Extracting prog: 35m59.803752357s Minimizing prog: 2h8m24.641179339s Simplifying prog options: 11m6.403620103s Extracting C: 48.293861383s Simplifying C: 0s extracting reproducer from 51 programs testing a last program of every proc single: executing 11 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-socket$netlink-prlimit64-syz_emit_ethernet-sched_setscheduler-sched_setaffinity-prctl$PR_SCHED_CORE-syz_open_dev$MSR-socket$kcm-setsockopt$sock_attach_bpf-read$msr-socket$netlink-sendmsg$nl_route-eventfd-prctl$PR_SCHED_CORE-sched_setaffinity-socket$inet6_sctp-openat$ipvs-setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED-setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD-sendmmsg$inet6-setsockopt$inet_sctp6_SCTP_RESET_STREAMS-bpf$PROG_LOAD-socket-mkdir-getsockopt$bt_hci-openat$sysfs-write$cgroup_int-sendmsg$netlink-socket$igmp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xb0}, [@ldst={0x5, 0x0, 0x6}], {0x95, 0x0, 0x74}}, 0x0, 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = socket$kcm(0xa, 0x6, 0x0) setsockopt$sock_attach_bpf(r2, 0x10d, 0xa, &(0x7f0000000000), 0x4) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYRESDEC=r2, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005000100042300008578219c88a3cb88e3650a29c140a551e05fb22e2bf8f4ea0a5cb9764e1818bbbc5bd700e95bec133dbdcd7709f026bedcc6390a262bc8"], 0x4c}}, 0x0) eventfd(0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0xfffffffd, @loopback}], 0x1c) sendmmsg$inet6(r3, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, &(0x7f0000000240)=[{&(0x7f00000000c0)='\b', 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, 0x0, 0x1000f) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x6, &(0x7f0000000000)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket(0x18, 0x3, 0x0) mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) getsockopt$bt_hci(r4, 0x84, 0x82, &(0x7f0000001c40)=""/4112, &(0x7f0000001080)=0x1010) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r5, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="200000005e000100ffffffc3000000000c0000000d000000ffffff7f04000180"], 0x20}], 0x1}, 0x0) socket$igmp(0x2, 0x3, 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$packet-socket$unix-bind$unix-socket$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_l2cap-bpf$BPF_RAW_TRACEPOINT_OPEN-prlimit64-sched_setscheduler-getpid-sched_setaffinity-socketpair$unix-unshare-bpf$MAP_CREATE detailed listing: executing program 0: socket$kcm(0x29, 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000000c0)=@abs={0x1}, 0x6e) socket$inet6(0xa, 0xa, 0x1000) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000000000000c00850000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xe, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) unshare(0x2040400) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="050000007f000000f00e0000090000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000c00c008a00000000000000000000000000000000000000008b03c5001bc29e4d7b10ab23cef8c0e50f6d86733d8c2a3eca9410809b69dd712d7a0ecdd20fe6907a18eb773a95e335e483dabf853d7b1b2df3a549fb205253ab40b92e760325fcf8a82bf9bbffd1ad090c7fa0a2e535418f56abe7c3d22663f13d8ab8956b27d7dc6f49b0ec08752500c5359def5b6774ae81ea065187df94313b86d5432166e0777d723f9784e6020783bf8fa2c8750531bbee01903a476a853958c23d5d0463fd9910971af49f583c694d31f9fbcf58f00c"], 0x48) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-rseq-socket$nl_route-socket$inet6_udp-socket$nl_generic-flock-syz_usb_connect-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-landlock_create_ruleset detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) flock(0xffffffffffffffff, 0x1780f9c373410dea) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="16010200925f5510ac05261289b2010203010902"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x64, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_PORT={0x6}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x64}}, 0x0) landlock_create_ruleset(&(0x7f0000000000)={0x400, 0x2}, 0x18, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmmsg$inet_sctp-prlimit64-sched_setscheduler-getpid-sched_setaffinity-mmap-socketpair$unix-connect$unix-recvmmsg-socket$inet6_sctp-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST-setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY detailed listing: executing program 0: sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f0000002e40)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)}], 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x84515000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000000c0)={r3, 0x5}, 0x8) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_dccp-bpf$PROG_LOAD-prctl$PR_SCHED_CORE-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-creat-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_clone detailed listing: executing program 0: socket$inet_dccp(0x2, 