Extracting prog: 1h18m42.316799397s Minimizing prog: 39m58.651532189s Simplifying prog options: 6m57.959851679s Extracting C: 3m12.112349154s Simplifying C: 18m53.952258843s extracting reproducer from 59 programs testing a last program of every proc single: executing 14 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SCHED_CORE-syz_clone-prctl$PR_SET_SECCOMP detailed listing: executing program 0: prctl$PR_SCHED_CORE(0x4e, 0x1, 0x0, 0x1, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000040)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-unshare-select-syz_clone detailed listing: executing program 0: mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='romfs\x00', 0x200011, 0x0) unshare(0x100000) select(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x3, 0x7, 0x836, 0x4, 0x1, 0x4}, &(0x7f0000000100)={0x7f, 0xb28f, 0x7fffffffffffffff, 0xb4, 0x400, 0x7, 0x7, 0x6}, &(0x7f0000000140)={0x4, 0xc74, 0x5, 0x2, 0x40, 0x3, 0x367, 0x7fff}, &(0x7f0000000180)) syz_clone(0x5d120500, 0x0, 0x3a, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO-syz_kvm_setup_syzos_vm$x86-socket$key-socket$nl_netfilter-sendmsg$NFT_BATCH-accept4-sendmsg$key-syz_kvm_add_vcpu$x86-syz_open_dev$tty1-write$UHID_INPUT-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-ioctl$KVM_CREATE_VCPU-syz_usb_connect$uac1-ioctl$KVM_SET_MSRS-ioctl$KVM_RUN-syz_kvm_add_vcpu$x86-openat$vimc0-ioctl$VIDIOC_G_FMT-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001700), 0x2000) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000001740)={{0x1, 0x1}, 'port0\x00', 0x1, 0x40040, 0xd, 0x4, 0x5, 0xc, 0x3, 0x0, 0x4, 0x4}) (async, rerun: 32) r1 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 32) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x6c}}, 0x0) accept4(r3, &(0x7f0000001640)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, &(0x7f00000016c0)=0x80, 0x80000) (async) sendmsg$key(r2, &(0x7f00000000c0)={0x2, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x2, 0x18, 0x0, 0x6, 0xc, 0x0, 0x70bd2c, 0x25dfdbfd, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x100, @private1, 0xe}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e1f, 0xc, @loopback, 0x74}}]}, 0x60}}, 0x4010) (async) syz_kvm_add_vcpu$x86(r1, &(0x7f00000004c0)={0x0, &(0x7f0000000380)=[@nested_load_syzos={0x136, 0x60, {0x2, 0x200, [@nested_vmresume={0x130, 0x18}, @out_dx={0x6a, 0x28, {0x1bc9, 0x4, 0xfffffffffffffff9}}]}}, @wr_crn={0x67, 0x20, {0x0, 0xfff}}, @nested_load_code={0x12e, 0x66, {0x3, "26f30f01734747819be6fb000072540000a7440f78434566660f38823f2626650f01c52e450f372e6564460f01cb440f2315c7442400e708ffffc744240202000000c7442406000000000f011c24"}}, @enable_nested={0x12c, 0x18}, @in_dx={0x69, 0x20, {0x6bfc}}], 0x11e}) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r4, &(0x7f0000000600)={0x9, {"a2e3ad21ed0d09f90e3d090987f70e06d038e7ff7fc6e5539b0d5b0e8b099b3f36006c090890e0878f0e1ac6e7f89b334d959b639a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0a6193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000400000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617679314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec230911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918c91243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac5a4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4b333bd5bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3be3b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ce0700c7e658828163e2d25c4aa348561f927eff7f3aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f05004b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d486046b2c0e2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee6157eb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de225727aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d78749a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29c60acebdbe8ddbd75c2f998d8a57f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95ff80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8870b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513007000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae8489d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60299473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d946a2daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810300000000000000a12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf000000800000000007b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae0e797e8bd1f4108b7807fb36207685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ad50dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b9048017848416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1db44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b00f1000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de9c0587c2cb5fe36d7d3e5db21b013b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cf4b23329072e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06810002000000000000957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f3e90d5943dbc10360a1a49700d1dfbf66d69f6fbafe1e83cdde8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000100", 0x35e}}, 0x1006) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x881, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r6, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 64) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) (async, rerun: 64) syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2b73, 0x34, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x7, 0x40, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x800, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x89, 0x6, 0x7, {0x7, 0x25, 0x1, 0x8, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x4a, 0x2, 0x1, {0x7, 0x25, 0x1, 0xc, 0x4, 0xe}}}}}}}}]}}, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0x40000021, 0x0, 0x1b3}]}) (async, rerun: 32) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async, rerun: 32) r8 = syz_kvm_add_vcpu$x86(r1, &(0x7f0000000240)={0x0, 0x0}) r9 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r9, 0xc0d05604, &(0x7f0000000280)={0x9, @meta={0x54505356, 0x3b0284d4, 0xd6d9, 0x650c, 0x2206fb50}}) (async, rerun: 64) ioctl$KVM_RUN(r8, 0xae80, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_ublk_setup_io_uring-syz_io_uring_submit-syz_ublk_add_dev-close_range-landlock_create_ruleset-landlock_restrict_self-socketpair$unix-sendmmsg$unix-recvmmsg-gettid-recvmmsg$unix-unlinkat-timer_create-timer_settime-mkdirat$cgroup-landlock_restrict_self-syz_open_dev$video4linux-ioctl$VIDIOC_SUBDEV_G_FMT-ioctl$VIDIOC_S_CTRL-openat$tun-socket$tipc-socket$nl_netfilter-sendmsg$IPSET_CMD_TYPE-ioctl$TUNSETDEBUG-msgget$private-msgrcv-syz_usb_connect$uac2-syz_usb_connect$cdc_ncm-open_by_handle_at-setsockopt$netlink_NETLINK_CAP_ACK detailed listing: executing program 0: r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000004e80)={0x0, 0x697a, 0x80, 0xfffffffe, 0x1e5}, &(0x7f0000004f00)=0x0, &(0x7f0000004f40)=0x0, &(0x7f0000007200)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000007240)=@IORING_OP_FUTEX_WAITV={0x35, 0x9, 0x0, 0x0, 0x0, &(0x7f00000072c0)=[{0x0, 0x0}], 0x1}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000007300)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000007380)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f00000073c0)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = landlock_create_ruleset(&(0x7f0000000840)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r4, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000540), 0x318, 0x0) recvmmsg(r5, &(0x7f0000008300)=[{{&(0x7f00000026c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000002c80)=[{&(0x7f0000002740)=""/68, 0x44}, {&(0x7f00000027c0)=""/217, 0xd9}, {&(0x7f00000028c0)=""/201, 0xac}, {&(0x7f00000029c0)=""/238, 0xee}, {&(0x7f0000002ac0)=""/143, 0x8f}, {&(0x7f0000002b80)=""/16, 0x10}, {&(0x7f0000002bc0)=""/132, 0x84}], 0x7, &(0x7f0000002d00)=""/4096, 0x1000}, 0xe}, {{0x0, 0x0, &(0x7f0000004f80)=[{&(0x7f0000003d00)=""/4096, 0xfffffffffffffec9}, {&(0x7f0000004d00)=""/236, 0xec}, {&(0x7f0000004e00)=""/25, 0x19}, {&(0x7f0000004e40)=""/52, 