 00 00 74 1e e8 95 a4
RSP: 0018:ffffc900000a7880 EFLAGS: 00000293
RAX: ffffffff816592cb RBX: 1ffff1103ee07af1 RCX: ffff888100263b40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900000a7998 R08: ffffffff8165929a R09: ffffed103ee271d3
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff8881f703d788 R14: ffff8881f7138e80 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe23ea9968 CR3: 000000000680f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 </IRQ>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1201 [inline]
 text_poke_bp_batch+0x1c4/0x5d0 arch/x86/kernel/alternative.c:1392
 text_poke_flush arch/x86/kernel/alternative.c:1560 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1567
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
 __jump_label_update+0x36a/0x380 kernel/jump_label.c:459
 jump_label_update+0x3af/0x450 kernel/jump_label.c:830
 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
 static_key_enable+0x1a/0x30 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x460 mm/kfence/core.c:729
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 20546 Comm: syz-executor Not tainted 5.15.149-syzkaller-00165-g85445b5a2107 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:tk_clock_read kernel/time/timekeeping.c:194 [inline]
RIP: 0010:timekeeping_get_delta kernel/time/timekeeping.c:290 [inline]
RIP: 0010:timekeeping_get_ns kernel/time/timekeeping.c:389 [inline]
RIP: 0010:ktime_get+0x73/0x160 kernel/time/timekeeping.c:832
Code: 07 e8 61 2c 0f 00 eb 1b f3 90 44 8b 25 f6 e0 ca 05 41 f6 c4 01 74 07 e8 4b 2c 0f 00 eb ea e8 44 2c 0f 00 4c 8b 2d 0d e1 ca 05 <48> 8b 1d de e0 ca 05 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc
RSP: 0018:ffffc90000007ca0 EFLAGS: 00000046
RAX: ffffffff81610aff RBX: 0000000000000000 RCX: ffff888110500000
RDX: 0000000000010001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007cc8 R08: ffffffff81610af2 R09: 0000000000000003
R10: fffff52000000f8c R11: dffffc0000000001 R12: 000000000000c04a
R13: 0000013da8c66be4 R14: dffffc0000000000 R15: 1ffff11024135420
FS:  0000555556308480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdf405b40c0 CR3: 000000012017d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 snd_hrtimer_callback+0x12d/0x330 sound/core/hrtimer.c:46
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x41a/0xad0 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x40c/0xaa0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
 __sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1102
 sysvec_apic_timer_interrupt+0x95/0xc0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x49/0x70 kernel/locking/spinlock.c:202
Code: 08 00 74 0c 48 c7 c7 d8 54 8d 86 e8 31 45 e9 fc 48 83 3d 31 29 c4 01 00 74 2a 48 89 df e8 a3 bb 8b fc 66 90 fb bf 01 00 00 00 <e8> 02 ff 82 fc 65 8b 05 c3 41 39 7b 85 c0 74 03 5b 5d c3 e8 c3 55
RSP: 0018:ffffc90003467c68 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88810ab97138 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffc90003467c70 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff5200068cf80 R11: dffffc0000000001 R12: ffff88810ab97000
R13: 1ffff9200068cfa8 R14: dffffc0000000000 R15: ffff88810ab97138
 spin_unlock_irq include/linux/spinlock.h:413 [inline]
 snd_timer_close_locked+0x88/0x920 sound/core/timer.c:398
 snd_timer_close sound/core/timer.c:463 [inline]
 snd_timer_user_release+0x121/0x2c0 sound/core/timer.c:1520
 __fput+0x3fe/0x910 fs/file_table.c:280
 ____fput+0x15/0x20 fs/file_table.c:308
 task_work_run+0x129/0x190 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xc4/0xe0 kernel/entry/common.c:175
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x26/0x160 kernel/entry/common.c:301
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fdf404810a9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffaef76838 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000011481d RCX: 00007fdf404810a9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: ffffffffffffffff R08: 0000000000000001 R09: 0000000500000000
R10: 00007fdf40404000 R11: 0000000000000246 R12: 00007fdf405b7f80
R13: 00007fdf405b7f8c R14: 0000000000000000 R15: 00007fdf405b7f80
 </TASK>

final repro crashed as (corrupted=false):
watchdog: BUG: soft lockup - CPU#1 stuck for 226s! [kworker/u4:1:10]
Modules linked in:
CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted 5.15.149-syzkaller-00165-g85445b5a2107 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:440 [inline]
RIP: 0010:smp_call_function_many_cond+0x843/0x9b0 kernel/smp.c:969