0x6, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000840)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2ed0300000000000000af99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14008c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000006da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c4159b364a4fd7013f34db173a4fdacf15229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4978ea8e4aa37014191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be867a28f09c5877fc2355ecdc9c30dcb2d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd"], &(0x7f0000000380)='GPL\x00', 0x10, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) creat(0x0, 0xb9) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r3}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-mount$9p_fd-bpf$PROG_LOAD-io_uring_enter-socket$nl_generic-ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT-setsockopt$RDS_CONG_MONITOR detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff, 0x0}, 0x8) r12 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r13 = socket$inet6_sctp(0xa, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {'wfdno', 0x3d, r13}}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x22, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa85, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_val={0x18, 0x6, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xba7a}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @jmp={0x5, 0x1, 0x2, 0x3, 0x3, 0x7, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0xb, 0x8, 0x100, 0xfffffffffffffffc}, @cb_func={0x18, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='syzkaller\x00', 0xc, 0xe2, &(0x7f0000000780)=""/226, 0x41100, 0x10, '\x00', 0x0, @fallback=0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f00000008c0)={0x5, 0xe, 0x200, 0x80}, 0x10, r11, r12, 0x2, 0x0, &(0x7f0000000940)=[{0x2, 0x5, 0x10, 0x6}, {0x5, 0x4, 0x6, 0x8}], 0x10, 0x54af, @void, @value}, 0x94) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) setsockopt$RDS_CONG_MONITOR(r14, 0x114, 0x6, &(0x7f0000000040)=0x1, 0x4) program crashed: INFO: task hung in io_wq_put_and_exit single: successfully extracted reproducer found reproducer with 23 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-mount$9p_fd-bpf$PROG_LOAD-io_uring_enter-socket$nl_generic-ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff, 0x0}, 0x8) r12 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r13 = socket$inet6_sctp(0xa, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {'wfdno', 0x3d, r13}}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x22, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa85, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_val={0x18, 0x6, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xba7a}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @jmp={0x5, 0x1, 0x2, 0x3, 0x3, 0x7, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0xb, 0x8, 0x100, 0xfffffffffffffffc}, @cb_func={0x18, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='syzkaller\x00', 0xc, 0xe2, &(0x7f0000000780)=""/226, 0x41100, 0x10, '\x00', 0x0, @fallback=0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f00000008c0)={0x5, 0xe, 0x200, 0x80}, 0x10, r11, r12, 0x2, 0x0, &(0x7f0000000940)=[{0x2, 0x5, 0x10, 0x6}, {0x5, 0x4, 0x6, 0x8}], 0x10, 0x54af, @void, @value}, 0x94) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-mount$9p_fd-bpf$PROG_LOAD-io_uring_enter-socket$nl_generic detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff, 0x0}, 0x8) r12 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r13 = socket$inet6_sctp(0xa, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {'wfdno', 0x3d, r13}}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x22, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa85, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_val={0x18, 0x6, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xba7a}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @jmp={0x5, 0x1, 0x2, 0x3, 0x3, 0x7, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0xb, 0x8, 0x100, 0xfffffffffffffffc}, @cb_func={0x18, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='syzkaller\x00', 0xc, 0xe2, &(0x7f0000000780)=""/226, 0x41100, 0x10, '\x00', 0x0, @fallback=0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f00000008c0)={0x5, 0xe, 0x200, 0x80}, 0x10, r11, r12, 0x2, 0x0, &(0x7f0000000940)=[{0x2, 0x5, 0x10, 0x6}, {0x5, 0x4, 0x6, 0x8}], 0x10, 0x54af, @void, @value}, 0x94) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-mount$9p_fd-bpf$PROG_LOAD-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff, 0x0}, 0x8) r12 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r13 = socket$inet6_sctp(0xa, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {'wfdno', 0x3d, r13}}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x22, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa85, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_val={0x18, 0x6, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xba7a}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @jmp={0x5, 0x1, 0x2, 0x3, 0x3, 0x7, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0xb, 0x8, 0x100, 0xfffffffffffffffc}, @cb_func={0x18, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='syzkaller\x00', 0xc, 0xe2, &(0x7f0000000780)=""/226, 0x41100, 0x10, '\x00', 0x0, @fallback=0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f00000008c0)={0x5, 0xe, 0x200, 0x80}, 0x10, r11, r12, 0x2, 0x0, &(0x7f0000000940)=[{0x2, 0x5, 0x10, 0x6}, {0x5, 0x4, 0x6, 0x8}], 0x10, 0x54af, @void, @value}, 0x94) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-mount$9p_fd-bpf$PROG_LOAD detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff, 0x0}, 0x8) r12 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r13 = socket$inet6_sctp(0xa, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {'wfdno', 0x3d, r13}}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x22, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa85, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_val={0x18, 0x6, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0xba7a}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @jmp={0x5, 0x1, 0x2, 0x3, 0x3, 0x7, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0xb, 0x8, 0x100, 0xfffffffffffffffc}, @cb_func={0x18, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000740)='syzkaller\x00', 0xc, 0xe2, &(0x7f0000000780)=""/226, 0x41100, 0x10, '\x00', 0x0, @fallback=0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f00000008c0)={0x5, 0xe, 0x200, 0x80}, 0x10, r11, r12, 0x2, 0x0, &(0x7f0000000940)=[{0x2, 0x5, 0x10, 0x6}, {0x5, 0x4, 0x6, 0x8}], 0x10, 0x54af, @void, @value}, 0x94) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-mount$9p_fd-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff}, 0x8) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r8 = socket$inet6_sctp(0xa, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r8}}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-socket$inet6_sctp-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff}, 0x8) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') socket$inet6_sctp(0xa, 0x1, 0x84) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-syz_open_procfs-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff}, 0x8) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-bpf$BPF_BTF_GET_NEXT_ID-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000900)={0xff}, 0x8) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-openat$ipvs-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000880)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE_CONST_STR-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) r5 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r6}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0xff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4, 0x0, @void, @value, @void, @value}, 0x50) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-bpf$MAP_UPDATE_ELEM_TAIL_CALL-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r5}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)=r4}, 0x20) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-bpf$MAP_UPDATE_CONST_STR-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r4}}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{}, &(0x7f00000002c0), &(0x7f0000000340)='%ps \x00'}, 0x20) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6, 0x0, 0x0, {0x0, r4}}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-openat2$dir-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x440002, 0x1c3, 0x1}, 0x18) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs$pagemap-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-socket$can_bcm-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-ioctl$sock_inet_SIOCSARP-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @loopback}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'lo\x00'}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(0xffffffffffffffff, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udplite-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, 0x0, &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, &(0x7f00000003c0)="cd7c3e635020b2251e3eac0f919337c839bef5f60e1da8ba80cc3c4414e24bd81f6f85e7a8a8f18d8b669e4c971e3e29f9a66296fa38a2ae0421648cc79802fc80cc24ffaa9e7a9bd5d0fc6df656ec414e20bcd1c95b294a9b399063c24f5e61d71ffb4ed070d8f223969a4681dca1bafee4d4e29141196f9b2d466e99132218e217007588f9e4d62c6729c9994a5496502a210ffff421fbce3776c323a3a9f0e779d8f5d198c07600ce90fc217dfec49d6bcd057d10", 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, 0x0, 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, 0x0, 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000200), &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0xc, 0x0, 0x7c31, 0x3, 0x0, 0x6}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_wq_put_and_exit extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program did not crash reproducing took 3h0m42.792213732s repro crashed as (corrupted=false): INFO: task syz.5.21:6433 blocked for more than 143 seconds. Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.21 state:D stack:25280 pid:6433 tgid:6433 ppid:6354 task_flags:0x400148 flags:0x00020000 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x18bc/0x4c40 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 io_wq_exit_workers io_uring/io-wq.c:1249 [inline] io_wq_put_and_exit+0x344/0x720 io_uring/io-wq.c:1277 io_uring_clean_tctx+0x168/0x1e0 io_uring/tctx.c:205 io_uring_cancel_generic+0x751/0x800 io_uring/io_uring.c:3181 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x6a3/0x28e0 kernel/exit.c:894 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f829258cde9 RSP: 002b:00007ffc20c21fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f829258cde9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000420c2209f R09: 00007f8292776260 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8292776260 R14: 0000000000000003 R15: 00007ffc20c22060 Showing all locks held in the system: 3 locks held by kworker/u8:0/11: 3 locks held by kworker/1:0/25: #0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3317 #1: ffffc900001f7c60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc900001f7c60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3317 #2: ffff8880793b3240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x314/0x3f00 drivers/net/netdevsim/fib.c:1490 1 lock held by khungtaskd/30: #0: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746 3 locks held by kworker/u8:2/35: 3 locks held by kworker/u9:0/54: #0: ffff8880a5433948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff8880a5433948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3317 #1: ffffc90000be7c60 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc90000be7c60 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3317 #2: ffff88803ab78d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:331 3 locks held by kworker/u8:4/69: 2 locks held by kswapd0/85: 3 locks held by kworker/u8:5/145: 3 locks held by kworker/u8:8/3498: #0: ffff8880b873e7d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598 #1: ffff8880b8728948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x41d/0x7a0 kernel/sched/psi.c:987 #2: ffff8880b872a398 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x972/0x10e0 kernel/time/timer.c:1159 2 locks held by getty/5579: #0: ffff8880319cd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211 3 locks held by iou-wrk-6433/6445: 2 locks held by iou-wrk-6616/6627: 1 lock held by iou-wrk-6738/6747: 1 lock held by iou-wrk-6915/6928: 1 lock held by iou-wrk-7054/7066: 3 locks held by syz-executor/7124: #0: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:335 [inline] #0: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc55/0x1d30 net/core/rtnetlink.c:4021 #1: ffff88807f65d4e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x22d/0x420 drivers/net/wireguard/device.c:50 #2: ffffffff8eb3e438 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:302 [inline] #2: ffffffff8eb3e438 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x381/0x820 kernel/rcu/tree_exp.h:996 3 locks held by kworker/u8:10/7181: #0: ffff888030e79148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff888030e79148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3317 #1: ffffc900048ffc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc900048ffc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3317 #2: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline] #2: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x10e/0x16a0 net/ipv6/addrconf.c:4190 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline] watchdog+0x1058/0x10a0 kernel/hung_task.c:399 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: iou_exit io_ring_exit_work RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:130 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0x4c/0x290 mm/kasan/generic.c:189 Code: 00 00 48 89 fd 48 c1 ed 2f 81 fd fe ff 01 00 0f 86 43 02 00 00 48 89 fb 48 c1 eb 03 49 ba 00 00 00 00 00 fc ff df 4e 8d 1c 13 <49> ff c8 4d 89 c1 49 c1 e9 03 49 be 01 00 00 00 00 fc ff df 4f 8d RSP: 0018:ffffc90000ab75b0 EFLAGS: 00000802 RAX: 0000000000000001 RBX: 1ffffffff20777ae RCX: ffffffff81c9864c RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff903bbd70 RBP: 000000000001ffff R08: ffffffff903bbd78 R09: 1ffffffff3503032 R10: dffffc0000000000 R11: fffffbfff20777ae R12: dffffc0000000000 R13: 1ffff92000156ec0 R14: ffffc90000ab7620 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb63fec4ae0 CR3: 000000003305c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:570 [inline] cpu_online include/linux/cpumask.h:1116 [inline] trace_irq_enable+0x2c/0x120 include/trace/events/preemptirq.h:40 trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:73 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x8f/0x140 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:1108 [inline] debug_check_no_obj_freed+0x561/0x580 lib/debugobjects.c:1129 slab_free_hook mm/slub.c:2284 [inline] slab_free mm/slub.c:4609 [inline] kmem_cache_free+0x114/0x410 mm/slub.c:4711 io_destroy_buffers+0x44b/0x4c0 io_uring/kbuf.c:414 io_ring_ctx_free+0xfa/0x530 io_uring/io_uring.c:2711 io_ring_exit_work+0x813/0x8a0 io_uring/io_uring.c:2939 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 final repro crashed as (corrupted=false): INFO: task syz.5.21:6433 blocked for more than 143 seconds. Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.21 state:D stack:25280 pid:6433 tgid:6433 ppid:6354 task_flags:0x400148 flags:0x00020000 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x18bc/0x4c40 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 io_wq_exit_workers io_uring/io-wq.c:1249 [inline] io_wq_put_and_exit+0x344/0x720 io_uring/io-wq.c:1277 io_uring_clean_tctx+0x168/0x1e0 io_uring/tctx.c:205 io_uring_cancel_generic+0x751/0x800 io_uring/io_uring.c:3181 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x6a3/0x28e0 kernel/exit.c:894 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f829258cde9 RSP: 002b:00007ffc20c21fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f829258cde9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000420c2209f R09: 00007f8292776260 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8292776260 R14: 0000000000000003 R15: 00007ffc20c22060 Showing all locks held in the system: 3 locks held by kworker/u8:0/11: 3 locks held by kworker/1:0/25: #0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3317 #1: ffffc900001f7c60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc900001f7c60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3317 #2: ffff8880793b3240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x314/0x3f00 drivers/net/netdevsim/fib.c:1490 1 lock held by khungtaskd/30: #0: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8eb38f60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746 3 locks held by kworker/u8:2/35: 3 locks held by kworker/u9:0/54: #0: ffff8880a5433948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff8880a5433948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3317 #1: ffffc90000be7c60 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc90000be7c60 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3317 #2: ffff88803ab78d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:331 3 locks held by kworker/u8:4/69: 2 locks held by kswapd0/85: 3 locks held by kworker/u8:5/145: 3 locks held by kworker/u8:8/3498: #0: ffff8880b873e7d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598 #1: ffff8880b8728948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x41d/0x7a0 kernel/sched/psi.c:987 #2: ffff8880b872a398 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x972/0x10e0 kernel/time/timer.c:1159 2 locks held by getty/5579: #0: ffff8880319cd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211 3 locks held by iou-wrk-6433/6445: 2 locks held by iou-wrk-6616/6627: 1 lock held by iou-wrk-6738/6747: 1 lock held by iou-wrk-6915/6928: 1 lock held by iou-wrk-7054/7066: 3 locks held by syz-executor/7124: #0: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:335 [inline] #0: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc55/0x1d30 net/core/rtnetlink.c:4021 #1: ffff88807f65d4e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x22d/0x420 drivers/net/wireguard/device.c:50 #2: ffffffff8eb3e438 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:302 [inline] #2: ffffffff8eb3e438 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x381/0x820 kernel/rcu/tree_exp.h:996 3 locks held by kworker/u8:10/7181: #0: ffff888030e79148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff888030e79148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3317 #1: ffffc900048ffc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc900048ffc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3317 #2: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline] #2: ffffffff8fec2a08 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x10e/0x16a0 net/ipv6/addrconf.c:4190 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline] watchdog+0x1058/0x10a0 kernel/hung_task.c:399 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: iou_exit io_ring_exit_work RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:130 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0x4c/0x290 mm/kasan/generic.c:189 Code: 00 00 48 89 fd 48 c1 ed 2f 81 fd fe ff 01 00 0f 86 43 02 00 00 48 89 fb 48 c1 eb 03 49 ba 00 00 00 00 00 fc ff df 4e 8d 1c 13 <49> ff c8 4d 89 c1 49 c1 e9 03 49 be 01 00 00 00 00 fc ff df 4f 8d RSP: 0018:ffffc90000ab75b0 EFLAGS: 00000802 RAX: 0000000000000001 RBX: 1ffffffff20777ae RCX: ffffffff81c9864c RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff903bbd70 RBP: 000000000001ffff R08: ffffffff903bbd78 R09: 1ffffffff3503032 R10: dffffc0000000000 R11: fffffbfff20777ae R12: dffffc0000000000 R13: 1ffff92000156ec0 R14: ffffc90000ab7620 R15: 0000000000000246 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb63fec4ae0 CR3: 000000003305c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:570 [inline] cpu_online include/linux/cpumask.h:1116 [inline] trace_irq_enable+0x2c/0x120 include/trace/events/preemptirq.h:40 trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:73 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x8f/0x140 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:1108 [inline] debug_check_no_obj_freed+0x561/0x580 lib/debugobjects.c:1129 slab_free_hook mm/slub.c:2284 [inline] slab_free mm/slub.c:4609 [inline] kmem_cache_free+0x114/0x410 mm/slub.c:4711 io_destroy_buffers+0x44b/0x4c0 io_uring/kbuf.c:414 io_ring_ctx_free+0xfa/0x530 io_uring/io_uring.c:2711 io_ring_exit_work+0x813/0x8a0 io_uring/io_uring.c:2939 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244