Extracting prog: 33m53.984373426s Minimizing prog: 2h39m29.969146955s Simplifying prog options: 26m17.044566419s Extracting C: 5m39.419994718s Simplifying C: 0s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-shmget$private-shmat-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-mremap-shmdt-syz_usb_disconnect-syz_usb_connect-syz_open_dev$char_usb-syz_usb_ep_write detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) r1 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) r2 = shmat(r1, &(0x7f0000ff1000/0x3000)=nil, 0x400c) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000005c0)={0x1, @pix_mp={0x3fc, 0x1, 0x30314742, 0x3, 0x8, [{0x8, 0xf}, {0x8, 0x8}, {0xa, 0x6f180000}, {0x4000005, 0x8}, {0x0, 0x2003}, {0x6, 0x9}, {0x6, 0xb}, {0x76, 0x1c00000}], 0x0, 0xd, 0x2, 0x3078182a3427730f, 0x1}}) mremap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) shmdt(r2) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_mptcp-bind$inet-connect$inet-writev-syz_usb_connect-syz_open_dev$char_usb-pselect6-shutdown-ioctl$sock_SIOCGIFINDEX-setxattr$system_posix_acl-getxattr detailed listing: executing program 0: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r0, &(0x7f0000000200)=[{0x0}], 0x1) syz_usb_connect(0x3, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) shutdown(r0, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'gre0\x00'}) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000004240)={{}, {}, [], {0x4, 0x5}, [{0x8, 0x5}, {0x8, 0x1}], {0x10, 0x6}, {0x20, 0x2}}, 0x34, 0x1) getxattr(&(0x7f0000005140)='./file0\x00', &(0x7f0000005180)=@known='system.posix_acl_access\x00', &(0x7f00000051c0)=""/47, 0x2f) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ecm-syz_usb_disconnect-syz_usb_connect$printer-syz_usb_control_io$printer-syz_usb_control_io-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000102505a1a44000000001010902440001fd00000009040000ff0202ffff052406000005240000000d240f010000000000000000000905810320000000000905820220000000000905030208"], 0x0) syz_usb_disconnect(r0) (async) r1 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000dc0)=ANY=[], 0x0) syz_usb_control_io$printer(r1, &(0x7f0000001100)={0x14, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x3, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x7}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x4c841}, 0x802) syz_usb_control_io(r1, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000400)=ANY=[@ANYBLOB='@\t\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): shmget-socketpair$unix-connect$unix-syz_open_dev$sndpcmp-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-madvise-landlock_create_ruleset-landlock_create_ruleset-landlock_restrict_self-syz_clone-socket$nl_generic-socket$nl_generic-openat$kvm-ioctl$KVM_CREATE_VM-close-syz_clone3-syz_genetlink_get_family_id$nl80211-recvmmsg-sendmsg$NL80211_CMD_SET_TID_CONFIG-ioctl$sock_SIOCGIFINDEX_80211-syz_open_procfs$namespace-syz_emit_ethernet-syz_open_procfs$userns-ioctl$NS_GET_PARENT-sendmsg$ETHTOOL_MSG_DEBUG_SET-bpf$PROG_LOAD detailed listing: executing program 0: shmget(0x1, 0x1000, 0x2, &(0x7f00003ae000/0x1000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff, 0xc, 0x2, 0x86cb}, 0x30, 0x1) landlock_restrict_self(r2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) close(r6) syz_clone3(&(0x7f00000003c0)={0x122125000, &(0x7f00000000c0), 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) recvmmsg(r4, &(0x7f0000002a80)=[{{0x0, 0x0, 0x0}, 0x263b}], 0x1, 0x40004000, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x38, r7, 0xc4fc9e906872338b, 0x0, 0xf0ffff, {{0x5}, {@val={0x8}, @val={0xc}}}, [@NL80211_ATTR_TID_CONFIG={0x6, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x4}]}]}]}, 0x38}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/ipc\x00') syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local={0xd}, @multicast, @void, {@ipv4={0x800, @udp={{0xc, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x8, 0x73, 0x0, @private, @broadcast, {[@timestamp_prespec={0x44, 0x1c, 0xe, 0x3, 0xd, [{@local, 0x8}, {@loopback, 0x5}, {@local, 0x8}]}]}}, {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) syz_open_procfs$userns(0xffffffffffffffff, 0x0) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r3, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x14, 0x0, 0x1, 0x400000, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x24}, 0x804) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d70300000000000000d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df6c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8a9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2a9e99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8be1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaa072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a3ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a98838156ff00000000000000cdbf91f7582ab314be3e67b8c9459564c856339a80919ecf839560c62e69df8667b274cc53f83f2086cfd2664252471fad9081824d60741d663ee258705c364e162b84a09870acd0a19399103474444f4fa12dcbd10b40195b6088513029b60a34e4161fe48c092693eb07dc8ddcba2eac2efe30b285a877c862c73ff8a60cf73f1b17da0000000000005664181c1f28cd2880e6872bae932eaf4b0000000000007b662c0fe22cfd6d4bd7b851ae928cebeec6375b16af342e93c39d97e5d74d5a8e96c15fdcde7526b0af54b145e61b042c1e600390590a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_open_dev$audion-socket$kcm-socket-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-madvise-sched_setattr-madvise-mremap-openat$incfs-ioctl$SG_GET_TIMEOUT-prctl$PR_SET_IO_FLUSHER-socket$nl_generic-sendmsg$nl_generic-setsockopt$RXRPC_SECURITY_KEY-bpf$PROG_LOAD-syz_usb_connect-close-sendmsg$tipc-execve-syz_usb_connect-syz_open_dev$radio-bpf$BPF_BTF_LOAD-openat$iommufd-ioctl-setsockopt$sock_attach_bpf detailed listing: executing program 0: syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8], 0x0) syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) r0 = socket$kcm(0xa, 0x1, 