Extracting prog: 51m21.239311814s Minimizing prog: 2h40m33.735390675s Simplifying prog options: 14m49.478082835s Extracting C: 5m13.392823932s Simplifying C: 0s extracting reproducer from 51 programs testing a last program of every proc single: executing 11 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$netlink_NETLINK_TX_RING-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$inet-ioctl$sock_inet_SIOCSIFFLAGS-sendmsg$NL80211_CMD_SET_INTERFACE-socket$packet-socket$inet-setsockopt$inet_tcp_int-bind$inet-setsockopt$SO_ATTACH_FILTER-sendto$inet-setsockopt$inet_tcp_TCP_CONGESTION-sendmmsg$inet-setsockopt$sock_int-writev-bind$packet-write detailed listing: executing program 0: r0 = socket(0x23, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000080)={0x209d, 0x0, 0x4, 0x10000}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r4, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b6", 0x148}], 0x1}}], 0x1, 0x2090) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) writev(r4, &(0x7f0000003240)=[{0x0}, {&(0x7f0000002200)="bb72f37d60513a07d8583e8f851cc0fc8b04e58e86ffbb954b5b43f85425d92da1ccc24410401291952fc861fc62b31526959d7998cba95407700cdc2672c63aa988797946c0896898d42f83ff3426f1dee050431b9ada1b0313e00a19c048dd410072878faa2dbb017de2f725f24a9cade4ce2ccb0a258087d2a3cf4a365f5b50478e27f84c21fc632a9ab4a853033505b1b60f2767c63bf4c53510863e97ac958be339e0cc3896408212164200599a63a9771bcfaf5804cd3d80c411ec36b581eeb4e2a65170e1ee9f1a4f34802861921d858219ab8f05d3e12a99bdb1ba4589d21da6dd945a1ac5161cf010f6091b406350f81f5aa26a4f1a3d16b4d2523b3a2170cac6f9c886084d6f25c07d2db1fca228783e26deb0ff63c6436088ad0563c55c19340a36eca42145fad1bc16b97649eff9cab5b486c6a6ef14f5b3a3e7a66e294fd7e10404e3567c1f028964f7d324ae8839023864c344019e411d507beda954932c6610a55d2a94ad7575518c074c06633829bc8c64faf9044f3c560d482a5adeaca17461bdfe7034cd687b590872b71058d059e663d3964d86ba7d9a43139f163b9850c6d8eda42a0583d988aafe480ac7d6cc5abbe09e2eed79269f23a32ab98f8bc58952758d99f88411c989a6c881390d3c10979c7f281e60249335c5ad7a1bca88d240e96186d498675ee727280a61707e7359c4f274d91f9eacef59d6a7e784d4426a3d555d1a7306b88b1bf9a203ebbd0bb7371ed551b9e683daa42ebc195551f97a4d1f543f24e4af35bc471e72d5dfe987f88387df761b4916b194aac607d31c1030af60ccda103c5a5e154c2b1762aed739b6c5d33f35206ac6a20ed9730910bc01d487bb0119dc7fd337da93e7fc5b00a123e8d34fa3f359ca9116a44abb51bc2d5cf56603527ca3e6a4f3a956f67cd1cada97a794a325e181ebfdd1e238f2ba93579582acab5c7a9356bab015b454d9b9f7bdeb4e601a891c86d7b4f591ced79ed8c3213716d484f2d0f6c4b40b4c5cf644d8d057e0621117cec1ce5a09a03b3151277c21962a44ebd4d4e2e2067d9776fae7c46c45fce9ca6009d79907bff66cda347433ba02566775a6564088a280ea016649512888a640fe9ff374cdabaad28753557a1b78a060264768a95a25daa4e6dd05f9696d81536225b2cdf0a400a3e8947ee8915cac66a9b304687223364d4663331f164b5eca29dc45f39d6bfb475f774300f031c2933fe135b72409738344340f68067da1dbec6ce5cad4a07d459bf4a5ea09193c49c35ccc58d182f7ab4152a80aebf9eacc367cd4ad5bdad24deadd200c8b7649900a25000a46fb36bc3298b3d3279905cf278221c0ba127f6e676d333cdb68678f80be017082f6c8d1a227ff77455fffded07d973816c94acd2a12404bb0e8d4c927269127416d74d27fd7e2f9bbda3ee4010f6d33a8de6a3ba1ff6a9df4effa31d428dfa3f3c29f949bc8ae9bd2dda5802004311cc9db170d84f9eb5b1bb12e6ec237ac308565482afaa5b47a0d503d4ddb4211f17b9b0f3b2abb766c575194aa5dc39530414968f218c1b41c9581b6830e9138d8abdc608cab60d639d7a167576d2cc803fe54a21a1db0312984cbd6f04f583687b19e5693d78358f4173c39e9fa5f41c4b35b9801cc7a6ac1331fcad1f38a639f74e1b2a70b0d2cb947455700186193375b32138813bd1c552cf53deb9ee3980a1b03fd0b44ed99ccafa76c3daabb6a1d1cbab3a2563abcd62f3432f8a62408bcc23e2324c6092b52f3e945a3d17ad38db4e7942564d2a6e470916ac0c7f909c91afb01cb6801848e56366e949fb2242187829862f88c4ecbb77d0c8009881d7172cb607757bc00c56f57d07676e4b93d6826d15ce65451cbbd2cc8fc309092b6d1c197995276c64ba5523c1122bd24176e12110923ef28bb69411bf5b3345d9def37b643278df56e1eebe82b2965d1c07a2bc762f2f4b2fec17ee266f661a195afa926296e722a4ca1252cfd37b70291ac8b433d70dd7dc261998f9c0fac2c3268b4ff81954a63fc1de0867484f7f2d5c3ab2ff80a3e2c4205a61081dc5e5431a2577a730057be0d87ee887cccd49bbd138e87423f5455a049518259a98f853ebe99004e96fc24c6f06c7ef654727dd93fbaea64766e13164bdeb57b20a6272e6787357e0285df325aba2274e5c7044fc550b833641bd4ab285b069617c073df3406f0ffd02cc82a331f0d8d3f0af99f673a9c039f573345246e36a1f30e1dcf07b3f3fc6e279f01b492f5f023c1b8d42445", 0x658}], 0x2) bind$packet(r3, 0x0, 0x0) write(r0, &(0x7f00000000c0)="1800000016005f0214ffffffffff", 0xe) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-socket$nl_xfrm-mq_open-socket$rds-ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD-syz_usb_control_io$hid-socket$inet_sctp-close-mkdirat-ioctl$SNDRV_CTL_IOCTL_ELEM_READ-prctl$PR_MCE_KILL-prctl$PR_SCHED_CORE-prlimit64-openat$sequencer-syz_open_dev$sndmidi-writev-socket-bind$netlink-socket$netlink-sendmsg$nl_route-recvmmsg-sendmsg$nl_xfrm-socket$nl_xfrm-openat$tcp_mem-syz_usb_control_io$uac2 detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) mq_open(&(0x7f0000000040)=']\x00', 0xdd326361bc84707c, 0x4, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r2, 0x8982, &(0x7f0000000100)={0x8, 'macvlan1\x00', {'veth1_to_bond\x00'}}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xa, {[@global=@item_4={0x3, 0x1, 0xe, '\a\x00'}, @main=@item_4={0x3, 0x0, 0xa, "e811e23b"}]}}, 0x0}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc2c45512, 0x0) prctl$PR_MCE_KILL(0x42, 0x1, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x1, 0x5, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}, 0x1, 0x0, 0x0, 0x4004050}, 0x800) recvmmsg(r4, &(0x7f0000007700), 0x318, 0xfc0, 0x0) sendmsg$nl_xfrm(r1, 0x0, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-ptrace$ARCH_GET_CPUID-getpid-sched_setscheduler-syz_clone-sched_setaffinity-syz_open_dev$MSR-read$msr-socket-mknodat$null-openat$fuse-read$FUSE detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ptrace$ARCH_GET_CPUID(0x1e, 0x0, 0x0, 0x1011) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x10, 0x3, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x100, 0x103) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r2, &(0x7f0000004280)={0x2020}, 0x2020) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-prlimit64-sched_setscheduler-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-sched_setaffinity-mkdir-mount-mkdir-openat detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="35874207", @ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYBLOB, @ANYRES32=r1, @ANYBLOB="66c429ef2213efc5a9e19ed391a9ab9eb0ac746698e78eee56fd2fc3b72a3c615b2925736f0184a847df38881ee2a6c0f58f56ab060993d19aa5bca04f976c695a50483577bec1c3bbd87ec0fdef561b93105bf1a29df22cad5b7e304aa83db432ab304df9c21268c812e566f8a8821144c1373a01f70d9cf5fbede22020e6e4fc87ce84363335985b96e0c1af57f61e7222782beb358c3a4f9ab1ba9b5db8fe321dcb97f2490aebc07ddaba7e2f3e38d7c88749e3eb8b60717aa17e1e7e4bdf15209641feafdaaa416b2f7aa8d25f6271d127c8afedbe0bd4e2bfef888dda68f6ba4717cc949f632c28c2161cea50dc81934a45caf28c15e352", @ANYRES16=r1, @ANYRES16], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r7, 0x0, 0x0) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/sub_compatible_id\x00', 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): read$FUSE-prlimit64-mount-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-fsconfig$FSCONFIG_CMD_CREATE-close-syz_open_dev$tty1-ioctl$KDFONTOP_SET-syz_emit_vhci-ioctl$vim2m_VIDIOC_ENUM_FMT-sendmmsg$sock-mkdir-syz_open_dev$tty1-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_DEVICE-ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE-ioctl$KDDISABIO-mount-openat$vcsa-openat detailed listing: executing program 0: read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080)='gadgetfs\x00', 0x10005, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r3, 0x4b72, &(0x7f00000001c0)={0x0, 0x20000, 0x8, 0x2, 0x200, &(0x7f0000003c40)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a73090000000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_pin_code_req={{0x16, 0x6}, {@none}}}, 0x9) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000280)={0xffffe8d3, 0x1, 0x83, "ac9b94aaad0b79ae3a00000000000000dcfa577900", 0x31324d59}) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000004100), 0x0, 0x0) mkdir(&(0x7f0000000000)='./proc_mnt\x00', 0x1ff) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat$kvm(0xffffff9c, &(0x7f00000001c0), 0xe41, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r7, 0x4018f50b, &(0x7f0000000000)={0x0, 0x8, 0x9}) ioctl$KDDISABIO(r4, 0x4b37) mount(0x0, &(0x7f0000000100)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f00000010c0), 0x806280, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-socket$nl_xfrm-close-socket$l2tp-shutdown-recvmmsg detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_xfrm(0x10, 0x3, 0x6) close(r0) socket$l2tp(0x2, 0x2, 0x73) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-socket$nl_xfrm-close-socket$l2tp-shutdown-recvmmsg detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_xfrm(0x10, 0x3, 0x6) close(r0) socket$l2tp(0x2, 0x2, 0x73) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-socket$nl_route-socket$inet_tcp-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open single: successfully extracted reproducer found reproducer with 18 