Extracting prog: 29m2.465557585s Minimizing prog: 49m29.413148012s Simplifying prog options: 13m11.792763718s Extracting C: 3m10.355976315s Simplifying C: 0s extracting reproducer from 64 programs testing a last program of every proc single: executing 16 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$TOKEN_CREATE-socket$xdp-getsockopt-bpf$BPF_PROG_TEST_RUN-mmap-socket$nl_generic-ioctl$TUNSETIFF-close-syz_init_net_socket$bt_hci-close-syz_open_procfs$namespace-mmap-socket$netlink-socket$nl_netfilter-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_PEER_MEASUREMENT_START-socket$vsock_stream-setsockopt$SO_VM_SOCKETS_BUFFER_SIZE-sendmsg$NFT_BATCH-socket$nl_generic-socket$nl_netfilter-socket$netlink-writev-mmap-socket$inet_tcp-setsockopt$ARPT_SO_SET_REPLACE-mmap-mmap detailed listing: executing program 0: bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) r0 = socket$xdp(0x2c, 0x3, 0x0) getsockopt(r0, 0x7, 0x3, &(0x7f0000000480)=""/4096, &(0x7f0000001480)=0x1000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r2 = socket$netlink(0x10, 0x3, 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$nl80211(0x0, r1) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r2, 0x0, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r4, 0x28, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000100001f500000000000000000000000a20000000000a010100000000000000000a0000000900010073797a300000000048000000030a010200000000000000000a0004000900010073797a30000000000900030073797a3100000000080007006e617400140004800800014000000003080002400000000014000000020a69eff1640000000000000000000114000000110001"], 0xa4}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, 0x0, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x13, r5, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000640)={'filter\x00', 0x5, 0x4, 0x3f0, 0x110, 0x110, 0x110, 0x308, 0x308, 0x308, 0x4, 0x0, {[{{@arp={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0x0, 0x4, 0x4, {@mac=@remote, {[0xff, 0xff, 0x0, 0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0x0, 0x0, 0x0, 0xff, 0xff]}}, 0x3, 0x8, 0x7, 0x9, 0x6, 0x4, 'veth0_to_batadv\x00', 'ipvlan0\x00', {0xff}, {0xff}, 0x0, 0x2}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private, @empty, 0xa}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @private=0x1000, 0x0, 0xffffffff}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x1000009, 0x11, r6, 0xd371f000) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000007, 0x12, r5, 0x12574000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ptrace-ptrace$setregs detailed listing: executing program 0: ptrace(0x10, 0x0) ptrace$setregs(0xd, 0x0, 0xfffffffffffffffc, &(0x7f0000000000)="18607651149d7b10b4024fbbdc08899b8f589df2db8ebcd920a2b5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130fb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b250a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7d3ac46537e62fc631ac3daa446ec5fc35b5dd906a13671b3030ef156264c724b0876a43b8a27b610b1") program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-bind$netlink-socket$inet6-syz_mount_image$ext4-openat-pwrite64-setsockopt$inet6_IPV6_XFRM_POLICY-connect$inet6 detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x87) syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./file0\x00', 0x2000000, &(0x7f0000000480), 0x1, 0x3d0, &(0x7f00000004c0)="$eJzs3M1uG0UcAPD/br5I+mEjcUCFgyUQBAFxHQhQhEThyscFeAArSUuF21SNkWjJoSBOnDggbhz6Ahx4gKpCSEi8Ai+AKlUozQFuQWvvOm4cp7Fix2r6+0mjndkdZ/bv3axm1rsTwGOrEhHnI2IiIhYjopSvT/MUN9spq3d/c2N5a3NjOYnt7U/+SSLJ1xV/K8mXJ/LCfBqRfhfxzM3edtev3/ii3misXsvL1eblq9X16zdevXS5fnH14uqV2pvnarWlxbdqrw8t1p+ef+ncxPvnz/z8V+nO0vT0bLa/J/Nt3XEMSyUqne9kt6VhNzZm0+PeAQAADiTN+/6Trf5/KSZaubZSVDfGunMAAADAUGy/my8BAACAYywx9gcAAIBjrngO4P7mxnKRxvg4wpG7915ElHfebd7qxD8ZT+R1pkb4fmslIq6+kJSyFCN6DxkAoNudrP9zdq/+XxpPd9WbiWj1h2aH3H5lV7m3/5PeHXKTD8j6f+9ExFZP/y8tqpQn8tKpVldxKrlwqbF6NiJOR8R8TM1k5do+bXzw7y8f99uWxf97cup0kbL2s+VOjfTu5MyDn1mpN+uHibnbvW8izkzuFX/S6f8mETF3iDYmvr71dr9tD49/tLZvRby45/Hfmbkn2X9+omrrfKgWZ0Wv/7799aN+7Y87/uz4z+0ffznpnq9pffA2bn/+57P9tnWPfwY5/6eTT1v5Ylz2Vb3ZvFaLmE4+7F2/uPPZolzUz+Kff27v///i+pfkc1qdzK8Bg/r+h99eOUj8WcraL8aCRyGLf2Wg4z945o3bf3zWr/2Hx58d//YcYPP5moNc/w66g4f57gAAAOBRkbbuayTpQiefpgsL7fsdT8Vc2lhbb758Ye3LKyvt+x/lmEqLO12lrvuhtfbP6J3y4q7yaxHxZET8WJptlReW1xor4w4eAAAAHhMn+oz/M38f2VMIAAAAwMiVx70DAAAAwMgZ/wMAAMCxdph5/WRkZI5rZtxXJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEfb/wEAAP//Wt22ag==") r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8a141, 0x59) pwrite64(r2, &(0x7f0000000140)="f6", 0xffffff07, 