Extracting prog: 1m30.371150275s
Minimizing prog: 10m35.286379689s
Simplifying prog options: 0s
Extracting C: 1m13.086267593s
Simplifying C: 6m44.362351114s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000001c0)={0x0, 0x18, 0x48, "ee4ef9677ff3f932698ca9fd6e8aeeb91a0cdae7d9b315686ca9f66ecf1125a43127d4727fa23be707ade93ac0eccf93c74e6661d16369977725a34b16c2bca0308986afa16192c0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in cancel_delayed_work_sync
validation run: crashed=true
reproducing took 23m0.246906606s
repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/workqueue.c:4561
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15, name: ksoftirqd/0
preempt_count: 100, expected: 0
RCU nest depth: 0, expected: 0
locks held by ksoftirqd/0/15: 1, last CPU#0:
 #0: ffff80008ec17a00 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745
Preemption disabled at:
[<ffff80008030a4d4>] softirq_handle_begin kernel/softirq.c:486 [inline]
[<ffff80008030a4d4>] handle_softirqs+0xe4/0xcbc kernel/softirq.c:621
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 __might_resched+0x354/0x4c0 kernel/sched/core.c:9264
 __might_sleep+0x84/0xdc kernel/sched/core.c:9193
 __cancel_work_sync+0x78/0x144 kernel/workqueue.c:4561
 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:4642
 mmc_free_host+0x20/0x48 drivers/mmc/core/host.c:700
 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379
 kref_put include/linux/kref.h:65 [inline]
 vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747
 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x530/0x744 kernel/time/timer.c:2386
 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395
 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 run_ksoftirqd+0x70/0xbc kernel/softirq.c:1099
 smpboot_thread_fn+0x4e4/0x97c kernel/smpboot.c:160
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
BUG: scheduling while atomic: ksoftirqd/0/15/0x00000101
locks held by ksoftirqd/0/15: 1, on CPU#0:
 #0: ffff80008ec17a00 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745
Modules linked in:
Preemption disabled at:
[<ffff80008030a4d4>] softirq_handle_begin kernel/softirq.c:486 [inline]
[<ffff80008030a4d4>] handle_softirqs+0xe4/0xcbc kernel/softirq.c:621
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 __schedule_bug+0x10c/0x190 kernel/sched/core.c:6092
 schedule_debug kernel/sched/core.c:6119 [inline]
 __schedule+0x1418/0x2b00 kernel/sched/core.c:7133
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0x13c/0x20c kernel/sched/core.c:7376
 schedule_timeout+0xc0/0x28c kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common+0x220/0x394 kernel/sched/completion.c:132
 wait_for_completion+0x18/0x24 kernel/sched/completion.c:153
 __synchronize_srcu+0x1cc/0x268 kernel/rcu/srcutree.c:1477
 synchronize_srcu+0x280/0x2e0 kernel/rcu/srcutree.c:-1
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69
 device_release+0xb4/0x1d4 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1dc/0x4b8 lib/kobject.c:737
 put_device+0x28/0x40 drivers/base/core.c:3884
 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:703
 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379
 kref_put include/linux/kref.h:65 [inline]
 vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747
 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x530/0x744 kernel/time/timer.c:2386
 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395
 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 run_ksoftirqd+0x70/0xbc kernel/softirq.c:1099
 smpboot_thread_fn+0x4e4/0x97c kernel/smpboot.c:160
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854

final repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/workqueue.c:4561
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15, name: ksoftirqd/0
preempt_count: 100, expected: 0
RCU nest depth: 0, expected: 0
locks held by ksoftirqd/0/15: 1, last CPU#0:
 #0: ffff80008ec17a00 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745
Preemption disabled at:
[<ffff80008030a4d4>] softirq_handle_begin kernel/softirq.c:486 [inline]
[<ffff80008030a4d4>] handle_softirqs+0xe4/0xcbc kernel/softirq.c:621
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 __might_resched+0x354/0x4c0 kernel/sched/core.c:9264
 __might_sleep+0x84/0xdc kernel/sched/core.c:9193
 __cancel_work_sync+0x78/0x144 kernel/workqueue.c:4561
 cancel_delayed_work_sync+0x24/0x38 kernel/workqueue.c:4642
 mmc_free_host+0x20/0x48 drivers/mmc/core/host.c:700
 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379
 kref_put include/linux/kref.h:65 [inline]
 vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747
 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x530/0x744 kernel/time/timer.c:2386
 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395
 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 run_ksoftirqd+0x70/0xbc kernel/softirq.c:1099
 smpboot_thread_fn+0x4e4/0x97c kernel/smpboot.c:160
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
BUG: scheduling while atomic: ksoftirqd/0/15/0x00000101
locks held by ksoftirqd/0/15: 1, on CPU#0:
 #0: ffff80008ec17a00 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xf0/0x7f4 kernel/time/timer.c:1745
Modules linked in:
Preemption disabled at:
[<ffff80008030a4d4>] softirq_handle_begin kernel/softirq.c:486 [inline]
[<ffff80008030a4d4>] handle_softirqs+0xe4/0xcbc kernel/softirq.c:621
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 __schedule_bug+0x10c/0x190 kernel/sched/core.c:6092
 schedule_debug kernel/sched/core.c:6119 [inline]
 __schedule+0x1418/0x2b00 kernel/sched/core.c:7133
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0x13c/0x20c kernel/sched/core.c:7376
 schedule_timeout+0xc0/0x28c kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common+0x220/0x394 kernel/sched/completion.c:132
 wait_for_completion+0x18/0x24 kernel/sched/completion.c:153
 __synchronize_srcu+0x1cc/0x268 kernel/rcu/srcutree.c:1477
 synchronize_srcu+0x280/0x2e0 kernel/rcu/srcutree.c:-1
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x110/0x32c drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x48/0x100 drivers/mmc/core/host.c:69
 device_release+0xb4/0x1d4 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1dc/0x4b8 lib/kobject.c:737
 put_device+0x28/0x40 drivers/base/core.c:3884
 mmc_free_host+0x38/0x48 drivers/mmc/core/host.c:703
 vub300_delete+0xd4/0xec drivers/mmc/host/vub300.c:379
 kref_put include/linux/kref.h:65 [inline]
 vub300_inactivity_timer_expired+0xd4/0x2ac drivers/mmc/host/vub300.c:747
 call_timer_fn+0x198/0x7f4 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x530/0x744 kernel/time/timer.c:2386
 run_timer_base+0x84/0x1b8 kernel/time/timer.c:2395
 run_timer_softirq+0x20/0x48 kernel/time/timer.c:2405
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 run_ksoftirqd+0x70/0xbc kernel/softirq.c:1099
 smpboot_thread_fn+0x4e4/0x97c kernel/smpboot.c:160
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854