0x34}, {&(0x7f0000008400)=""/263, 0x107}], 0x5, &(0x7f0000005000)=""/4096, 0x1000}, 0x10000}, {{&(0x7f0000006000), 0x80, &(0x7f0000007140)=[{&(0x7f0000006080)=""/4096, 0x1000}, {&(0x7f0000007080)=""/150, 0x96}], 0x2}, 0x9c2}, {{&(0x7f0000007180)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000008200)=[{&(0x7f0000008540)=""/4104, 0x1008}], 0x1, &(0x7f0000008240)=""/131, 0x83}, 0x2}], 0x4, 0x2003, 0x0) r7 = gettid() recvmmsg$unix(r5, &(0x7f0000002580)=[{{&(0x7f0000000240)=@abs, 0x6e, &(0x7f0000000300), 0x0, &(0x7f0000000740)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xd8}}, {{0x0, 0x0, &(0x7f0000000840)}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001e00)=[{&(0x7f0000000900)=""/157, 0x9d}, {&(0x7f00000009c0)=""/150, 0x96}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/150, 0x96}, {&(0x7f0000001b40)=""/140, 0x8c}, {&(0x7f0000001c00)=""/223, 0xdf}, {&(0x7f0000001d00)=""/242, 0xf2}], 0x7, &(0x7f0000001e80)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001ec0)=@abs, 0x6e, &(0x7f0000001fc0)=[{&(0x7f0000001f40)=""/95, 0x5f}], 0x1, &(0x7f0000002000)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x108}}, {{&(0x7f0000002140)=@abs, 0x6e, &(0x7f0000002480)=[{&(0x7f00000021c0)=""/22, 0x16}, {&(0x7f0000002200)=""/29, 0x1d}, {&(0x7f0000002240)=""/121, 0x79}, {&(0x7f00000022c0)=""/176, 0xb0}, {&(0x7f0000002380)=""/246, 0xf6}], 0x5, &(0x7f0000002500)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x68}}], 0x5, 0x40010020, 0x0) unlinkat(0xffffffffffffffff, 0x0, 0x7a80a58f7c96d83b) timer_create(0x7, &(0x7f00000005c0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000600)=0x0) timer_settime(r10, 0x1, &(0x7f0000000640)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mkdirat$cgroup(r9, &(0x7f0000007540)='syz0\x00', 0x1ff) landlock_restrict_self(0xffffffffffffffff, 0xc) r11 = syz_open_dev$video4linux(&(0x7f0000007580), 0x5, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r11, 0xc0585604, &(0x7f00000075c0)={0x1000000, 0x0, {0x2, 0x4283, 0x2002, 0x6, 0x8, 0x4, 0x2, 0x5}}) ioctl$VIDIOC_S_CTRL(r11, 0xc008561c, &(0x7f0000007640)={0x8, 0x4}) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x101282, 0x0) socket$tipc(0x1e, 0x7, 0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r13, &(0x7f0000007500)={&(0x7f0000007400)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000074c0)={&(0x7f0000007440)=ANY=[@ANYBLOB="500000000d0601010000000000000000000020e2b4dfe85eaec6000005000100070000000500050001000300686173683a6e65742c6e65740000005f6ce5bbee5e000500000000000000000006000000"], 0x50}}, 0x4c004) ioctl$TUNSETDEBUG(r12, 0x400454c9, &(0x7f0000000300)=0x1) r14 = msgget$private(0x0, 0x1f3) msgrcv(r14, 0x0, 0x0, 0xfffffffffffffff9, 0x0) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201500200000040532b24004000010202010902690003012b4006080b0201010320080904000000010120000924010080090900090904010000010220000904010101010220000905010910003200090825010230000100090402000001022000090402010101022000090582d5"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$cdc_ncm(0x2, 0x99, &(0x7f0000000680)=ANY=[@ANYBLOB="12010002020000ff2505a1a44000010203010902870002010610020904000001020d00000a24060001584682e09d05240005000d240f01dd7500000a0009000106241a0400080c2407030200040004000400152412c001a317a88a045e4f01a607c0ffcb7e392a0524010100090581030800ce04070904010000020d00000904010102020d0000090582020002000507090503021000ff6700"], &(0x7f0000000480)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x4, 0x5e, 0x8, 0x10, 0x1}, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="050f3600041410040487609a15037ee6fc9679885b4215a3260b10010c46007bdc22d5f5442dd30611ff000b10010c00000b05f50302"], 0x6, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x406}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x1001}}, {0x68, &(0x7f0000007680)=ANY=[@ANYBLOB="6803c680de3aedb053c9a9b41afb23ac985247b49b16f5ae1dc78fa4243001cec9b735bda5eb5f49c144dba16d10b7d561829c22aac213aebb97db28712f887554362b0ebf9c1b00c81c9bdbe814fa68bf0f52c6e425fa15a22830701c90f868e60d5a2bb0613f48c249a2b0cb1bba73d4874e"]}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x44b}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x402}}, {0xb2, &(0x7f00000003c0)=@string={0xb2, 0x3, "c348d926f310e97d4e33e9fc15c5306cb79c53b123945080db5b86f0ae36be5c37fc7aaf941b4e7afc20b81c4c75c759080b8c77e023eb2c630e5654531f1114c7e6503c5e8f4d11062d3c276554b6855ef546d1cfc2660209ef4c9abb43d7fa1c4afedaccb8396a8d6a976c6da5fcfa44ed20f38a489d21dadc1bffe91a02f173758e8803bb35b04867e12d8cd7954dd314b7def9a000f8d75b7f4ae1b45a0340b53062bf796cd5dbda1377fe5161e3"}}]}) open_by_handle_at(r6, &(0x7f0000000540)=@xfs_parent={0x1c, 0x82, {0xffffffff, 0x2, 0xffff, 0x9}}, 0x40) setsockopt$netlink_NETLINK_CAP_ACK(r8, 0x10e, 0xa, &(0x7f0000000580)=0x800, 0x4) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-recvmmsg-mbind-syz_open_procfs-read$FUSE-socket$inet6_sctp-mkdirat-mount-openat-read$FUSE detailed listing: executing program 0: mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, &(0x7f0000000000)=0x85, 0x7, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='numa_maps\x00') read$FUSE(r0, &(0x7f00000035c0)={0x2020}, 0x2020) socket$inet6_sctp(0xa, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc_mnt\x00', &(0x7f0000000380)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc_mnt/kcore\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000001580)={0x2020}, 0x2020) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): preadv-timer_create-mmap-ioctl$KVM_SET_USER_MEMORY_REGION-openat$urandom-ioctl$RNDZAPENTCNT-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-mmap$IORING_OFF_PBUF_RING-syz_ublk_setup_io_uring-gettid-syz_ublk_add_dev-ioctl$BTRFS_IOC_DEFAULT_SUBVOL-landlock_restrict_self-ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES-ioctl$FE_SET_PROPERTY-socket$inet6_tcp-close-mkdirat$cgroup-ioctl$MEMERASE64-syz_kvm_setup_cpu$x86-ioctl$TIOCCBRK-getsockopt$inet_sctp_SCTP_INITMSG-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$ifreq_SIOCGIFINDEX_vcan-ioctl$RTC_AIE_ON-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_COALESCE_SET-syz_ublk_setup_io_uring-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: preadv(0xffffffffffffffff, &(0x7f00000021c0)=[{&(0x7f0000000000)=""/170, 0xaa}, {&(0x7f00000000c0)=""/41, 0x29}, {&(0x7f0000000100)=""/159, 0x9f}, {&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/4096, 0x1000}], 0x5, 0x2, 0x5) (async) timer_create(0x5, &(0x7f0000002340)={0x0, 0x10, 0x0, @thr={&(0x7f0000002240)="2e16bf2a463bb30df24cf8f590c00016d878c3805aa2b582e1c9d152f027dad3676a65f4665ac337e621fa15c886a7bdba1337a05303973d9f7b3f", &(0x7f0000002280)="1a8ff13144d50d6d07d191faf4a327165f11a58e8c98d0eede9e1f48642f4fb52ec9f5d40f3604c68cbbc7fff55e17d285773975841b51763ea137c98153b48a33aa213d8b23ec8ced1255d2e8f4bf1d11a3079dbf3ad269505a928a987552cbcd1f7ef47a9b69fcebbbe2652f2c0eb062fcad994f5bb57e27d2e1e02098449918635737310709417a2a33cd71482939a73537112b330c2b6b2ca8b13f4048a306a9dd82c0eced66220b0632a12384657a12e05af299747ea1"}}, &(0x7f0000002380)) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x30, 0xffffffffffffffff, 0x4a0ff000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000023c0)={0x10001, 0x0, 0xfec00000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async, rerun: 64) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000002400), 0x10002, 0x0) (rerun: 64) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f0000002440)=0xcd4a) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000002fc0)={{r0, &(0x7f0000002480)='/dev/urandom\x00', 0x424400, &(0x7f00000024c0)={@_ha_fsid={[0x7f, 0x5]}, {0x4, 0x0, 0x1, 0xfffffffffffffff5}}, 0x1, &(0x7f0000002500), &(0x7f0000002540)=0x7}, 0xa, &(0x7f0000002e80)=[{0x1, 0x8, &(0x7f0000002580)='\\\x00', &(0x7f00000025c0)="a18fc4d55097b47294ee9f4fc8a1a9a6c5c838c90776744bbb82da1cd7172c", 0x1f, 0xa}, {0x3, 0x2c8fb6f5, &(0x7f0000002600)='/dev/urandom\x00', &(0x7f0000002640)="a4e98f68343243164b437149be0f4f71e8f93049b8b030ac5575224168b8552519ef8ca2c978a6539dd7df48acbd630da9fc9ed0f7674020466c96e4b8548d797e089b510a0c4fc07c0c1b4d9b08aa93a9ec680ce9e71249afe1225ee6c3993110a89055093ac466c76b7b921d54436fb0f5759fdf32d93bac60b7e2cd6a1d04497f7a1654700e101b9f30356dcbedb2939854af1603b92e25574f992431b1be8207cd631bab6f21c3c2edc4dfde339def7585236120c9ce7361776952888bdc23ef16e29795bd44293411ea4afea783302b6416f457c646d5d058baaa5fceb83820aa664ebd", 