0x8000c61) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0xfffffffffffffffd, 0x1, 0x1, 0x0, 0x0, 0xb}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x6, 0x80001, 0x1, 0x0, 0x1, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4d4, 0x32}, 0xa, @in=@local, 0x3502, 0x1, 0x0, 0x0, 0x6, 0xffbffffd}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt-syz_mount_image$ext4-creat-socket$nl_generic-syz_genetlink_get_family_id$ethtool-ioctl$ifreq_SIOCGIFINDEX_wireguard-sendmsg$ETHTOOL_MSG_LINKSTATE_GET-syz_ublk_setup_io_uring-syz_ublk_add_dev-openat$procfs-read$FUSE-openat$ptmx-ioctl$TCSETAF-write$binfmt_aout-ioctl$TCSETS-syz_open_pts-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-dup3-bpf$PROG_LOAD-mprotect-ioctl$TIOCSTI-socket$nl_xfrm-sendmsg$nl_xfrm-lseek-prlimit64-getpid-socketpair$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="b400000000000000", 0x8) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000340)={[{@noload}, {@stripe={'stripe', 0x3d, 0x30c}}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@jqfmt_vfsv1}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r2, &(0x7f0000002280)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000002280)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x24040085) syz_ublk_setup_io_uring(0x3b79, &(0x7f0000001140)={0x0, 0xfffffffd, 0x4000, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x32, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001480)=@new_dev={0x6, 0x6c2, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x109}}}, &(0x7f00000000c0)) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002340)='/proc/sysvipc/shm\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f0000000040)={0x2020}, 0x15dc871c) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r7, 0x5408, &(0x7f0000000140)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r7, &(0x7f0000000140)=ANY=[], 0xff2e) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r8 = syz_open_pts(r7, 0x200) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x6, 0xc, &(0x7f00000008c0)=ANY=[@ANYRESHEX=r1], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x0, 0xe, 0x36, &(0x7f0000000000)="5fd63edbfd8a4a6077fd87686f9a", 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x3}, 0x50) r10 = dup3(r8, r7, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$TIOCSTI(r10, 0x5412, &(0x7f0000000080)=0xa) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000002080)=ANY=[@ANYBLOB="f00000001000130727bd700004000000fe8000000000000000000000000000bbfe8000000000000000000000000000bb000000004e240000000000002f0000004d51e09903a958949f90036b512de5d060b7170abac646ecc7cc4ec79c8e449e9692d9de6bf58b74dd4845e7ef697bb3ad2fc332f6eba454c206e50897f1dfcf1a77004b25ccd06a91d84d3b9dd99a8ac690a4c6cd1a6ee406ba085f6d95c770dc3b3e80607fba5a5bbf7410e5b5b9ce70d8b8ef16c6388ce98b322a2727c1adcb6849381a87294f93f3ed318ec79106228f70b50012ff9ee1c87a71e4ff5772b48a049d4c6761dd880ff722952b085fcd576dd5d496e2a5cbe5b510e77ec2892bc39547e04d9042b4e979bd66331ff5a8e915352527d44b00e7ce", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e00000010000000000000000000000000000000133000000200100000000000000000000000000010000000000000000000000000000000001000000000000000300000000000000000000000000000002000000000000007e7208000000000000000000000000000000000000000000fbfffff7ffdfffff0600000000000000050000000000000001000000090000000800000000000080063500000a0004002100000000000000"], 0xf0}}, 0x0) lseek(r6, 0x1, 0x1) prlimit64(0x0, 0x8, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r12, 0x8946, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x48, 0x10, 0x41, 0x5}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE-add_key$keyring-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: INFO: task hung in corrupted single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE-add_key$keyring-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE-add_key$keyring-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE-add_key$keyring-ioctl$SNDCTL_TMR_STOP-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE-add_key$keyring-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: INFO: rcu detected stall in exit_to_user_mode_loop testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: INFO: task hung in corrupted testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 program crashed: INFO: rcu detected stall in sys_clone a never seen crash title: INFO: rcu detected stall in sys_clone, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: INFO: rcu detected stall in worker_thread validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: INFO: rcu detected stall in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program did not crash validation run: crashed=false testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE-ioctl$SNDCTL_TMR_STOP-ioctl$SNDCTL_TMR_CONTINUE-syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2 detailed listing: executing program 0: ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) program crashed: INFO: task hung in ath9k_hif_usb_firmware_cb validation run: crashed=true reproducing took 2h2m23.761742905s repro crashed as (corrupted=false): INFO: task kworker/1:7:6003 blocked for more than 155 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:7 state:D stack:23784 pid:6003 tgid:6003 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events request_firmware_work_func Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1102 [inline] ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline] ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 5 locks held by kworker/1:0/24: 3 locks held by kworker/1:1/29: 1 lock held by khungtaskd/32: #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 3 locks held by kworker/0:2/89: #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000254fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000254fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline] #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279 1 lock held by dhcpcd/5281: #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65e/0xdf0 net/ipv6/addrconf.c:5062 2 locks held by kworker/1:3/5352: 2 locks held by getty/5374: #0: ffff888035eef0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 3 locks held by kworker/u8:4/5746: #0: ffff88803250e940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88803250e940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900040dfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900040dfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4229 5 locks held by kworker/1:6/6000: 3 locks held by kworker/1:7/6003: #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000361fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000361fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline] #2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279 4 locks held by udevd/6133: #0: ffff88804e1cbab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807af72480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888044d702d8 (kn->active#33){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888044d702d8 (kn->active#33){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802b24c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1107 [inline] #3: ffff88802b24c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 2 locks held by kworker/1:8/6134: 6 locks held by kworker/1:9/6185: 3 locks held by kworker/u8:13/6606: #0: ffff88801b064140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b064140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900042afc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900042afc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 2 locks held by kworker/1:10/6988: 3 locks held by kworker/1:11/7015: 8 locks held by kworker/u8:14/7063: #0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90005377c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90005377c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff9001e788 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:673 #3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 net/devlink/core.c:557 #4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline] #4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 net/devlink/core.c:557 #5: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 drivers/net/netdevsim/netdev.c:1191 #6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2847 [inline] #6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x11d0/0x2150 net/core/dev.c:12433 #7: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #7: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961 2 locks held by syz-executor/7073: #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 1 lock held by syz-executor/7077: #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7081: #0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7084: #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7088: #0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7090: #0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: events psi_avgs_work RIP: 0010:__lock_acquire+0x271/0x2cf0 kernel/locking/lockdep.c:-1 Code: 13 6e 03 4c 8b 5c 24 18 44 8b 14 24 45 89 f9 48 8b 74 24 