Extracting prog: 1m29.451102682s
Minimizing prog: 20m59.625070742s
Simplifying prog options: 0s
Extracting C: 51.062433741s
Simplifying C: 5m41.113000315s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300))
syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r5=>0x0)
syz_ublk_setup_queues(0xffffffffffffffff, r5, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
r1 = syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2)
syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r0}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r2=>0x0)
r3 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r1, 0x2)
syz_ublk_setup_queues(r3, r2, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r3, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r0}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, 0x0, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), 0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, 0x0, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, 0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, 0x0)
r4 = syz_ublk_add_dev(r1, r2, r3, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, 0x0, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r0}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, 0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r6, 0x0, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(0x0, r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, 0x0, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, 0x0, 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=34.019987757s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
simplifying C reproducer
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program did not crash
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=34.019987757s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x4, 0x6e1, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000700)={0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe1ad, 0x0, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5a9b, 0x0, 0x20002, 0x226}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9874, 0x0, 0x0, 0x80000000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2441}}], 0x1, &(0x7f0000000900)={0x2e, 0x4, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0x0, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
reproducing took 31m37.569012334s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 1 PID: 334 at drivers/block/ublk_drv.c:1579 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Modules linked in:
CPU: 1 UID: 0 PID: 334 Comm: kworker/u8:3 Not tainted syzkaller #0 ebdb8ca0d5496920d5c1f7baee21ca017c7afde3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Code: 5d e9 53 26 52 02 cc e8 5d a9 33 fe 0f 0b eb e3 e8 54 a9 33 fe 0f 0b eb da e8 4b a9 33 fe 0f 0b e9 4d fe ff ff e8 3f a9 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc90001a5f990 EFLAGS: 00010293
RAX: ffffffff8353c8b1 RBX: 1ffff110227cf2cd RCX: ffff88810c3d2600
RDX: 0000000000000000 RSI: 00000000000000d4 RDI: 00000000000006e1
RBP: ffffc90001a5f9e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff8353b890 R12: ffff8881165c8000
R13: ffff888113e79640 R14: ffff8881163ea560 R15: ffff8881163ea570
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54c0f86fc0 CR3: 00000000074aa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1975
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 1 PID: 334 at drivers/block/ublk_drv.c:1579 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Modules linked in:
CPU: 1 UID: 0 PID: 334 Comm: kworker/u8:3 Not tainted syzkaller #0 ebdb8ca0d5496920d5c1f7baee21ca017c7afde3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Code: 5d e9 53 26 52 02 cc e8 5d a9 33 fe 0f 0b eb e3 e8 54 a9 33 fe 0f 0b eb da e8 4b a9 33 fe 0f 0b e9 4d fe ff ff e8 3f a9 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc90001a5f990 EFLAGS: 00010293
RAX: ffffffff8353c8b1 RBX: 1ffff110227cf2cd RCX: ffff88810c3d2600
RDX: 0000000000000000 RSI: 00000000000000d4 RDI: 00000000000006e1
RBP: ffffc90001a5f9e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff8353b890 R12: ffff8881165c8000
R13: ffff888113e79640 R14: ffff8881163ea560 R15: ffff8881163ea570
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f54c0f86fc0 CR3: 00000000074aa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1975
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---