0xe6, 0x20}, {0x1, 0xa223, &(0x7f0000002740)='+\x00', &(0x7f0000002780)="687f638c13d26c557ab550f44322f2cca896e11862f03d39abb96ed4b513afe8dd", 0x21}, {0x1, 0xf, &(0x7f00000027c0)='/dev/urandom\x00', &(0x7f0000002800)="edb53b367fddc46d4e2427d19e69af6a59eea1cef5e48799a5e9354402494c976483b6f9d05cf498f9cbf86e3e8b0b96ae2af402b9d85c0db0b1bb83861c4e6a8ce1cb08f3f8219a4ff7f76cb858d2249d790882d8843de8cbf6b857c422aa714bcaba8656f6cad161751d28225d8b6252f59332b8976025705681c10a8a1d1655900d1861d8131df7c10ddcd8d859094a2819225b0f95584947f78efb16f05d5e86291a56a1ef8a55fe78957d335543c2078b24780288114fb5195bc0a7fb1bf28217e60589776f0e46df04cdff13b1c9c0f51333d859ac65219aac84db343e80a84885e11f98c87b47", 0xea, 0x14}, {0x3, 0x6, &(0x7f0000002900)='/dev/urandom\x00', &(0x7f0000002940)="07958179475004ce8d7e5d9a85aea8b3104a8152d7b321d566640f5f465eaf2bd925bc380ed9cb2b8234516977466098dad6cc740920cedd922a14b01f6f38600bd16b5dba0efe75fd3c5385fb2c70eb426b2977c55705cb97eec7eed4f9781891345dc1d665fdbbf06748c26413e3277e6618568e018973bec982070f34a73a4474537af551c970cd00ab8bfbcff0e481d1232b6da548c3126d61ed0eb214056902", 0xa2, 0x8}, {0x3, 0x39, &(0x7f0000002a00)='/dev/urandom\x00', &(0x7f0000002a40)="34062fc9bedde047f6c5392667e49469402596cd87134129", 0x18, 0x8}, {0x1cf9dc037ee3dcd4, 0x1000, &(0x7f0000002a80)='/dev/urandom\x00', &(0x7f0000002ac0)="a2c9f3e05e958e8030c21b7e61991356aae45f5274713bb41a07ed4607c004d916c6c8b19044f3f08ff188e0c78af69cd3f2d272cecd81aede13b7ecf8288d898f1b20c656443620dd42b13dc609aeb4d93cb1473dc498fdae95187da14615cd1aa2b6bfa9d56f0d175da17da1a95589c454efbebf66578463d206320253a65dffa3a426ac4a0cb1", 0x88, 0x38}, {0x1, 0x401, &(0x7f0000002b80)='(\x8f\x00', &(0x7f0000002bc0)="d91945e0d7b27f7285", 0x9, 0x3c}, {0x3, 0x6, &(0x7f0000002c00)='(*\'', &(0x7f0000002c40)="d8571e29f27142197ea018b02c6485573117fec3940afe4833a07ee49cace9347413f7c76b76dcc8e4c3f2c9a6a2d99c9b68fa9978ad351936cf0c8a042d0c4a7c49250ca7b55d4306a259b17ef4fa624f4939136d1f53a8b6ed5ebb0072da4725510a63c0fd102e236a03e8a0f14efc59f3814ad5c5f11c279fb52a9af7e896199ca82014592f8417c027a722d0795c775f2bb8ff1e05c407af3df8c26a112c718982d7f58f23916c49851e77a8690880602bad53675830ca7cd627cf95321c51c85cb6760e7f5f18357be9efc49e", 0xcf, 0x2}, {0x3, 0x5, &(0x7f0000002d40)='//)\x14\xd4*\x93(:^:.', &(0x7f0000002d80)="7316664d189c698b8adf7ff52d84091bbb13f1fe6c10efc221e008086f3f9d0ea133922d88f736a176fa0f132a5f5f046b57f7035da68116b1adb464e3f5adecd1fbf24570e32eba76e8dbf3118eb59adbc690b917cbe5b5179f6296c81461f04d93f662eaee45eac2568c905ee585814a3904a4a73d52d3be4601a5362e8dfb315bfbc2ade06559b0584c1f140949086facc6153069319d87cc9fb4a21a672af1ebf89bbb8da9492e3ac6436faefac2e481571ee2bd1273ea170055de609454c916ab0036f37e1c5f4c7d8c7775d6f98a981a28327e4a9445e950327691ff9ae930daba490c2a78f3686030df9a7b2d", 0xf0, 0x30}]}) r2 = mmap$IORING_OFF_PBUF_RING(0x0, 0x7, 0x0, 0x20010, 0xffffffffffffffff, 0x83af7f72) r3 = syz_ublk_setup_io_uring(0x1da1, &(0x7f0000003040)={0x0, 0xbbc3, 0x20, 0x2, 0x1de}, &(0x7f00000030c0), &(0x7f0000003100), &(0x7f0000003140)=0x0) r5 = gettid() syz_ublk_add_dev(r1, 0x0, r2, r4, &(0x7f00000031c0)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x291, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000003180)=@any_dev={0x4, 0xa7d, 0x0, 0x0, 0x1000, 0x2, r5, 0x0, 0x40}}}, &(0x7f0000003240)) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r6, 0x40089413, &(0x7f0000003280)=0x9) (async) landlock_restrict_self(r1, 0x1) (async, rerun: 64) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r3, 0x80489439, &(0x7f00000032c0)) (rerun: 64) ioctl$FE_SET_PROPERTY(r1, 0x40106f52, &(0x7f00000033c0)={0x3e, &(0x7f0000003340)=[{0x1, '\x00', @data=0x3, 0x200}]}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) close(r0) (async) mkdirat$cgroup(r1, &(0x7f0000003400)='syz1\x00', 0x1ff) (async) ioctl$MEMERASE64(r1, 0x40104d14, &(0x7f0000003440)={0x1, 0x9}) (async) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000034c0)=[@text32={0x20, &(0x7f0000003480)="2e0f01d1dec466ba2100ed66bad104ed0f3266baf80cb86c7b4984ef66bafc0ced8fe9409268000f01c866baf80cb8a96b3985ef66bafc0cb077ee0f07", 0x3d}], 0x1, 0x5, &(0x7f0000003500)=[@flags={0x3, 0x80000}, @dstype3={0x7, 0xe}], 0x2) ioctl$TIOCCBRK(r1, 0x5428) (async) getsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000003540), &(0x7f0000003580)=0x8) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000035c0)={{0x1, 0x1, 0x18, r6, {0x1}}, './file0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000003600)={'vxcan1\x00'}) (async, rerun: 64) ioctl$RTC_AIE_ON(r1, 0x7001) (async, rerun: 64) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003680), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r8, &(0x7f0000003740)={&(0x7f0000003640)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000003700)={&(0x7f00000036c0)={0x1c, r9, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_COALESCE_RX_USECS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4091) (async) syz_ublk_setup_io_uring(0xe42, &(0x7f0000003780)={0x0, 0x4585, 0x800, 0x2, 0x2e0}, &(0x7f0000003800), &(0x7f0000003840), &(0x7f0000003880)) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f00000038c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x25410, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000003a00)={0x4, 0x0, 0x0, 0x168, 0x138, 0x1, 0x0, 0x1400, 0x0, 0x0, @by_dev={r10}, [@error={0x0, 0x0, 0x0, 0x30}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-recvmmsg-mbind-syz_open_procfs-read$FUSE-socket$inet6_sctp-mkdirat-mount-openat-read$FUSE detailed listing: executing program 0: mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, &(0x7f0000000000)=0x85, 0x7, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='numa_maps\x00') read$FUSE(r0, &(0x7f00000035c0)={0x2020}, 0x2020) socket$inet6_sctp(0xa, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc_mnt\x00', &(0x7f0000000380)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc_mnt/kcore\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000001580)={0x2020}, 0x2020) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_generic-ioctl$SIOCSIFHWADDR-writev detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0xc0142, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000dc0)={'syzkaller0\x00', @multicast}) (async) writev(r0, &(0x7f0000000e00)=[{&(0x7f0000000e40)="89e7ee0c7cdad9b4b47380c988ca", 0xe}, {&(0x7f00000000c0)="448b7c0acf8bc0cefe9360fcbe079c0ecd", 0x11}], 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): preadv-timer_create-mmap-ioctl$KVM_SET_USER_MEMORY_REGION-openat$urandom-ioctl$RNDZAPENTCNT-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-mmap$IORING_OFF_PBUF_RING-syz_ublk_setup_io_uring-gettid-syz_ublk_add_dev-ioctl$BTRFS_IOC_DEFAULT_SUBVOL-landlock_restrict_self-ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES-ioctl$FE_SET_PROPERTY-socket$inet6_tcp-close-mkdirat$cgroup-ioctl$MEMERASE64-syz_kvm_setup_cpu$x86-ioctl$TIOCCBRK-getsockopt$inet_sctp_SCTP_INITMSG-ioctl$AUTOFS_DEV_IOCTL_EXPIRE-ioctl$ifreq_SIOCGIFINDEX_vcan-ioctl$RTC_AIE_ON-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_COALESCE_SET-syz_ublk_setup_io_uring-ioctl$DM_DEV_CREATE-ioctl$DM_TABLE_LOAD detailed listing: executing program 0: preadv(0xffffffffffffffff, &(0x7f00000021c0)=[{&(0x7f0000000000)=""/170, 0xaa}, {&(0x7f00000000c0)=""/41, 0x29}, {&(0x7f0000000100)=""/159, 0x9f}, {&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/4096, 0x1000}], 0x5, 0x2, 0x5) (async) timer_create(0x5, &(0x7f0000002340)={0x0, 0x10, 0x0, @thr={&(0x7f0000002240)="2e16bf2a463bb30df24cf8f590c00016d878c3805aa2b582e1c9d152f027dad3676a65f4665ac337e621fa15c886a7bdba1337a05303973d9f7b3f", &(0x7f0000002280)="1a8ff13144d50d6d07d191faf4a327165f11a58e8c98d0eede9e1f48642f4fb52ec9f5d40f3604c68cbbc7fff55e17d285773975841b51763ea137c98153b48a33aa213d8b23ec8ced1255d2e8f4bf1d11a3079dbf3ad269505a928a987552cbcd1f7ef47a9b69fcebbbe2652f2c0eb062fcad994f5bb57e27d2e1e02098449918635737310709417a2a33cd71482939a73537112b330c2b6b2ca8b13f4048a306a9dd82c0eced66220b0632a12384657a12e05af299747ea1"}}, &(0x7f0000002380)) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x30, 0xffffffffffffffff, 0x4a0ff000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000023c0)={0x10001, 0x0, 0xfec00000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async, rerun: 64) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000002400), 0x10002, 0x0) (rerun: 64) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f0000002440)=0xcd4a) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000002fc0)={{r0, &(0x7f0000002480)='/dev/urandom\x00', 0x424400, &(0x7f00000024c0)={@_ha_fsid={[0x7f, 0x5]}, {0x4, 0x0, 0x1, 0xfffffffffffffff5}}, 0x1, &(0x7f0000002500), &(0x7f0000002540)=0x7}, 0xa, &(0x7f0000002e80)=[{0x1, 0x8, &(0x7f0000002580)='\\\x00', &(0x7f00000025c0)="a18fc4d55097b47294ee9f4fc8a1a9a6c5c838c90776744bbb82da1cd7172c", 0x1f, 0xa}, {0x3, 0x2c8fb6f5, &(0x7f0000002600)='/dev/urandom\x00', &(0x7f0000002640)="a4e98f68343243164b437149be0f4f71e8f93049b8b030ac5575224168b8552519ef8ca2c978a6539dd7df48acbd630da9fc9ed0f7674020466c96e4b8548d797e089b510a0c4fc07c0c1b4d9b08aa93a9ec680ce9e71249afe1225ee6c3993110a89055093ac466c76b7b921d54436fb0f5759fdf32d93bac60b7e2cd6a1d04497f7a1654700e101b9f30356dcbedb2939854af1603b92e25574f992431b1be8207cd631bab6f21c3c2edc4dfde339def7585236120c9ce7361776952888bdc23ef16e29795bd44293411ea4afea783302b6416f457c646d5d058baaa5fceb83820aa664ebd", 0xe6, 0x20}, {0x1, 0xa223, &(0x7f0000002740)='+\x00', &(0x7f0000002780)="687f638c13d26c557ab550f44322f2cca896e11862f03d39abb96ed4b513afe8dd", 0x21}, {0x1, 0xf, &(0x7f00000027c0)='/dev/urandom\x00', &(0x7f0000002800)="edb53b367fddc46d4e2427d19e69af6a59eea1cef5e48799a5e9354402494c976483b6f9d05cf498f9cbf86e3e8b0b96ae2af402b9d85c0db0b1bb83861c4e6a8ce1cb08f3f8219a4ff7f76cb858d2249d790882d8843de8cbf6b857c422aa714bcaba8656f6cad161751d28225d8b6252f59332b8976025705681c10a8a1d1655900d1861d8131df7c10ddcd8d859094a2819225b0f95584947f78efb16f05d5e86291a56a1ef8a55fe78957d335543c2078b24780288114fb5195bc0a7fb1bf28217e60589776f0e46df04cdff13b1c9c0f51333d859ac65219aac84db343e80a84885e11f98c87b47", 0xea, 0x14}, {0x3, 0x6, &(0x7f0000002900)='/dev/urandom\x00', &(0x7f0000002940)="07958179475004ce8d7e5d9a85aea8b3104a8152d7b321d566640f5f465eaf2bd925bc380ed9cb2b8234516977466098dad6cc740920cedd922a14b01f6f38600bd16b5dba0efe75fd3c5385fb2c70eb426b2977c55705cb97eec7eed4f9781891345dc1d665fdbbf06748c26413e3277e6618568e018973bec982070f34a73a4474537af551c970cd00ab8bfbcff0e481d1232b6da548c3126d61ed0eb214056902", 0xa2, 0x8}, {0x3, 0x39, &(0x7f0000002a00)='/dev/urandom\x00', &(0x7f0000002a40)="34062fc9bedde047f6c5392667e49469402596cd87134129", 0x18, 0x8}, {0x1cf9dc037ee3dcd4, 0x1000, &(0x7f0000002a80)='/dev/urandom\x00', &(0x7f0000002ac0)="a2c9f3e05e958e8030c21b7e61991356aae45f5274713bb41a07ed4607c004d916c6c8b19044f3f08ff188e0c78af69cd3f2d272cecd81aede13b7ecf8288d898f1b20c656443620dd42b13dc609aeb4d93cb1473dc498fdae95187da14615cd1aa2b6bfa9d56f0d175da17da1a95589c454efbebf66578463d206320253a65dffa3a426ac4a0cb1", 0x88, 0x38}, {0x1, 0x401, &(0x7f0000002b80)='(\x8f\x00', &(0x7f0000002bc0)="d91945e0d7b27f7285", 0x9, 0x3c}, {0x3, 0x6, &(0x7f0000002c00)='(*\'', &(0x7f0000002c40)="d8571e29f27142197ea018b02c6485573117fec3940afe4833a07ee49cace9347413f7c76b76dcc8e4c3f2c9a6a2d99c9b68fa9978ad351936cf0c8a042d0c4a7c49250ca7b55d4306a259b17ef4fa624f4939136d1f53a8b6ed5ebb0072da4725510a63c0fd102e236a03e8a0f14efc59f3814ad5c5f11c279fb52a9af7e896199ca82014592f8417c027a722d0795c775f2bb8ff1e05c407af3df8c26a112c718982d7f58f23916c49851e77a8690880602bad53675830ca7cd627cf95321c51c85cb6760e7f5f18357be9efc49e", 0xcf, 0x2}, {0x3, 0x5, &(0x7f0000002d40)='//)\x14\xd4*\x93(:^:.', &(0x7f0000002d80)="7316664d189c698b8adf7ff52d84091bbb13f1fe6c10efc221e008086f3f9d0ea133922d88f736a176fa0f132a5f5f046b57f7035da68116b1adb464e3f5adecd1fbf24570e32eba76e8dbf3118eb59adbc690b917cbe5b5179f6296c81461f04d93f662eaee45eac2568c905ee585814a3904a4a73d52d3be4601a5362e8dfb315bfbc2ade06559b0584c1f140949086facc6153069319d87cc9fb4a21a672af1ebf89bbb8da9492e3ac6436faefac2e481571ee2bd1273ea170055de609454c916ab0036f37e1c5f4c7d8c7775d6f98a981a28327e4a9445e950327691ff9ae930daba490c2a78f3686030df9a7b2d", 0xf0, 0x30}]}) r2 = mmap$IORING_OFF_PBUF_RING(0x0, 0x7, 0x0, 0x20010, 0xffffffffffffffff, 0x83af7f72) r3 = syz_ublk_setup_io_uring(0x1da1, &(0x7f0000003040)={0x0, 0xbbc3, 0x20, 0x2, 0x1de}, &(0x7f00000030c0), &(0x7f0000003100), &(0x7f0000003140)=0x0) r5 = gettid() syz_ublk_add_dev(r1, 0x0, r2, r4, &(0x7f00000031c0)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x291, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000003180)=@any_dev={0x4, 0xa7d, 0x0, 0x0, 0x1000, 0x2, r5, 0x0, 0x40}}}, &(0x7f0000003240)) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r6, 0x40089413, &(0x7f0000003280)=0x9) (async) landlock_restrict_self(r1, 0x1) (async, rerun: 64) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r3, 0x80489439, &(0x7f00000032c0)) (rerun: 64) ioctl$FE_SET_PROPERTY(r1, 0x40106f52, &(0x7f00000033c0)={0x3e, &(0x7f0000003340)=[{0x1, '\x00', @data=0x3, 0x200}]}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) close(r0) (async) mkdirat$cgroup(r1, &(0x7f0000003400)='syz1\x00', 0x1ff) (async) ioctl$MEMERASE64(r1, 0x40104d14, &(0x7f0000003440)={0x1, 0x9}) (async) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000034c0)=[@text32={0x20, &(0x7f0000003480)="2e0f01d1dec466ba2100ed66bad104ed0f3266baf80cb86c7b4984ef66bafc0ced8fe9409268000f01c866baf80cb8a96b3985ef66bafc0cb077ee0f07", 0x3d}], 0x1, 0x5, &(0x7f0000003500)=[@flags={0x3, 0x80000}, @dstype3={0x7, 0xe}], 0x2) ioctl$TIOCCBRK(r1, 0x5428) (async) getsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000003540), &(0x7f0000003580)=0x8) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000035c0)={{0x1, 0x1, 0x18, r6, {0x1}}, './file0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000003600)={'vxcan1\x00'}) (async, rerun: 64) ioctl$RTC_AIE_ON(r1, 0x7001) (async, rerun: 64) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003680), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r8, &(0x7f0000003740)={&(0x7f0000003640)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000003700)={&(0x7f00000036c0)={0x1c, r9, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_COALESCE_RX_USECS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4091) (async) syz_ublk_setup_io_uring(0xe42, &(0x7f0000003780)={0x0, 0x4585, 0x800, 0x2, 0x2e0}, &(0x7f0000003800), &(0x7f0000003840), &(0x7f0000003880)) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f00000038c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x25410, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f0000003a00)={0x4, 0x0, 0x0, 0x168, 0x138, 0x1, 0x0, 0x1400, 0x0, 0x0, @by_dev={r10}, [@error={0x0, 0x0, 0x0, 0x30}]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_generic-ioctl$SIOCSIFHWADDR-writev detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0xc0142, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000dc0)={'syzkaller0\x00', @multicast}) (async) writev(r0, &(0x7f0000000e00)=[{&(0x7f0000000e40)="89e7ee0c7cdad9b4b47380c988ca", 0xe}, {&(0x7f00000000c0)="448b7c0acf8bc0cefe9360fcbe079c0ecd", 0x11}], 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-openat$panthor-ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_TIMESTAMP_INFO-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001140)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001180), 0x1a1800, 0x0) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_TIMESTAMP_INFO(r2, 0xc0106440, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000011c0)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000001200)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000001240)={'syzkaller0\x00', @random="110000000002"}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-openat$panthor-ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_TIMESTAMP_INFO-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001140)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001180), 0x1a1800, 