Extracting prog: 1m0.443767981s
Minimizing prog: 1m43.255042866s
Simplifying prog options: 0s
Extracting C: 30.669570985s
Simplifying C: 2m32.938394503s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-madvise
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, &(0x7f0000000d40)={0x0, 0xffffff7c, 0x2, 0x3, 0x349}, &(0x7f0000000dc0), 0x0, 0x0)
madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15)

program crashed: WARNING in io_sq_thread_stop
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, &(0x7f0000000d40)={0x0, 0xffffff7c, 0x2, 0x3, 0x349}, &(0x7f0000000dc0), 0x0, 0x0)

program crashed: WARNING in io_sq_thread_stop
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, 0x0, &(0x7f0000000dc0), 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, &(0x7f0000000d40)={0x0, 0xffffff7c, 0x2, 0x3, 0x349}, 0x0, 0x0, 0x0)

program crashed: WARNING in io_sq_thread_stop
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
program crashed: WARNING in io_sq_thread_stop
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, &(0x7f0000000d40)={0x0, 0xffffff7c, 0x2, 0x3, 0x349}, 0x0, 0x0, 0x0)

program crashed: WARNING in io_sq_thread_stop
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, &(0x7f0000000d40)={0x0, 0xffffff7c, 0x2, 0x3, 0x349}, 0x0, 0x0, 0x0)

program crashed: WARNING in io_sq_thread_stop
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup
detailed listing:
executing program 0:
syz_io_uring_setup(0xec4, &(0x7f0000000d40)={0x0, 0xffffff7c, 0x2, 0x3, 0x349}, 0x0, 0x0, 0x0)

program crashed: WARNING in io_sq_thread_stop
validation run: crashed=true
reproducing took 7m28.497664294s
repro crashed as (corrupted=false):
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
------------[ cut here ]------------
test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state)
WARNING: io_uring/sqpoll.c:88 at io_sq_thread_stop+0x18b/0x1c0 io_uring/sqpoll.c:88, CPU#0: kworker/u33:3/68
Modules linked in:
CPU: 0 UID: 0 PID: 68 Comm: kworker/u33:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:io_sq_thread_stop+0x18b/0x1c0 io_uring/sqpoll.c:88
Code: 48 c7 c2 00 c5 80 8c be 25 00 00 00 48 c7 c7 60 c5 80 8c c6 05 bb 6d 20 0d 01 e8 60 2c b7 fc e9 12 ff ff ff e8 46 b2 dc fc 90 <0f> 0b 90 e9 c8 fe ff ff e8 38 b2 dc fc 90 0f 0b 90 e9 3c ff ff ff
RSP: 0018:ffffc90000d67a28 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888040645000 RCX: 0000000000000000
RDX: ffff888025454b00 RSI: ffffffff85319e7a RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: ffff88804064511f R11: 0000000000000000 R12: ffff888040645118
R13: 0000000000000000 R14: ffff888030ae24e0 R15: ffff888040644bc0
FS:  0000000000000000(0000) GS:ffff8880d447f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000007158601c000 CR3: 0000000028fce000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 io_put_sq_data io_uring/sqpoll.c:105 [inline]
 io_put_sq_data+0xb0/0x100 io_uring/sqpoll.c:100
 io_sq_thread_finish+0x252/0x320 io_uring/sqpoll.c:130
 io_ring_ctx_free io_uring/io_uring.c:2322 [inline]
 io_ring_exit_work+0x40a/0x9f5 io_uring/io_uring.c:2658
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
------------[ cut here ]------------
test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state)
WARNING: io_uring/sqpoll.c:88 at io_sq_thread_stop+0x18b/0x1c0 io_uring/sqpoll.c:88, CPU#0: kworker/u33:3/68
Modules linked in:
CPU: 0 UID: 0 PID: 68 Comm: kworker/u33:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:io_sq_thread_stop+0x18b/0x1c0 io_uring/sqpoll.c:88
Code: 48 c7 c2 00 c5 80 8c be 25 00 00 00 48 c7 c7 60 c5 80 8c c6 05 bb 6d 20 0d 01 e8 60 2c b7 fc e9 12 ff ff ff e8 46 b2 dc fc 90 <0f> 0b 90 e9 c8 fe ff ff e8 38 b2 dc fc 90 0f 0b 90 e9 3c ff ff ff
RSP: 0018:ffffc90000d67a28 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888040645000 RCX: 0000000000000000
RDX: ffff888025454b00 RSI: ffffffff85319e7a RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: ffff88804064511f R11: 0000000000000000 R12: ffff888040645118
R13: 0000000000000000 R14: ffff888030ae24e0 R15: ffff888040644bc0
FS:  0000000000000000(0000) GS:ffff8880d447f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000007158601c000 CR3: 0000000028fce000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 io_put_sq_data io_uring/sqpoll.c:105 [inline]
 io_put_sq_data+0xb0/0x100 io_uring/sqpoll.c:100
 io_sq_thread_finish+0x252/0x320 io_uring/sqpoll.c:130
 io_ring_ctx_free io_uring/io_uring.c:2322 [inline]
 io_ring_exit_work+0x40a/0x9f5 io_uring/io_uring.c:2658
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>