Extracting prog: 4m4.017099576s Minimizing prog: 55m46.265540099s Simplifying prog options: 8m15.89633954s Extracting C: 1m10.466675491s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program crashed: BUG: soft lockup in sock_close single: successfully extracted reproducer found reproducer with 3 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, 0x0, 0x0) (async) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(r1, 0x0, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet program crashed: BUG: soft lockup in sock_setsockopt a never seen crash title: BUG: soft lockup in sock_setsockopt, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf-sendmsg$inet detailed listing: executing program 0: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f0000000540), 0x4) (async) sendmsg$inet(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) program crashed: BUG: soft lockup in sys_sendmsg a never seen crash title: BUG: soft lockup in sys_sendmsg, ignore reproducing took 1h9m16.645692396s repro crashed as (corrupted=false): watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz.0.3822:15652] Modules linked in: irq event stamp: 17025 hardirqs last enabled at (17024): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline] hardirqs last enabled at (17024): [] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91 hardirqs last disabled at (17025): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (12762): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (12772): [] spin_lock_bh include/linux/spinlock.h:368 [inline] softirqs last disabled at (12772): [] lock_sock_nested+0x108/0x1ec net/core/sock.c:3256 CPU: 0 PID: 15652 Comm: syz.0.3822 Not tainted 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382 lr : queued_spin_lock_slowpath+0x16c/0x938 kernel/locking/qspinlock.c:382 sp : ffff800022067600 x29: ffff8000220676a0 x28: 1ffff0000440cecc x27: 1fffe0001dc4eef2 x26: dfff800000000000 x25: ffff70000440cec4 x24: ffff800022067620 x23: 1fffe0001dc4eef1 x22: ffff800022067660 x21: 0000000000000001 x20: 0000000000000001 x19: ffff0000ee277788 x18: 0000000000000000 x17: 0000000000000000 x16: ffff800008305360 x15: 0000000000000002 x14: 1ffff0000296e06c x13: dfff800000000000 x12: 0000000000000001 x11: 1fffe0001dc4eef1 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000101 x7 : ffff80000ff135f0 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008304588 x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline] __cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline] queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline] _raw_spin_lock_bh+0x12c/0x1c4 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:368 [inline] lock_sock_nested+0x108/0x1ec net/core/sock.c:3256 lock_sock include/net/sock.h:1684 [inline] tipc_release+0xa8/0x1460 net/tipc/socket.c:639 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x1fc net/socket.c:1336 __fput+0x1c4/0x800 fs/file_table.c:280 ____fput+0x20/0x30 fs/file_table.c:308 task_work_run+0x130/0x1e4 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 final repro crashed as (corrupted=false): watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz.0.3822:15652] Modules linked in: irq event stamp: 17025 hardirqs last enabled at (17024): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:81 [inline] hardirqs last enabled at (17024): [] exit_to_kernel_mode+0x100/0x178 arch/arm64/kernel/entry-common.c:91 hardirqs last disabled at (17025): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (12762): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (12772): [] spin_lock_bh include/linux/spinlock.h:368 [inline] softirqs last disabled at (12772): [] lock_sock_nested+0x108/0x1ec net/core/sock.c:3256 CPU: 0 PID: 15652 Comm: syz.0.3822 Not tainted 5.15.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382 lr : queued_spin_lock_slowpath+0x16c/0x938 kernel/locking/qspinlock.c:382 sp : ffff800022067600 x29: ffff8000220676a0 x28: 1ffff0000440cecc x27: 1fffe0001dc4eef2 x26: dfff800000000000 x25: ffff70000440cec4 x24: ffff800022067620 x23: 1fffe0001dc4eef1 x22: ffff800022067660 x21: 0000000000000001 x20: 0000000000000001 x19: ffff0000ee277788 x18: 0000000000000000 x17: 0000000000000000 x16: ffff800008305360 x15: 0000000000000002 x14: 1ffff0000296e06c x13: dfff800000000000 x12: 0000000000000001 x11: 1fffe0001dc4eef1 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000101 x7 : ffff80000ff135f0 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008304588 x2 : 0000000000000000 x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:252 [inline] __cmpwait arch/arm64/include/asm/cmpxchg.h:278 [inline] queued_spin_lock_slowpath+0x160/0x938 kernel/locking/qspinlock.c:382 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline] do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline] _raw_spin_lock_bh+0x12c/0x1c4 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:368 [inline] lock_sock_nested+0x108/0x1ec net/core/sock.c:3256 lock_sock include/net/sock.h:1684 [inline] tipc_release+0xa8/0x1460 net/tipc/socket.c:639 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x1fc net/socket.c:1336 __fput+0x1c4/0x800 fs/file_table.c:280 ____fput+0x20/0x30 fs/file_table.c:308 task_work_run+0x130/0x1e4 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584