0x0) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_TIMESTAMP_INFO(r2, 0xc0106440, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000011c0)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000001200)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000001240)={'syzkaller0\x00', @random="110000000002"}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_CLAIM_PORT-close_range-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000080)=0x1) close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usb_stor_scan_dwork single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_CLAIM_PORT-close_range detailed listing: executing program 0: syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045518, &(0x7f0000000080)=0x1) close_range(r0, 0xffffffffffffffff, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-ioctl$USBDEVFS_CLAIM_PORT-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000080)=0x1) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x1f, &(0x7f0000001000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(0x0, 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usb_stor_scan_dwork extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read program crashed: INFO: task hung in usb_stor_scan_dwork testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usbdev_open validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usbdev_open validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$usbfs-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0xb, 0x103381) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) program crashed: INFO: task hung in usb_stor_scan_dwork validation run: crashed=true reproducing took 2h39m48.200374213s repro crashed as (corrupted=false): INFO: task kworker/0:3:4966 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:25864 pid:4966 tgid:4966 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3505 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3588 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3669 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5946 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:26016 pid:5946 tgid:5946 ppid:5860 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1109 [inline] usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4851 [inline] path_openat+0x16fc/0x20f0 fs/namei.c:5016 do_file_open+0x23e/0x4a0 fs/namei.c:5045 do_sys_openat2+0x115/0x200 fs/open.c:1443 do_sys_open fs/open.c:1449 [inline] __do_sys_openat fs/open.c:1789 [inline] __se_sys_openat fs/open.c:1784 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1784 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007fc634f6034e RSP: 002b:00007ffcbcf74638 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00005555643a1500 RCX: 00007fc634f6034e RDX: 0000000000103381 RSI: 00007ffcbcf74710 RDI: ffffffffffffff9c RBP: 00007ffcbcf74710 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fc635225fac R14: 00007fc635225fa0 R15: 00007fc635225fa0 INFO: task kworker/0:4:5977 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:4 state:D stack:27296 pid:5977 tgid:5977 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3505 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3588 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3669 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.1.18:6067 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27592 pid:6067 tgid:6067 ppid:6033 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1109 [inline] usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4851 [inline] path_openat+0x16fc/0x20f0 fs/namei.c:5016 do_file_open+0x23e/0x4a0 fs/namei.c:5045 do_sys_openat2+0x115/0x200 fs/open.c:1443 do_sys_open fs/open.c:1449 [inline] __do_sys_openat fs/open.c:1789 [inline] __se_sys_openat fs/open.c:1784 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1784 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007fdaa396034e RSP: 002b:00007ffcf203c988 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055558fc75500 RCX: 00007fdaa396034e RDX: 0000000000103381 RSI: 00007ffcf203ca60 RDI: ffffffffffffff9c RBP: 00007ffcf203ca60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fdaa3c25fac R14: 00007fdaa3c25fa0 R15: 00007fdaa3c25fa0 Showing all locks held in the system: locks held by kworker/0:1/11: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88805e9d8ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/u8:0/13: 3, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88806a250800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6997 [inline] #2: ffff88806a250800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:596 locks held by kworker/1:0/27: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff888027498ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:1/32: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88807a39cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by pr/ttyS0/34: 2, last CPU#0: #0: ffffffff90234058 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff90234058 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline] #0: ffffffff90234058 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9c4b6138 (&port_lock_key){-...}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9c4b6138 (&port_lock_key){-...}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/35: 1, last CPU#1: #0: ffffffff9035a560 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9035a560 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9035a560 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/43: 5, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffffffff901e61f0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:222 #3: ffffffff9043dce0 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline] #3: ffffffff9043dce0 (jump_label_mutex){+.+.}-{4:4}, at: static_key_enable_cpuslocked+0xcb/0x240 kernel/jump_label.c:207 #4: ffffffff901fd220 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 locks held by kworker/u8:4/64: 3, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff8880689d0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6997 [inline] #2: ffff8880689d0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:596 locks held by kworker/u8:5/66: 3, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffffff9c19fc08 (&____s->seqcount#2){----}-{0:0}, at: ktime_get_real_ts64+0x45/0x2d0 kernel/time/timekeeping.c:983 #2: ffff8880b8326498 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x904/0xed0 kernel/time/timer.c:1118 locks held by kworker/1:2/916: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802b99c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802b99c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff888068bd31a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff888068bd31a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88802dfbcee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by kworker/0:2/996: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff8880226e71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff8880226e71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff8880771ccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by kworker/u8:8/1226: 3, last CPU#0: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff8880358e2258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/0:3/4966: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff888077578ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by getty/5392: 2, on CPU#0: #0: ffff88803633f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by udevd/5679: 4, on CPU#0: #0: ffff888034a371b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff8880347e2c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807a26bd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807a26bd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5701: 4, on CPU#0: #0: ffff88807ca3df38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888075550480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880352230f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880352230f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5764: 4, on CPU#0: #0: ffff88807ca3d998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888078870c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807588ca58 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807588ca58 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:3/5769: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bb5d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bb5d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff88802d7ca1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88802d7ca1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff888027498ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.0.17/5946: 1, on CPU#1: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by kworker/0:4/5977: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff8880771ccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/0:5/6050: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802b90e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802b90e1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff888013f341a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff888013f341a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff888077578ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.1.18/6067: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6068: 4, on CPU#0: #0: ffff8880349e2e18 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888071dc4480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888073f79008 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888073f79008 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/0:6/6072: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802baa11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802baa11d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff888057bd41a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff888057bd41a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88803545cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by kworker/0:8/6104: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802ba321d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802ba321d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff88807a0f71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88807a0f71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88805e9d8ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.2.19/6115: 1, on CPU#1: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6116: 4, on CPU#0: #0: ffff88803506a2d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807b3ac480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807b4540f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807b4540f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:4/6120: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802dfbcee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:5/6121: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bacf1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bacf1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff88805a30c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88805a30c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88806a040ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.3.20/6156: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by kworker/0:9/6161: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88803545cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by udevd/6166: 4, on CPU#0: #0: ffff88802bb0af38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888035abec80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807556dc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807556dc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:6/6187: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90002e67c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88806a040ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.4.21/6204: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by syz.5.22/6251: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6252: 4, on CPU#0: #0: ffff88803506a518 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888029e1ac80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880771f5878 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880771f5878 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:7/6260: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bbe31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bbe31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff8880609081a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff8880609081a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88807a39cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.6.23/6303: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6304: 4, on CPU#0: #0: ffff888022b4e998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88802b466080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888059ab3e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888059ab3e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:9/6308: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88806aaccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.7.24/6349: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6350: 4, on CPU#0: #0: ffff88802bb0a3f8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888059b3b480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888058dcb2d8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888058dcb2d8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:10/6351: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bc621d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bc621d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff8880565641a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff8880565641a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88806aaccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.8.25/6396: 1, on CPU#1: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by syz-executor/6409: 2, last CPU#1: #0: ffffffff90ff4728 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff90ff4728 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff90ff4728 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:598 #1: ffffffff918c4ca0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff918c4ca0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #1: ffffffff918c4ca0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 34 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:io_serial_out+0x7c/0xc0 drivers/tty/serial/8250/8250_port.c:432 Code: d8 35 fc 44 89 f9 d3 e5 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1c a2 af fc 41 03 2e 89 d8 89 ea ee <5b> 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 44 89 f9 80 e1 07 38 c1 RSP: 0018:ffffc90000aa7900 EFLAGS: 00000002 RAX: 000000000000002b RBX: 000000000000002b RCX: 0000000000000000 RDX: 00000000000003f8 RSI: 0000000000000000 RDI: 0000000000000020 RBP: 00000000000003f8 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff85937ba0 R12: dffffc0000000000 R13: 000000000000002b R14: ffffffff9c4b6160 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888123159000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f37af034e9c CR3: 000000007eeb8000 CR4: 00000000003526f0 Call Trace: serial_port_out include/linux/serial_core.h:817 [inline] serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3311 [inline] __serial8250_console_fifo_write+0x1e6/0x3e0 drivers/tty/serial/8250/8250_port.c:3383 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3520 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/0:3:4966 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:25864 pid:4966 tgid:4966 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3505 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3588 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3669 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.17:5946 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:26016 pid:5946 tgid:5946 ppid:5860 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1109 [inline] usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4851 [inline] path_openat+0x16fc/0x20f0 fs/namei.c:5016 