Code: 45 8b 7d 00 44 89 fe 83 e6 01 31 ff e8 76 a8 0a 00 41 83 e7 01 49 bf 00 00 00 00 00 fc ff df 75 07 e8 b1 a4 0a 00 eb 38 f3 90 <42> 0f b6 04 3b 84 c0 75 11 41 f7 45 00 01 00 00 00 74 1e e8 95 a4
RSP: 0018:ffffc900000a7880 EFLAGS: 00000293
RAX: ffffffff816592cb RBX: 1ffff1103ee07af1 RCX: ffff888100263b40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900000a7998 R08: ffffffff8165929a R09: ffffed103ee271d3
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff8881f703d788 R14: ffff8881f7138e80 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe23ea9968 CR3: 000000000680f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 </IRQ>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x80 kernel/smp.c:1135
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1201 [inline]
 text_poke_bp_batch+0x1c4/0x5d0 arch/x86/kernel/alternative.c:1392
 text_poke_flush arch/x86/kernel/alternative.c:1560 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1567
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:146
 __jump_label_update+0x36a/0x380 kernel/jump_label.c:459
 jump_label_update+0x3af/0x450 kernel/jump_label.c:830
 static_key_enable_cpuslocked+0x12f/0x250 kernel/jump_label.c:177
 static_key_enable+0x1a/0x30 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x460 mm/kfence/core.c:729
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 20546 Comm: syz-executor Not tainted 5.15.149-syzkaller-00165-g85445b5a2107 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:tk_clock_read kernel/time/timekeeping.c:194 [inline]
RIP: 0010:timekeeping_get_delta kernel/time/timekeeping.c:290 [inline]
RIP: 0010:timekeeping_get_ns kernel/time/timekeeping.c:389 [inline]
RIP: 0010:ktime_get+0x73/0x160 kernel/time/timekeeping.c:832
Code: 07 e8 61 2c 0f 00 eb 1b f3 90 44 8b 25 f6 e0 ca 05 41 f6 c4 01 74 07 e8 4b 2c 0f 00 eb ea e8 44 2c 0f 00 4c 8b 2d 0d e1 ca 05 <48> 8b 1d de e0 ca 05 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc
RSP: 0018:ffffc90000007ca0 EFLAGS: 00000046
RAX: ffffffff81610aff RBX: 0000000000000000 RCX: ffff888110500000
RDX: 0000000000010001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007cc8 R08: ffffffff81610af2 R09: 0000000000000003
R10: fffff52000000f8c R11: dffffc0000000001 R12: 000000000000c04a
R13: 0000013da8c66be4 R14: dffffc0000000000 R15: 1ffff11024135420
FS:  0000555556308480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdf405b40c0 CR3: 000000012017d000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 snd_hrtimer_callback+0x12d/0x330 sound/core/hrtimer.c:46
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x41a/0xad0 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x40c/0xaa0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
 __sysvec_apic_timer_interrupt+0xfd/0x3c0 arch/x86/kernel/apic/apic.c:1102
 sysvec_apic_timer_interrupt+0x95/0xc0 arch/x86/kernel/apic/apic.c:1096
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x49/0x70 kernel/locking/spinlock.c:202
Code: 08 00 74 0c 48 c7 c7 d8 54 8d 86 e8 31 45 e9 fc 48 83 3d 31 29 c4 01 00 74 2a 48 89 df e8 a3 bb 8b fc 66 90 fb bf 01 00 00 00 <e8> 02 ff 82 fc 65 8b 05 c3 41 39 7b 85 c0 74 03 5b 5d c3 e8 c3 55
RSP: 0018:ffffc90003467c68 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88810ab97138 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffc90003467c70 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff5200068cf80 R11: dffffc0000000001 R12: ffff88810ab97000
R13: 1ffff9200068cfa8 R14: dffffc0000000000 R15: ffff88810ab97138
 spin_unlock_irq include/linux/spinlock.h:413 [inline]
 snd_timer_close_locked+0x88/0x920 sound/core/timer.c:398
 snd_timer_close sound/core/timer.c:463 [inline]
 snd_timer_user_release+0x121/0x2c0 sound/core/timer.c:1520
 __fput+0x3fe/0x910 fs/file_table.c:280
 ____fput+0x15/0x20 fs/file_table.c:308
 task_work_run+0x129/0x190 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xc4/0xe0 kernel/entry/common.c:175
 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x26/0x160 kernel/entry/common.c:301
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fdf404810a9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffaef76838 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000011481d RCX: 00007fdf404810a9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: ffffffffffffffff R08: 0000000000000001 R09: 0000000500000000
R10: 00007fdf40404000 R11: 0000000000000246 R12: 00007fdf405b7f80
R13: 00007fdf405b7f8c R14: 0000000000000000 R15: 00007fdf405b7f80
 </TASK>