20 48 83 bc 24 20 01 00 00 00 0f 85 c8 fe ff ff 8b bc 24 38 01 00 00 <4c> 8b 84 24 28 01 00 00 4d 8d be a0 0b 00 00 83 fd 31 48 89 74 24 RSP: 0018:ffffc90000a08178 EFLAGS: 00000046 RAX: 00000000000000af RBX: 0000000000000000 RCX: ffffffff9415c510 RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000000 R13: 0000000000000002 R14: ffff88801ee81f00 R15: 0000000000000046 FS: 0000000000000000(0000) GS:ffff888125050000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd70a21ac0 CR3: 000000004ff60000 CR4: 0000000000350ef0 Call Trace: lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rcu_lock_acquire include/linux/rcupdate.h:300 [inline] rcu_read_lock include/linux/rcupdate.h:840 [inline] class_rcu_constructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] dummy_urb_enqueue+0x7c/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1277 usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1542 ath9k_hif_usb_rx_cb+0x11de/0x1590 drivers/net/wireless/ath/ath9k/hif_usb.c:721 __usb_hcd_giveback_urb+0x374/0x530 drivers/usb/core/hcd.c:1657 dummy_timer+0xac3/0x4b40 drivers/usb/gadget/udc/dummy_hcd.c:2005 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113 handle_softirqs+0x225/0x840 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:get_recent_times kernel/sched/psi.c:275 [inline] RIP: 0010:collect_percpu_times+0x277/0xc60 kernel/sched/psi.c:385 Code: 42 c7 44 30 08 00 00 00 00 ba 20 00 00 00 48 8d bc 24 00 01 00 00 31 f6 e8 a6 ac 93 00 48 8b 84 24 80 00 00 00 42 80 3c 30 00 <74> 08 4c 89 ff e8 bf a9 93 00 48 8b 44 24 08 83 e0 07 49 8b 1f 4c RSP: 0018:ffffc90000a67920 EFLAGS: 00000246 RAX: 1ffff1100ed91813 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000020 RSI: 0000000000000000 RDI: ffffc90000a67a40 RBP: ffffc90000a67aa8 R08: ffffc90000a67a3f R09: ffffc90000a67a20 R10: dffffc0000000000 R11: fffff5200014cf48 R12: 0000000000000000 R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888076c8c098 psi_avgs_work+0x63/0x170 kernel/sched/psi.c:592 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/1:7:6003 blocked for more than 155 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:7 state:D stack:23784 pid:6003 tgid:6003 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events request_firmware_work_func Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821 device_lock include/linux/device.h:1102 [inline] ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline] ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279 request_firmware_work_func+0xf7/0x2d0 drivers/base/firmware_loader/main.c:1164 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 5 locks held by kworker/1:0/24: 3 locks held by kworker/1:1/29: 1 lock held by khungtaskd/32: #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 3 locks held by kworker/0:2/89: #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000254fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000254fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline] #2: ffff88802a3da1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279 1 lock held by dhcpcd/5281: #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65e/0xdf0 net/ipv6/addrconf.c:5062 2 locks held by kworker/1:3/5352: 2 locks held by getty/5374: #0: ffff888035eef0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 3 locks held by kworker/u8:4/5746: #0: ffff88803250e940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88803250e940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900040dfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900040dfc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4229 5 locks held by kworker/1:6/6000: 3 locks held by kworker/1:7/6003: #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000361fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000361fc40 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_fail drivers/net/wireless/ath/ath9k/hif_usb.c:1151 [inline] #2: ffff88802a24a1d8 (&dev->mutex){....