do_file_open+0x23e/0x4a0 fs/namei.c:5045 do_sys_openat2+0x115/0x200 fs/open.c:1443 do_sys_open fs/open.c:1449 [inline] __do_sys_openat fs/open.c:1789 [inline] __se_sys_openat fs/open.c:1784 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1784 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007fc634f6034e RSP: 002b:00007ffcbcf74638 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00005555643a1500 RCX: 00007fc634f6034e RDX: 0000000000103381 RSI: 00007ffcbcf74710 RDI: ffffffffffffff9c RBP: 00007ffcbcf74710 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fc635225fac R14: 00007fc635225fa0 R15: 00007fc635225fa0 INFO: task kworker/0:4:5977 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:4 state:D stack:27296 pid:5977 tgid:5977 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_freezable usb_stor_scan_dwork Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 process_one_work kernel/workqueue.c:3505 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3588 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3669 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.1.18:6067 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27592 pid:6067 tgid:6067 ppid:6033 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1109 [inline] usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 chrdev_open+0x4d9/0x600 fs/char_dev.c:413 do_dentry_open+0x80e/0x1360 fs/open.c:1000 vfs_open_consume+0x4a/0x350 fs/open.c:1131 do_open fs/namei.c:4851 [inline] path_openat+0x16fc/0x20f0 fs/namei.c:5016 do_file_open+0x23e/0x4a0 fs/namei.c:5045 do_sys_openat2+0x115/0x200 fs/open.c:1443 do_sys_open fs/open.c:1449 [inline] __do_sys_openat fs/open.c:1789 [inline] __se_sys_openat fs/open.c:1784 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1784 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x16a/0x530 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x00007fdaa396034e RSP: 002b:00007ffcf203c988 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055558fc75500 RCX: 00007fdaa396034e RDX: 0000000000103381 RSI: 00007ffcf203ca60 RDI: ffffffffffffff9c RBP: 00007ffcf203ca60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007fdaa3c25fac R14: 00007fdaa3c25fa0 R15: 00007fdaa3c25fa0 Showing all locks held in the system: locks held by kworker/0:1/11: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000107c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88805e9d8ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/u8:0/13: 3, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88806a250800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6997 [inline] #2: ffff88806a250800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:596 locks held by kworker/1:0/27: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000a1fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff888027498ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:1/32: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000a77c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88807a39cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by pr/ttyS0/34: 2, last CPU#0: #0: ffffffff90234058 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff90234058 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline] #0: ffffffff90234058 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9c4b6138 (&port_lock_key){-...}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9c4b6138 (&port_lock_key){-...}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/35: 1, last CPU#1: #0: ffffffff9035a560 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9035a560 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9035a560 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/43: 5, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffffffff901e61f0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:222 #3: ffffffff9043dce0 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline] #3: ffffffff9043dce0 (jump_label_mutex){+.+.}-{4:4}, at: static_key_enable_cpuslocked+0xcb/0x240 kernel/jump_label.c:207 #4: ffffffff901fd220 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 locks held by kworker/u8:4/64: 3, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000205fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff8880689d0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6997 [inline] #2: ffff8880689d0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:596 locks held by kworker/u8:5/66: 3, last CPU#1: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffffff9c19fc08 (&____s->seqcount#2){----}-{0:0}, at: ktime_get_real_ts64+0x45/0x2d0 kernel/time/timekeeping.c:983 #2: ffff8880b8326498 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x904/0xed0 kernel/time/timer.c:1118 locks held by kworker/1:2/916: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90004687c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802b99c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802b99c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff888068bd31a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff888068bd31a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88802dfbcee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by kworker/0:2/996: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90004d47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff8880226e71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff8880226e71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff8880771ccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by kworker/u8:8/1226: 3, last CPU#0: #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fea4150 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000552fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff8880358e2258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/0:3/4966: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000f78fc40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff888077578ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by getty/5392: 2, on CPU#0: #0: ffff88803633f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by udevd/5679: 4, on CPU#0: #0: ffff888034a371b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff8880347e2c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807a26bd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807a26bd28 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88807687f1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5701: 4, on CPU#0: #0: ffff88807ca3df38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888075550480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880352230f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880352230f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by udevd/5764: 4, on CPU#0: #0: ffff88807ca3d998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888078870c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807588ca58 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807588ca58 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:3/5769: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003807c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bb5d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bb5d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff88802d7ca1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88802d7ca1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff888027498ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.0.17/5946: 1, on CPU#1: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by kworker/0:4/5977: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc900033b7c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff8880771ccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/0:5/6050: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003167c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802b90e1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802b90e1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff888013f341a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff888013f341a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff888077578ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.1.18/6067: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6068: 4, on CPU#0: #0: ffff8880349e2e18 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888071dc4480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888073f79008 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888073f79008 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88807b1011d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/0:6/6072: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003297c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802baa11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802baa11d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff888057bd41a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff888057bd41a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88803545cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by kworker/0:8/6104: 6, on CPU#0: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc900036d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802ba321d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802ba321d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff88807ae6d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff88807a0f71a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88807a0f71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88805e9d8ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.2.19/6115: 1, on CPU#1: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6116: 4, on CPU#0: #0: ffff88803506a2d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807b3ac480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807b4540f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807b4540f8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff888078caa1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:4/6120: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003717c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802dfbcee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by kworker/1:5/6121: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90002f37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bacf1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bacf1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff88805a30c1a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88805a30c1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88806a040ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.3.20/6156: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by kworker/0:9/6161: 3, on CPU#0: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90002e97c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88803545cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by udevd/6166: 4, on CPU#0: #0: ffff88802bb0af38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888035abec80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff88807556dc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88807556dc38 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff88805797a1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:6/6187: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90002e67c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88806a040ee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.4.21/6204: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by syz.5.22/6251: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6252: 4, on CPU#0: #0: ffff88803506a518 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888029e1ac80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff8880771f5878 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880771f5878 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff888035ff61d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:7/6260: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc9000211fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bbe31d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bbe31d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff8880609081a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff8880609081a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88807a39cee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.6.23/6303: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6304: 4, on CPU#0: #0: ffff888022b4e998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88802b466080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888059ab3e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888059ab3e18 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff8880373461d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:9/6308: 3, on CPU#1: #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff88813fe66150 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc90003f17c40 ((work_completion)(&(&us->scan_dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88806aaccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: usb_stor_scan_dwork+0xec/0x2c0 drivers/usb/storage/usb.c:987 locks held by syz.7.24/6349: 1, on CPU#0: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by udevd/6350: 4, on CPU#0: #0: ffff88802bb0a3f8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff888059b3b480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888058dcb2d8 (kn->active#30){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888058dcb2d8 (kn->active#30){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1114 [inline] #3: ffff888068bd61d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 locks held by kworker/1:10/6351: 6, on CPU#1: #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff8880216ccd50 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffffc900042a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3588 #2: ffff88802bc621d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #2: ffff88802bc621d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917 #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff8880564541d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #4: ffff8880565641a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff8880565641a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1106 #5: ffff88806aaccee8 (&us_interface_key[i]){+.+.}-{4:4}, at: ene_ub6250_probe+0x375/0x610 drivers/usb/storage/ene_ub6250.c:2362 locks held by syz.8.25/6396: 1, on CPU#1: #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #0: ffff88802b85f1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x760 drivers/usb/core/devio.c:1054 locks held by syz-executor/6409: 2, last CPU#1: #0: ffffffff90ff4728 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff90ff4728 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff90ff4728 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:598 #1: ffffffff918c4ca0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff918c4ca0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #1: ffffffff918c4ca0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 34 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:io_serial_out+0x7c/0xc0 drivers/tty/serial/8250/8250_port.c:432 Code: d8 35 fc 44 89 f9 d3 e5 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1c a2 af fc 41 03 2e 89 d8 89 ea ee <5b> 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 44 89 f9 80 e1 07 38 c1 RSP: 0018:ffffc90000aa7900 EFLAGS: 00000002 RAX: 000000000000002b RBX: 000000000000002b RCX: 0000000000000000 RDX: 00000000000003f8 RSI: 0000000000000000 RDI: 0000000000000020 RBP: 00000000000003f8 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff85937ba0 R12: dffffc0000000000 R13: 000000000000002b R14: ffffffff9c4b6160 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888123159000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f37af034e9c CR3: 000000007eeb8000 CR4: 00000000003526f0 Call Trace: serial_port_out include/linux/serial_core.h:817 [inline] serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3311 [inline] __serial8250_console_fifo_write+0x1e6/0x3e0 drivers/tty/serial/8250/8250_port.c:3383 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3520 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245