0x0) socket(0x1e, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) r3 = openat$incfs(0xffffffffffffffff, &(0x7f0000000140)='.pending_reads\x00', 0x8a083, 0x20) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x15, 0x301, 0x70bd28, 0x25dfdbfb, {0xc}, [@typed={0xc, 0x4, 0x0, 0x0, @str='\x00\x00\x00\x00\x00\x00\x00\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_connect(0x1, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x300, 0x1, 0x85, 0x2c, 0x8, 0x525, 0xa4a3, 0xfd97, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x7, 0x0, 0x6, "", [{{0x9, 0x4, 0x8, 0xa, 0x0, 0xa6, 0x41, 0xa8, 0xed}}]}}]}}, &(0x7f0000000980)={0x0, 0x0, 0x5, 0x0, 0x1, [{0x0, 0x0}]}) close(0xffffffffffffffff) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000003140)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x1, {0x43, 0x3}}, 0x10, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x40051}, 0x20008000) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x400000}, 0x28) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl(r5, 0x3b93, &(0x7f00000000c0)='(') setsockopt$sock_attach_bpf(r0, 0x29, 0x21, &(0x7f0000000100), 0x120) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ppoll-ioctl$KVM_SET_USER_MEMORY_REGION2-ioctl$KVM_SET_MEMORY_ATTRIBUTES-ioctl$KVM_CREATE_VCPU-ioctl$KVM_PRE_FAULT_MEMORY-ioctl$KVM_GET_PIT detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r6}) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) (async) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000000240)) program crashed: INFO: task hung in kvm_gmem_release single: successfully extracted reproducer found reproducer with 27 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ppoll-ioctl$KVM_SET_USER_MEMORY_REGION2-ioctl$KVM_SET_MEMORY_ATTRIBUTES-ioctl$KVM_CREATE_VCPU-ioctl$KVM_PRE_FAULT_MEMORY detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r6}) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ppoll-ioctl$KVM_SET_USER_MEMORY_REGION2-ioctl$KVM_SET_MEMORY_ATTRIBUTES-ioctl$KVM_CREATE_VCPU detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r6}) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ppoll-ioctl$KVM_SET_USER_MEMORY_REGION2-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r6}) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_vm_ioctl_set_memory_region testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ppoll-ioctl$KVM_SET_USER_MEMORY_REGION2 detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r6}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r6, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-write$uinput_user_dev-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r6, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ioctl$vim2m_VIDIOC_STREAMOFF-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r6, 0x40045612, &(0x7f0000000100)=0x1) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_REQBUFS-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-syz_open_dev$vim2m-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_VM-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-openat$kvm-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-write$RDMA_USER_CM_CMD_CREATE_ID-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) (async) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-syz_genetlink_get_family_id$l2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-getsockopt$inet6_udp_int-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) getsockopt$inet6_udp_int(r2, 0x11, 0x1, &(0x7f0000000140), &(0x7f0000000300)=0x4) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r5, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-sendmsg$nl_xfrm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=@newsa={0x144, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@rand_addr=0x64010101, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x9, 0xa, 0x400000000000, 0x0, 0x0, 0x3}, {0x4010, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x0, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @extra_flags={0x8, 0x18, 0x3}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-socket$nl_xfrm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$iommufd-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f00000003c0), 0x501801, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-socket$nl_generic-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-sendmsg$NFT_BATCH-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-socket$nl_netfilter-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-mmap-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x40, 0x41, 0x107, 0x70bd27, 0xfffffdfe, {0x4, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x18, 0x2, 0x0, 0x1, [@typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program crashed: INFO: task hung in kvm_gmem_release testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program crashed: INFO: task hung in kvm_gmem_release extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program crashed: INFO: task hung in kvm_gmem_release extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program crashed: INFO: task hung in kvm_gmem_release extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program crashed: INFO: task hung in kvm_gmem_release validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program crashed: INFO: task hung in kvm_gmem_release validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket-openat-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_GUEST_MEMFD-ppoll-ioctl$KVM_SET_MEMORY_ATTRIBUTES detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000200)={0x10000, 0x1000000, 0x8}) program crashed: INFO: task hung in kvm_gmem_release validation run: crashed=true reproducing took 3h59m7.2616369s repro crashed as (corrupted=false): INFO: task syz.0.17:5837 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:26184 pid:5837 tgid:5837 ppid:5751 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5520 [inline] __schedule+0x17d4/0x5820 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7362 