Extracting prog: 5m41.058096755s
Minimizing prog: 1h36m15.071800806s
Simplifying prog options: 16m33.563455406s
Extracting C: 5m11.567742192s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp-fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-write$cgroup_subtree
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x0)
r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)
write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5)

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
single: successfully extracted reproducer
found reproducer with 11 syscalls
minimizing guilty program
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp-fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x0)
r3 = openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5)

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp-fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x0)
openat$cgroup_subtree(r2, &(0x7f0000000100), 0x2, 0x0)

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp-fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0)
fsmount(r1, 0x0, 0x0)

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp-fsopen-fsconfig$FSCONFIG_SET_BINARY
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0)

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp-fsopen
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])
fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(0xffffffffffffffff, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, 0x0, 0x0)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(0x0, &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), 0x0, &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', 0x0, 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, 0x0)

program did not crash
testing program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB])

program did not crash
extracting C reproducer
testing compiled C program (duration=6m22.215462808s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m22.215462808s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
extracting C reproducer
testing compiled C program (duration=6m22.215462808s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m22.215462808s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program did not crash
testing program (duration=6m22.215462808s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
testing program (duration=6m22.215462808s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
testing program (duration=6m22.215462808s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet_tcp-bind$inet-listen-mount$9p_tcp
detailed listing:
executing program 0:
syz_usb_connect(0x4, 0x0, 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
listen(r0, 0x2400003)
mount$9p_tcp(&(0x7f0000000000), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000404e22'])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
reproducing took 2h17m50.767181057s
repro crashed as (corrupted=false):
Bluetooth: hci69: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci69: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci68: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci68: unexpected cc 0x0c38 length: 249 > 2
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 4872 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: hci69 hci_rx_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3855 [inline]
 validate_chain kernel/locking/lockdep.c:3876 [inline]
 __lock_acquire+0xfdc/0x2ebc kernel/locking/lockdep.c:5237
 lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868
 do_write_seqcount_begin_nested include/linux/seqlock.h:478 [inline]
 do_write_seqcount_begin include/linux/seqlock.h:504 [inline]
 psi_write_begin+0x1b4/0x320 kernel/sched/psi.c:183
 psi_task_change+0x88/0x1d0 kernel/sched/psi.c:919
 psi_enqueue kernel/sched/stats.h:166 [inline]
 enqueue_task+0x24c/0x2f0 kernel/sched/core.c:2167
 activate_task kernel/sched/core.c:2205 [inline]
 ttwu_do_activate+0x188/0x44c kernel/sched/core.c:3725
 ttwu_queue kernel/sched/core.c:3978 [inline]
 try_to_wake_up+0x46c/0xc84 kernel/sched/core.c:4302
 wake_up_process+0x18/0x24 kernel/sched/core.c:4434
 kick_pool+0x3d8/0x584 kernel/workqueue.c:1313
 __queue_work+0xdbc/0x13c4 kernel/workqueue.c:2394
 queue_work_on+0xc0/0x130 kernel/workqueue.c:2444
 queue_work include/linux/workqueue.h:698 [inline]
 hci_cmd_sync_submit+0x1f8/0x224 net/bluetooth/hci_sync.c:727
 hci_cmd_sync_queue net/bluetooth/hci_sync.c:748 [inline]
 hci_cmd_sync_queue_once+0xa8/0xc0 net/bluetooth/hci_sync.c:785
 hci_update_passive_scan+0x138/0x194 net/bluetooth/hci_sync.c:3281
 le_conn_complete_evt+0xaf0/0x10f8 net/bluetooth/hci_event.c:5880
 hci_le_conn_complete_evt+0x114/0x3d8 net/bluetooth/hci_event.c:5891
 hci_le_meta_evt+0x2b0/0x46c net/bluetooth/hci_event.c:7529
 hci_event_func net/bluetooth/hci_event.c:7793 [inline]
 hci_event_packet+0x4c0/0x9c8 net/bluetooth/hci_event.c:7847
 hci_rx_work+0x2f4/0xd78 net/bluetooth/hci_core.c:4040
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3397
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3478
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Bluetooth: hci67: command tx timeout
Bluetooth: hci69: command tx timeout
Bluetooth: hci69: command tx timeout
Bluetooth: hci68: command tx timeout
Bluetooth: hci34: command 0x0406 tx timeout
Bluetooth: hci70: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci70: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci70: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci70: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci70: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci71: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci71: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci71: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci71: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci71: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci70: command tx timeout
Bluetooth: hci72: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci72: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci72: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci72: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci72: unexpected cc 0x0c38 length: 249 > 2

final repro crashed as (corrupted=false):
Bluetooth: hci69: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci69: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci68: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci68: unexpected cc 0x0c38 length: 249 > 2
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 4872 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: hci69 hci_rx_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3855 [inline]
 validate_chain kernel/locking/lockdep.c:3876 [inline]
 __lock_acquire+0xfdc/0x2ebc kernel/locking/lockdep.c:5237
 lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868
 do_write_seqcount_begin_nested include/linux/seqlock.h:478 [inline]
 do_write_seqcount_begin include/linux/seqlock.h:504 [inline]
 psi_write_begin+0x1b4/0x320 kernel/sched/psi.c:183
 psi_task_change+0x88/0x1d0 kernel/sched/psi.c:919
 psi_enqueue kernel/sched/stats.h:166 [inline]
 enqueue_task+0x24c/0x2f0 kernel/sched/core.c:2167
 activate_task kernel/sched/core.c:2205 [inline]
 ttwu_do_activate+0x188/0x44c kernel/sched/core.c:3725
 ttwu_queue kernel/sched/core.c:3978 [inline]
 try_to_wake_up+0x46c/0xc84 kernel/sched/core.c:4302
 wake_up_process+0x18/0x24 kernel/sched/core.c:4434
 kick_pool+0x3d8/0x584 kernel/workqueue.c:1313
 __queue_work+0xdbc/0x13c4 kernel/workqueue.c:2394
 queue_work_on+0xc0/0x130 kernel/workqueue.c:2444
 queue_work include/linux/workqueue.h:698 [inline]
 hci_cmd_sync_submit+0x1f8/0x224 net/bluetooth/hci_sync.c:727
 hci_cmd_sync_queue net/bluetooth/hci_sync.c:748 [inline]
 hci_cmd_sync_queue_once+0xa8/0xc0 net/bluetooth/hci_sync.c:785
 hci_update_passive_scan+0x138/0x194 net/bluetooth/hci_sync.c:3281
 le_conn_complete_evt+0xaf0/0x10f8 net/bluetooth/hci_event.c:5880
 hci_le_conn_complete_evt+0x114/0x3d8 net/bluetooth/hci_event.c:5891
 hci_le_meta_evt+0x2b0/0x46c net/bluetooth/hci_event.c:7529
 hci_event_func net/bluetooth/hci_event.c:7793 [inline]
 hci_event_packet+0x4c0/0x9c8 net/bluetooth/hci_event.c:7847
 hci_rx_work+0x2f4/0xd78 net/bluetooth/hci_core.c:4040
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3397
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3478
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Bluetooth: hci67: command tx timeout
Bluetooth: hci69: command tx timeout
Bluetooth: hci69: command tx timeout
Bluetooth: hci68: command tx timeout
Bluetooth: hci34: command 0x0406 tx timeout
Bluetooth: hci70: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci70: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci70: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci70: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci70: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci71: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci71: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci71: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci71: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci71: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci70: command tx timeout
Bluetooth: hci72: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci72: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci72: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci72: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci72: unexpected cc 0x0c38 length: 249 > 2