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-socket$nl_route-socket$inet_tcp-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-socket$nl_route-socket$inet_tcp-unshare-socket$nl_netfilter-socket$nl_netfilter-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-socket$nl_route-socket$inet_tcp-unshare-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-socket$nl_route-socket$inet_tcp-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-socket$nl_route-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-openat-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-openat-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-mkdirat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) write(0xffffffffffffffff, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mount-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mkdirat-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380), 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, 0x0, 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280), 0x0) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, 0x0, 0x1b, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in instance_mkdir validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write-openat-write-unshare-socket$nl_netfilter-socket$nl_netfilter-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) unshare(0xc000000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs/available_tracers\x00', 0x1b, 0x0) program crashed: INFO: task hung in show_traces_open validation run: crashed=true reproducing took 4h1m26.149520332s repro crashed as (corrupted=false): INFO: task syz.2.19:4395 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:26896 pid: 4395 ppid: 4324 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efd3c5801d9 RSP: 002b:00007ffd87a03378 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007efd3c807fa0 RCX: 00007efd3c5801d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007efd3c617888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efd3c807fac R14: 00007efd3c807fa0 R15: 00007efd3c807fa0 INFO: task syz.1.18:4396 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27088 pid: 4396 ppid: 4319 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc806d361d9 RSP: 002b:00007fffe3656918 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fc806fbdfa0 RCX: 00007fc806d361d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fc806dcd888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc806fbdfac R14: 00007fc806fbdfa0 R15: 00007fc806fbdfa0 INFO: task syz.4.21:4397 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.21 state:D stack:27472 pid: 4397 ppid: 4331 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fca1513e1d9 RSP: 002b:00007ffd23de2e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fca153c5fa0 RCX: 00007fca1513e1d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fca151d5888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fca153c5fac R14: 00007fca153c5fa0 R15: 00007fca153c5fa0 INFO: task syz.3.20:4398 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:27088 pid: 4398 ppid: 4326 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa3d2af61d9 RSP: 002b:00007ffefa871d38 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fa3d2d7dfa0 RCX: 00007fa3d2af61d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fa3d2b8d888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa3d2d7dfac R14: 00007fa3d2d7dfa0 R15: 00007fa3d2d7dfa0 Showing all locks held in the system: 3 locks held by kworker/1:1/23: #0: ffff88802c568138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000ddfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 1 lock held by khungtaskd/27: #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:1/144: 2 locks held by getty/3947: #0: ffff88814c7ac098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 2 locks held by kworker/1:3/4248: #0: ffff888017872138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90002f4fd00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 3 locks held by kworker/0:16/4312: #0: ffff88802c568138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000312fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e24d5c8 (rtnl_mutex ){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 5 locks held by syz.0.17/4363: 3 locks held by kworker/u4:6/4384: 1 lock held by syz.2.19/4395: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.1.18/4396: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.21/4397: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3} , at: trace_array_get kernel/trace/trace.c:451 [inline] , at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] , at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.20/4398: #0: ffffffff8d1615a8 ( trace_types_lock ){+.+.