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7f1039e159 RSP: 002b:00007ffd84d002b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f7f10627da0 RCX: 00007f7f1039e159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f7f10627da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f7f10627cb0 R11: 0000000000000246 R12: 0000000000018ede R13: 00007f7f1062609c R14: 0000000000018bf0 R15: 00007ffd84d003c0 Showing all locks held in the system: locks held by kworker/u8:0/12: 4, last CPU#1: #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffff88807a51e1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 net/batman-adv/bat_iv_ogm.c:1010 #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:870 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:949 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule+0x41f/0xfc0 net/batman-adv/bat_iv_ogm.c:1011 locks held by pr/ttyS0/16: 2, last CPU#0: locks held by pr/ttyS0/16: 2, last CPU#0: #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9ad2f098 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9ad2f098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/32: 1, last CPU#1: #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837 locks held by kworker/u8:2/38: 3, last CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffff88802afed258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:4/61: 3, on CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffffffff90250d00 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/u8:6/203: 5, last CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffffffff8ebe98f0 (cpu_hotplug_lock ){++++}-{0:0}, at: static_key_disable+0x12/0x20 kernel/jump_label.c:247 #3: ffffffff8ee38100 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline] #3: ffffffff8ee38100 (jump_label_mutex){+.+.}-{4:4}, at: static_key_disable_cpuslocked+0x8d/0x1a0 kernel/jump_label.c:238 #4: ffffffff8ebff620 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 locks held by kworker/u8:10/1115: 3, last CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffff88802af96258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by getty/5376: 2, on CPU#1: #0: ffff8880340130a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.0.17/5837: 1, on CPU#0: #0: ffff88807dcc40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.0.17/5839: 2, last CPU#1: #0: ffff88807dcc40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff88807dcc40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: xa_cmpxchg include/linux/xarray.h:697 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: xa_reserve include/linux/xarray.h:1088 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2577 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: kvm_vm_ioctl_set_mem_attributes+0x3a1/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.1.19/5899: 1, on CPU#1: #0: ffff8880736bc0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.1.19/5901: 1, last CPU#1: #0: ffff8880736bc0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff8880736bc0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.2.22/5951: 1, on CPU#1: #0: ffff888059fd40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.2.22/5953: 1, last CPU#1: #0: ffff888059fd40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff888059fd40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.3.23/5991: 1, on CPU#0: #0: ffff88807a5a00a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.3.23/5993: 1, last CPU#1: #0: ffff88807a5a00a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff88807a5a00a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.4.24/6038: 1, on CPU#0: #0: ffff8880706a80a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.4.24/6040: 1, last CPU#1: #0: ffff8880706a80a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff8880706a80a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.5.25/6091: 1, on CPU#1: #0: ffff88807cbe40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.5.25/6093: 1, last CPU#1: #0: ffff88807cbe40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff88807cbe40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.6.26/6138: 1, on CPU#0: #0: ffff888059e7c0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.6.26/6140: 1, last CPU#1: #0: ffff888059e7c0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff888059e7c0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz-executor/6143: 2, last CPU#1: #0: ffffffff8eeabbb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeabbb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffff8880b873bb20 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:677 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:409 Code: e8 4e e8 55 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1f b0 c5 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 5a cc 74 06 cc 44 89 f9 80 e1 07 RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 RAX: 1ffffffff35a5e00 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff8571cb00 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffffff9ad2f0c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124cdc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562881265660 CR3: 000000007a4e2000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2013 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3429 [inline] serial8250_console_write+0xaa1/0x1200 drivers/tty/serial/8250/8250_port.c:3493 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x679/0x880 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task syz.0.17:5837 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:26184 pid:5837 tgid:5837 ppid:5751 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5520 [inline] __schedule+0x17d4/0x5820 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7362 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7419 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7f1039e159 RSP: 002b:00007ffd84d002b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f7f10627da0 