Extracting prog: 27.316038724s
Minimizing prog: 10m43.718743666s
Simplifying prog options: 0s
Extracting C: 1m4.376000292s
Simplifying C: 5m17.995289485s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-syz_open_procfs$namespace-mkdirat-mount-mkdirat-rmdir-syz_clone
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/pid\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')
syz_clone(0x2100, &(0x7f0000000000)="e99f8ef0a92aacd7ac7c9c8a0eb039d396560cea791dafce7b8d5cb9c68924749f87e3b75509e824e18a5bf89c56d414f7d369042bfca8dc613bde937e5a96feb22b9ca79e218841bbb5fad0eaf2f1a7f9859857dcb14d4f9b8071808dd01dcb81fa4f18c044beb5b7b801ee4299c4a8ceafc356f122ebd3e07a676dd1591d9a4fef2ae2c37196249f0873f71a080dd95fda67561b6d3c30f9ceb1fb03ca748ad8e7974a15de0dbb62acd687fe4a17adc1c33e7326e2bc", 0xb7, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="026125dca4fc4625c50a94c1631155fcb0361aed4d9be8f29c625e983b5235853a7593105edf021e63c7415bb616f414c9cc3b5125c47bd710d90e702f76d0b66b77bc90d23fd9bfc24cdbbe9d35d2a8200f03ec")

program crashed: BUG: scheduling while atomic in kernfs_remove
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-syz_open_procfs$namespace-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/pid\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-syz_open_procfs$namespace-mkdirat-mount-mkdirat
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/pid\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-syz_open_procfs$namespace-mkdirat-mount-rmdir
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/pid\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-syz_open_procfs$namespace-mkdirat-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/pid\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-syz_open_procfs$namespace-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/pid\x00')
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket(0x8000000010, 0x2, 0x0)
write(r0, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
socket(0x8000000010, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000500)="fc0000001c000704ab5b2509b868030002ab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a020700000000000000fc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_drain
a never seen crash title: BUG: scheduling while atomic in kernfs_drain, ignore
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
write(0xffffffffffffffff, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1fe)
rmdir(&(0x7f0000000140)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
validation run: crashed=true
reproducing took 20m25.302912617s
repro crashed as (corrupted=false):
BUG: scheduling while atomic: syz.2.24/388/0x00000002
Modules linked in:
CPU: 0 UID: 0 PID: 388 Comm: syz.2.24 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 __schedule_bug+0x12b/0x200 kernel/sched/core.c:6629
 schedule_debug kernel/sched/core.c:6656 [inline]
 __schedule+0xb85/0x20b0 kernel/sched/core.c:7700
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8032
 rwsem_down_write_slowpath+0x5c9/0x1b60 kernel/locking/rwsem.c:1239
 __down_write_common kernel/locking/rwsem.c:1383 [inline]
 __down_write kernel/locking/rwsem.c:1392 [inline]
 down_write+0x163/0x2b0 kernel/locking/rwsem.c:1659
 kernfs_remove_by_name_ns+0x8c/0x180 fs/kernfs/dir.c:1737
 sysfs_remove_file_ns+0x68/0x80 fs/sysfs/file.c:506
 sysfs_remove_file include/linux/sysfs.h:773 [inline]
 device_remove_file drivers/base/core.c:3074 [inline]
 device_del+0x56c/0xcf0 drivers/base/core.c:3879
 device_unregister drivers/base/core.c:3922 [inline]
 device_destroy+0xb0/0x100 drivers/base/core.c:4521
 android_device_destroy+0x118/0x180 drivers/usb/gadget/android_configfs_uevent.c:223
 gadgets_drop+0x1d/0x30 drivers/usb/gadget/configfs.c:2075
 client_drop_item fs/configfs/dir.c:943 [inline]
 configfs_rmdir+0x8ba/0x9b0 fs/configfs/dir.c:1546
 vfs_rmdir+0x3de/0x560 fs/namei.c:4348
 do_rmdir+0x29a/0x590 fs/namei.c:4407
 __do_sys_rmdir fs/namei.c:4426 [inline]
 __se_sys_rmdir fs/namei.c:4424 [inline]
 __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424
 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f864f19e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe50a1fc48 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f864f425fa0 RCX: 00007f864f19e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140
RBP: 00007f864f23506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f864f425fac R14: 00007f864f425fa0 R15: 00007f864f425fa0
 </TASK>
BUG: scheduling while atomic: syz.2.24/388/0x00000000
Modules linked in:
CPU: 0 UID: 0 PID: 388 Comm: syz.2.24 Tainted: G        W          syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:

final repro crashed as (corrupted=false):
BUG: scheduling while atomic: syz.2.24/388/0x00000002
Modules linked in:
CPU: 0 UID: 0 PID: 388 Comm: syz.2.24 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 __schedule_bug+0x12b/0x200 kernel/sched/core.c:6629
 schedule_debug kernel/sched/core.c:6656 [inline]
 __schedule+0xb85/0x20b0 kernel/sched/core.c:7700
 __schedule_loop kernel/sched/core.c:7960 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7975
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8032
 rwsem_down_write_slowpath+0x5c9/0x1b60 kernel/locking/rwsem.c:1239
 __down_write_common kernel/locking/rwsem.c:1383 [inline]
 __down_write kernel/locking/rwsem.c:1392 [inline]
 down_write+0x163/0x2b0 kernel/locking/rwsem.c:1659
 kernfs_remove_by_name_ns+0x8c/0x180 fs/kernfs/dir.c:1737
 sysfs_remove_file_ns+0x68/0x80 fs/sysfs/file.c:506
 sysfs_remove_file include/linux/sysfs.h:773 [inline]
 device_remove_file drivers/base/core.c:3074 [inline]
 device_del+0x56c/0xcf0 drivers/base/core.c:3879
 device_unregister drivers/base/core.c:3922 [inline]
 device_destroy+0xb0/0x100 drivers/base/core.c:4521
 android_device_destroy+0x118/0x180 drivers/usb/gadget/android_configfs_uevent.c:223
 gadgets_drop+0x1d/0x30 drivers/usb/gadget/configfs.c:2075
 client_drop_item fs/configfs/dir.c:943 [inline]
 configfs_rmdir+0x8ba/0x9b0 fs/configfs/dir.c:1546
 vfs_rmdir+0x3de/0x560 fs/namei.c:4348
 do_rmdir+0x29a/0x590 fs/namei.c:4407
 __do_sys_rmdir fs/namei.c:4426 [inline]
 __se_sys_rmdir fs/namei.c:4424 [inline]
 __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424
 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f864f19e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe50a1fc48 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f864f425fa0 RCX: 00007f864f19e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140
RBP: 00007f864f23506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f864f425fac R14: 00007f864f425fa0 R15: 00007f864f425fa0
 </TASK>
BUG: scheduling while atomic: syz.2.24/388/0x00000000
Modules linked in:
CPU: 0 UID: 0 PID: 388 Comm: syz.2.24 Tainted: G        W          syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace: