Extracting prog: 1m49.727241477s
Minimizing prog: 19m20.766805493s
Simplifying prog options: 0s
Extracting C: 48.807794487s
Simplifying C: 7m32.007730778s


extracting reproducer from 44 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000160001000300000000000000ac141414000000000000000000000000fc000000000000000000000000000001fffe000000000000000000a000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000000000000002a0000000033000000ffffffff0000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a000002000000000000000000000000070000000c0015"], 0x104}}, 0x0)

program crashed: BUG: soft lockup in sys_sendmsg
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm
detailed listing:
executing program 0:
socket$nl_xfrm(0x10, 0x3, 0x6)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm
detailed listing:
executing program 0:
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000160001000300000000000000ac141414000000000000000000000000fc000000000000000000000000000001fffe000000000000000000a000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000000000000002a0000000033000000ffffffff0000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a000002000000000000000000000000070000000c0015"], 0x104}}, 0x0)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={0x0, 0x104}}, 0x0)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[], 0x104}}, 0x0)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000160001000300000000000000ac141414000000000000000000000000fc000000000000000000000000000001fffe000000000000000000a000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x104}}, 0x0)

program did not crash
testing program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000000000000002a0000000033000000ffffffff0000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a000002000000000000000000000000070000000c0015"], 0x104}}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m39.638297952s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
simplifying C reproducer
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing compiled C program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
program crashed: BUG: soft lockup in sys_sendmsg
testing program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000160001000300000000000000ac141414000000000000000000000000fc000000000000000000000000000001fffe000000000000000000a000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000000000000002a0000000033000000ffffffff0000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a000002000000000000000000000000070000000c0015"], 0x104}}, 0x0)

program crashed: BUG: soft lockup in sys_sendmsg
validation run: crashed=true
testing program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000160001000300000000000000ac141414000000000000000000000000fc000000000000000000000000000001fffe000000000000000000a000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000000000000002a0000000033000000ffffffff0000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a000002000000000000000000000000070000000c0015"], 0x104}}, 0x0)

program crashed: BUG: soft lockup in sys_sendmsg
validation run: crashed=true
testing program (duration=1m39.638297952s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000160001000300000000000000ac141414000000000000000000000000fc000000000000000000000000000001fffe000000000000000000a000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000000000000002a0000000033000000ffffffff0000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a000002000000000000000000000000070000000c0015"], 0x104}}, 0x0)

program crashed: BUG: soft lockup in sys_sendmsg
validation run: crashed=true
reproducing took 33m32.279339252s
repro crashed as (corrupted=false):
watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz.0.24:4506]
Modules linked in:
irq event stamp: 6573
hardirqs last  enabled at (6572): [<ffff800011b9f848>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (6572): [<ffff800011b9f848>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (6573): [<ffff800011b9d900>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (6573): [<ffff800011b9d900>] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:486
softirqs last  enabled at (1460): [<ffff8000108d0df8>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (1460): [<ffff8000108d0df8>] xfrm_find_acq+0x98/0xc0 net/xfrm/xfrm_state.c:1909
softirqs last disabled at (1462): [<ffff8000108d18b0>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (1462): [<ffff8000108d18b0>] xfrm_alloc_spi+0xac/0xb10 net/xfrm/xfrm_state.c:2117
CPU: 1 PID: 4506 Comm: syz.0.24 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __sanitizer_cov_trace_pc+0x8c/0x90 kernel/kcov.c:230
lr : xfrm_state_lookup_spi_proto net/xfrm/xfrm_state.c:1314 [inline]
lr : xfrm_alloc_spi+0x4ac/0xb10 net/xfrm/xfrm_state.c:2132
sp : ffff8000220971a0
x29: ffff800022097280 x28: 0000000000000033 x27: 0000000003000000
x26: ffff0000dd834400 x25: 0000000000000004 x24: ffff0000dd834000
x23: dfff800000000000 x22: ffff700004412e44 x21: ffff800018db3000
x20: 0000000000000003 x19: ffff0000dd834028 x18: 0000000000000000
x17: 00000000ffff0000 x16: ffff800011ba16d0 x15: 0000000000000000
x14: 1ffff00002c7c073 x13: dfff800000000000 x12: 00000000cc1889a7
x11: ff008000108d1cb0 x10: 0000000000000000 x9 : ffff8000108d1cb0
x8 : ffff0000e0aad400 x7 : ffff8000108d8ac0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000003000000 x0 : 0000000001000000
Call trace:
 __sanitizer_cov_trace_pc+0x8c/0x90 kernel/kcov.c:230
 xfrm_alloc_userspi+0x498/0x914 net/xfrm/xfrm_user.c:1606
 xfrm_user_rcv_msg+0x500/0x7b8 net/xfrm/xfrm_user.c:3119
 netlink_rcv_skb+0x220/0x3ec net/netlink/af_netlink.c:2516
 xfrm_netlink_rcv+0x80/0x9c net/xfrm/xfrm_user.c:3141
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5fc/0x80c net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f0/0x9d8 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x588/0x90c net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x288/0x374 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589

final repro crashed as (corrupted=false):
watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz.0.24:4506]
Modules linked in:
irq event stamp: 6573
hardirqs last  enabled at (6572): [<ffff800011b9f848>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (6572): [<ffff800011b9f848>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (6573): [<ffff800011b9d900>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (6573): [<ffff800011b9d900>] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:486
softirqs last  enabled at (1460): [<ffff8000108d0df8>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (1460): [<ffff8000108d0df8>] xfrm_find_acq+0x98/0xc0 net/xfrm/xfrm_state.c:1909
softirqs last disabled at (1462): [<ffff8000108d18b0>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (1462): [<ffff8000108d18b0>] xfrm_alloc_spi+0xac/0xb10 net/xfrm/xfrm_state.c:2117
CPU: 1 PID: 4506 Comm: syz.0.24 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __sanitizer_cov_trace_pc+0x8c/0x90 kernel/kcov.c:230
lr : xfrm_state_lookup_spi_proto net/xfrm/xfrm_state.c:1314 [inline]
lr : xfrm_alloc_spi+0x4ac/0xb10 net/xfrm/xfrm_state.c:2132
sp : ffff8000220971a0
x29: ffff800022097280 x28: 0000000000000033 x27: 0000000003000000
x26: ffff0000dd834400 x25: 0000000000000004 x24: ffff0000dd834000
x23: dfff800000000000 x22: ffff700004412e44 x21: ffff800018db3000
x20: 0000000000000003 x19: ffff0000dd834028 x18: 0000000000000000
x17: 00000000ffff0000 x16: ffff800011ba16d0 x15: 0000000000000000
x14: 1ffff00002c7c073 x13: dfff800000000000 x12: 00000000cc1889a7
x11: ff008000108d1cb0 x10: 0000000000000000 x9 : ffff8000108d1cb0
x8 : ffff0000e0aad400 x7 : ffff8000108d8ac0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000003000000 x0 : 0000000001000000
Call trace:
 __sanitizer_cov_trace_pc+0x8c/0x90 kernel/kcov.c:230
 xfrm_alloc_userspi+0x498/0x914 net/xfrm/xfrm_user.c:1606
 xfrm_user_rcv_msg+0x500/0x7b8 net/xfrm/xfrm_user.c:3119
 netlink_rcv_skb+0x220/0x3ec net/netlink/af_netlink.c:2516
 xfrm_netlink_rcv+0x80/0x9c net/xfrm/xfrm_user.c:3141
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5fc/0x80c net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6f0/0x9d8 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x588/0x90c net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x288/0x374 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589