}-{3:3} , at: trace_array_get kernel/trace/trace.c:451 [inline] , at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] , at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.5.22/4421: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.6.23/4465: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.9.26/4503: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.7.24/4504: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.8.25/4505: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.2.32/4562: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.44/4608: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.1.43/4609: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.45/4632: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.5.65/4648: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.6.88/4743: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.9.89/4744: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.7.98/4777: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.8.104/4782: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.130/4847: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.2.129/4851: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.144/4886: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz-executor/4887: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz.1.141/4888: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 3 locks held by syz-executor/4892: #0: ffffffff8e24d5c8 (rtnl_mutex ){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] ){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 #1: ffff88805926d3e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49 #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 1 lock held by syz-executor/4946: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4948: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4302 Comm: kworker/0:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: events hci_cmd_timeout RIP: 0010:format_decode+0x146/0x1330 lib/vsprintf.c:2545 Code: 48 c1 e8 03 0f b6 04 18 84 c0 75 2b 45 0f b6 3e 4c 89 ff 48 c7 c6 40 fa 74 8d e8 65 bd 6c fd 45 85 ff 74 2d 41 83 ff 25 74 20 f5 b8 6c fd 49 ff c6 48 ff c5 eb c6 89 e9 80 e1 07 38 c1 7c cc RSP: 0018:ffffc900030af450 EFLAGS: 00000202 RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000001 RDX: ffffffff840c6a5b RSI: ffffffff8d74fa40 RDI: 000000000000005d RBP: ffffffff8a2be344 R08: ffff88802d439dc0 R09: 0000000000000002 R10: 0000000000000025 R11: 0000000000000000 R12: ffffffff8a2be344 R13: ffff0a0000000604 R14: ffffffff8a2be344 R15: 000000000000005d FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557f736a38 CR3: 000000002bd78000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vsnprintf+0xef/0x1c20 lib/vsprintf.c:2763 sprintf+0xe4/0x140 lib/vsprintf.c:3013 print_caller kernel/printk/printk.c:1285 [inline] info_print_prefix+0x20c/0x360 kernel/printk/printk.c:1302 record_print_text kernel/printk/printk.c:1349 [inline] console_unlock+0x650/0x10f0 kernel/printk/printk.c:2725 vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274 _printk+0xda/0x130 kernel/printk/printk.c:2299 bt_err+0x11e/0x180 net/bluetooth/lib.c:180 hci_cmd_timeout+0x10a/0x220 net/bluetooth/hci_core.c:2797 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 final repro crashed as (corrupted=false): INFO: task syz.2.19:4395 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:26896 pid: 4395 ppid: 4324 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efd3c5801d9 RSP: 002b:00007ffd87a03378 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007efd3c807fa0 RCX: 00007efd3c5801d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007efd3c617888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efd3c807fac R14: 00007efd3c807fa0 R15: 00007efd3c807fa0 INFO: task syz.1.18:4396 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27088 pid: 4396 ppid: 4319 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc806d361d9 RSP: 002b:00007fffe3656918 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fc806fbdfa0 RCX: 00007fc806d361d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fc806dcd888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc806fbdfac R14: 00007fc806fbdfa0 R15: 00007fc806fbdfa0 INFO: task syz.4.21:4397 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.21 state:D stack:27472 pid: 4397 ppid: 4331 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fca1513e1d9 RSP: 002b:00007ffd23de2e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fca153c5fa0 RCX: 00007fca1513e1d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fca151d5888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fca153c5fac R14: 00007fca153c5fa0 R15: 00007fca153c5fa0 INFO: task syz.3.20:4398 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:27088 pid: 4398 ppid: 4326 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa3d2af61d9 RSP: 002b:00007ffefa871d38 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fa3d2d7dfa0 RCX: 