RCX: 00007f7f1039e159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f7f10627da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f7f10627cb0 R11: 0000000000000246 R12: 0000000000018ede R13: 00007f7f1062609c R14: 0000000000018bf0 R15: 00007ffd84d003c0 Showing all locks held in the system: locks held by kworker/u8:0/12: 4, last CPU#1: #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff888032214940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc90000117c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffff88807a51e1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 net/batman-adv/bat_iv_ogm.c:1010 #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:870 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:949 [inline] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule+0x41f/0xfc0 net/batman-adv/bat_iv_ogm.c:1011 locks held by pr/ttyS0/16: 2, last CPU#0: locks held by pr/ttyS0/16: 2, last CPU#0: #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9ad2f098 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9ad2f098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/32: 1, last CPU#1: #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837 locks held by kworker/u8:2/38: 3, last CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc90000ae7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffff88802afed258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:4/61: 3, on CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffffffff90250d00 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/u8:6/203: 5, last CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc9000303fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffffffff8ebe98f0 (cpu_hotplug_lock ){++++}-{0:0}, at: static_key_disable+0x12/0x20 kernel/jump_label.c:247 #3: ffffffff8ee38100 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline] #3: ffffffff8ee38100 (jump_label_mutex){+.+.}-{4:4}, at: static_key_disable_cpuslocked+0x8d/0x1a0 kernel/jump_label.c:238 #4: ffffffff8ebff620 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 locks held by kworker/u8:10/1115: 3, last CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline] #1: ffffc90005017c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470 #2: ffff88802af96258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by getty/5376: 2, on CPU#1: #0: ffff8880340130a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.0.17/5837: 1, on CPU#0: #0: ffff88807dcc40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.0.17/5839: 2, last CPU#1: #0: ffff88807dcc40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff88807dcc40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: xa_cmpxchg include/linux/xarray.h:697 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: xa_reserve include/linux/xarray.h:1088 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2577 [inline] #1: ffffffff8ee8f900 (fs_reclaim){+.+.}-{0:0}, at: kvm_vm_ioctl_set_mem_attributes+0x3a1/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.1.19/5899: 1, on CPU#1: #0: ffff8880736bc0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.1.19/5901: 1, last CPU#1: #0: ffff8880736bc0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff8880736bc0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.2.22/5951: 1, on CPU#1: #0: ffff888059fd40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.2.22/5953: 1, last CPU#1: #0: ffff888059fd40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff888059fd40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.3.23/5991: 1, on CPU#0: #0: ffff88807a5a00a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.3.23/5993: 1, last CPU#1: #0: ffff88807a5a00a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff88807a5a00a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.4.24/6038: 1, on CPU#0: #0: ffff8880706a80a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.4.24/6040: 1, last CPU#1: #0: ffff8880706a80a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff8880706a80a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.5.25/6091: 1, on CPU#1: #0: ffff88807cbe40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.5.25/6093: 1, last CPU#1: #0: ffff88807cbe40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff88807cbe40a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz.6.26/6138: 1, on CPU#0: #0: ffff888059e7c0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_gmem_release+0xdf/0x3e0 virt/kvm/guest_memfd.c:310 locks held by syz.6.26/6140: 1, last CPU#1: #0: ffff888059e7c0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_set_mem_attributes virt/kvm/kvm_main.c:2566 [inline] #0: ffff888059e7c0a0 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_mem_attributes+0x33c/0x1600 virt/kvm/kvm_main.c:2625 locks held by syz-executor/6143: 2, last CPU#1: #0: ffffffff8eeabbb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeabbb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffff8880b873bb20 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:677 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:409 Code: e8 4e e8 55 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1f b0 c5 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 5a cc 74 06 cc 44 89 f9 80 e1 07 RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 RAX: 1ffffffff35a5e00 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff8571cb00 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffffff9ad2f0c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124cdc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562881265660 CR3: 000000007a4e2000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2013 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3270 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3429 [inline] serial8250_console_write+0xaa1/0x1200 drivers/tty/serial/8250/8250_port.c:3493 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x679/0x880 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245