}-{4:4}, at: ath9k_hif_usb_firmware_cb+0x32f/0x4b0 drivers/net/wireless/ath/ath9k/hif_usb.c:1279 4 locks held by udevd/6133: #0: ffff88804e1cbab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 #1: ffff88807af72480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165 #2: ffff888044d702d8 (kn->active#33){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff888044d702d8 (kn->active#33){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166 #3: ffff88802b24c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1107 [inline] #3: ffff88802b24c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 2 locks held by kworker/1:8/6134: 6 locks held by kworker/1:9/6185: 3 locks held by kworker/u8:13/6606: #0: ffff88801b064140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801b064140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc900042afc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc900042afc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 2 locks held by kworker/1:10/6988: 3 locks held by kworker/1:11/7015: 8 locks held by kworker/u8:14/7063: #0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90005377c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90005377c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff9001e788 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:673 #3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline] #3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff88807a106128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 net/devlink/core.c:557 #4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline] #4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff88807a100258 (&devlink->lock_key#11){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 net/devlink/core.c:557 #5: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 drivers/net/netdevsim/netdev.c:1191 #6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2847 [inline] #6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #6: ffff88807bf70e70 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x11d0/0x2150 net/core/dev.c:12433 #7: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #7: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961 2 locks held by syz-executor/7073: #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 1 lock held by syz-executor/7077: #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7081: #0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff90599970 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7084: #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057c9d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7088: #0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057da38 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 2 locks held by syz-executor/7090: #0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff9057c700 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff9002d340 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: events psi_avgs_work RIP: 0010:__lock_acquire+0x271/0x2cf0 kernel/locking/lockdep.c:-1 Code: 13 6e 03 4c 8b 5c 24 18 44 8b 14 24 45 89 f9 48 8b 74 24 20 48 83 bc 24 20 01 00 00 00 0f 85 c8 fe ff ff 8b bc 24 38 01 00 00 <4c> 8b 84 24 28 01 00 00 4d 8d be a0 0b 00 00 83 fd 31 48 89 74 24 RSP: 0018:ffffc90000a08178 EFLAGS: 00000046 RAX: 00000000000000af RBX: 0000000000000000 RCX: ffffffff9415c510 RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000000 R13: 0000000000000002 R14: ffff88801ee81f00 R15: 0000000000000046 FS: 0000000000000000(0000) GS:ffff888125050000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd70a21ac0 CR3: 000000004ff60000 CR4: 0000000000350ef0 Call Trace: lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rcu_lock_acquire include/linux/rcupdate.h:300 [inline] rcu_read_lock include/linux/rcupdate.h:840 [inline] class_rcu_constructor include/linux/rcupdate.h:1183 [inline] unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] dummy_urb_enqueue+0x7c/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1277 usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1542 ath9k_hif_usb_rx_cb+0x11de/0x1590 drivers/net/wireless/ath/ath9k/hif_usb.c:721 __usb_hcd_giveback_urb+0x374/0x530 drivers/usb/core/hcd.c:1657 dummy_timer+0xac3/0x4b40 drivers/usb/gadget/udc/dummy_hcd.c:2005 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113 handle_softirqs+0x225/0x840 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:get_recent_times kernel/sched/psi.c:275 [inline] RIP: 0010:collect_percpu_times+0x277/0xc60 kernel/sched/psi.c:385 Code: 42 c7 44 30 08 00 00 00 00 ba 20 00 00 00 48 8d bc 24 00 01 00 00 31 f6 e8 a6 ac 93 00 48 8b 84 24 80 00 00 00 42 80 3c 30 00 <74> 08 4c 89 ff e8 bf a9 93 00 48 8b 44 24 08 83 e0 07 49 8b 1f 4c RSP: 0018:ffffc90000a67920 EFLAGS: 00000246 RAX: 1ffff1100ed91813 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000020 RSI: 0000000000000000 RDI: ffffc90000a67a40 RBP: ffffc90000a67aa8 R08: ffffc90000a67a3f R09: ffffc90000a67a20 R10: dffffc0000000000 R11: fffff5200014cf48 R12: 0000000000000000 R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888076c8c098 psi_avgs_work+0x63/0x170 kernel/sched/psi.c:592 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245