00007fa3d2af61d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fa3d2b8d888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa3d2d7dfac R14: 00007fa3d2d7dfa0 R15: 00007fa3d2d7dfa0 Showing all locks held in the system: 3 locks held by kworker/1:1/23: #0: ffff88802c568138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000ddfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 1 lock held by khungtaskd/27: #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:1/144: 2 locks held by getty/3947: #0: ffff88814c7ac098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 2 locks held by kworker/1:3/4248: #0: ffff888017872138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90002f4fd00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 3 locks held by kworker/0:16/4312: #0: ffff88802c568138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000312fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e24d5c8 (rtnl_mutex ){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 5 locks held by syz.0.17/4363: 3 locks held by kworker/u4:6/4384: 1 lock held by syz.2.19/4395: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.1.18/4396: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.21/4397: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3} , at: trace_array_get kernel/trace/trace.c:451 [inline] , at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] , at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.20/4398: #0: ffffffff8d1615a8 ( trace_types_lock ){+.+.}-{3:3} , at: trace_array_get kernel/trace/trace.c:451 [inline] , at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] , at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.5.22/4421: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.6.23/4465: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.9.26/4503: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.7.24/4504: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.8.25/4505: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.2.32/4562: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.44/4608: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.1.43/4609: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.45/4632: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.5.65/4648: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.6.88/4743: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.9.89/4744: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.7.98/4777: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.8.104/4782: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.130/4847: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.2.129/4851: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.144/4886: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz-executor/4887: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz.1.141/4888: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 3 locks held by syz-executor/4892: #0: ffffffff8e24d5c8 (rtnl_mutex ){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] ){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 #1: ffff88805926d3e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49 #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 1 lock held by syz-executor/4946: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4948: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4302 Comm: kworker/0:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: events hci_cmd_timeout RIP: 0010:format_decode+0x146/0x1330 lib/vsprintf.c:2545 Code: 48 c1 e8 03 0f b6 04 18 84 c0 75 2b 45 0f b6 3e 4c 89 ff 48 c7 c6 40 fa 74 8d e8 65 bd 6c fd 45 85 ff 74 2d 41 83 ff 25 74 20 f5 b8 6c fd 49 ff c6 48 ff c5 eb c6 89 e9 80 e1 07 38 c1 7c cc RSP: 0018:ffffc900030af450 EFLAGS: 00000202 RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000001 RDX: ffffffff840c6a5b RSI: ffffffff8d74fa40 RDI: 000000000000005d RBP: ffffffff8a2be344 R08: ffff88802d439dc0 R09: 0000000000000002 R10: 0000000000000025 R11: 0000000000000000 R12: ffffffff8a2be344 R13: ffff0a0000000604 R14: ffffffff8a2be344 R15: 000000000000005d FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557f736a38 CR3: 000000002bd78000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vsnprintf+0xef/0x1c20 lib/vsprintf.c:2763 sprintf+0xe4/0x140 lib/vsprintf.c:3013 print_caller kernel/printk/printk.c:1285 [inline] info_print_prefix+0x20c/0x360 kernel/printk/printk.c:1302 record_print_text kernel/printk/printk.c:1349 [inline] console_unlock+0x650/0x10f0 kernel/printk/printk.c:2725 vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274 _printk+0xda/0x130 kernel/printk/printk.c:2299 bt_err+0x11e/0x180 net/bluetooth/lib.c:180 hci_cmd_timeout+0x10a/0x220 net/bluetooth/hci_core.c:2797 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287