Extracting prog: 2m46.000399925s
Minimizing prog: 2h44m35.174691038s
Simplifying prog options: 0s
Extracting C: 3m43.877712936s
Simplifying C: 1h0m32.306035696s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet-setsockopt$SO_RDS_TRANSPORT-setsockopt$sock_int-sendmsg$xdp-setsockopt$RDS_CONG_MONITOR-sendmsg$NL80211_CMD_JOIN_MESH-socket$unix
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)
setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f00006dbffc), 0x4)
sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x40088c5}, 0x0)
setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4)
sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40)
socket$unix(0x1, 0x2, 0x0)

program crashed: INFO: rcu detected stall in batadv_nc_worker
single: successfully extracted reproducer
found reproducer with 26 syscalls
minimizing guilty program
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet-setsockopt$SO_RDS_TRANSPORT-setsockopt$sock_int-sendmsg$xdp-setsockopt$RDS_CONG_MONITOR-sendmsg$NL80211_CMD_JOIN_MESH
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)
setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f00006dbffc), 0x4)
sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x40088c5}, 0x0)
setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4)
sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet-setsockopt$SO_RDS_TRANSPORT-setsockopt$sock_int-sendmsg$xdp-setsockopt$RDS_CONG_MONITOR
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)
setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f00006dbffc), 0x4)
sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x40088c5}, 0x0)
setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet-setsockopt$SO_RDS_TRANSPORT-setsockopt$sock_int-sendmsg$xdp
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)
setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f00006dbffc), 0x4)
sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840), 0x0, 0x0, 0x0, 0x40088c5}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet-setsockopt$SO_RDS_TRANSPORT-setsockopt$sock_int
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)
setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f00006dbffc), 0x4)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet-setsockopt$SO_RDS_TRANSPORT
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket-connect$inet
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime-socket
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socket(0x40000000015, 0x5, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-timer_settime
detailed listing:
executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r0 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r2 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
gettid()
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-socket-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
socket(0x2b, 0x80801, 0x1)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-prctl$PR_MCE_KILL-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-writev-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r3 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r4 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-syz_open_dev$sndmidi-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r2 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r2 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-ioctl$DRM_IOCTL_MODE_ADDFB2-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000000)={0x0, 0x40, 0x3f, 0x30315559, 0x1, [], [0x20000000, 0x0, 0x1000010, 0x20000], [0x0, 0x40002, 0xfffffffe], [0x0, 0x10000000000000]})
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r2 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-syz_open_dev$dri-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
syz_open_dev$dri(0x0, 0x1, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r1 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r2 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in security_file_open
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r1 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r2 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prctl$PR_SCHED_CORE-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r1 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r2 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r1 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r2 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
readv(r0, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in syscall_exit_to_user_mode
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, 0x0)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x5c, 0x160, 0x134, 0x3e0, 0x240, 0x228, 0x25a, 0x240, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0xffffff00], 'veth0_to_batadv\x00', 'wg1\x00', {}, {0x222cecdb0fb5a62a}, 0x3a}, 0x5002, 0xec, 0x134, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x24}, {0x0, "d176"}}, @common=@unspec=@state={{0x24}, {0xfffffffd}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}, {{@ipv6={@local, @private2={0xfc, 0x2, '\x00', 0x4}, [0x0, 0x0, 0xff000000], [0xff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x88}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x364)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
gettid()
timer_create(0x0, 0x0, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, 0x0)
readv(0xffffffffffffffff, &(0x7f0000000d00)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000540)}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/248, 0xf8}, {&(0x7f0000000880)=""/223, 0xdf}, {&(0x7f0000000c40)=""/58, 0x3a}, {&(0x7f0000000c80)=""/75, 0x4b}], 0x7)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program did not crash
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in syscall_exit_to_user_mode
testing program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, 0x0, 0x0)
timer_settime(0x0, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=5m13.731449894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
simplifying C reproducer
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in syscall_exit_to_user_mode
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in gc_worker
a never seen crash title: INFO: rcu detected stall in gc_worker, ignore
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in syscall_exit_to_user_mode
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program did not crash
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
program crashed: INFO: rcu detected stall in syscall_exit_to_user_mode
testing program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=5m13.731449894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_MCE_KILL-socket-setsockopt$IP6T_SO_SET_REPLACE-rseq-gettid-timer_create-readv-timer_settime
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
prctl$PR_MCE_KILL(0x4e, 0x1, 0x0)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0)
rseq(0x0, 0x0, 0x0, 0x0)
r1 = gettid()
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
readv(0xffffffffffffffff, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)

program crashed: INFO: rcu detected stall in batadv_nc_worker
validation run: crashed=true
reproducing took 4h6m34.439451655s
repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P4408/1:b..l
	(detected by 1, t=10503 jiffies, g=10745, q=181 ncpus=2)
task:kworker/u4:6    state:R  running task     stack:26512 pid:4408  ppid:2      flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 preempt_schedule_irq+0xbb/0x160 kernel/sched/core.c:6875
 irqentry_exit+0x63/0x70 kernel/entry/common.c:442
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:lock_acquire+0x225/0x4a0 kernel/locking/lockdep.c:5682
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3d 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 43 c7 44 3d 08 00 00 00 00 65 48 8b 04
RSP: 0018:ffffc90003407ac0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: a668810ef8e13500
RDX: 0000000000000000 RSI: ffffffff8a8c2a20 RDI: ffffffff8adf68a0
RBP: ffffc90003407bc8 R08: dffffc0000000000 R09: 1ffffffff2161e48
R10: dffffc0000000000 R11: fffffbfff2161e49 R12: 0000000000000001
R13: 1ffff92000680f64 R14: 0000000000000246 R15: dffffc0000000000
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock include/linux/rcupdate.h:791 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
 batadv_nc_worker+0xeb/0x600 net/batman-adv/network-coding.c:719
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: rcu_preempt kthread starved for 10528 jiffies! g10745 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26800 pid:16    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_timeout+0x184/0x2d0 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x303/0x1350 kernel/rcu/tree.c:1706
 rcu_gp_kthread+0x99/0x3b0 kernel/rcu/tree.c:1905
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4484 Comm: syz.1.28 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_region_inline mm/kasan/generic.c:-1 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:189
Code: ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc cc 00 00 cc cc b0 01 48 85 f6 0f 84 ac 01 00 00 55 41 57 41 56 41 54 <53> 49 89 f8 49 01 f0 0f 82 0e 02 00 00 49 89 f8 49 c1 e8 2f 41 81
RSP: 0018:ffffc90003637858 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 00000000000001a0 RCX: ffffffff81641445
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b0f270
RBP: ffffc90003637ab0 R08: dffffc0000000000 R09: 1ffffffff2161e4e
R10: dffffc0000000000 R11: fffffbfff2161e4f R12: ffff88802729e4d8
R13: ffff88802729da00 R14: 9b0f82d77b983520 R15: 9b0f82d77b983520
FS:  00005555620c3500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000bbdffc CR3: 00000000231ae000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 hlock_class kernel/locking/lockdep.c:228 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3742 [inline]
 validate_chain kernel/locking/lockdep.c:3798 [inline]
 __lock_acquire+0x1465/0x7c40 kernel/locking/lockdep.c:5063
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
 __might_fault+0xc2/0x120 mm/memory.c:5850
 _copy_to_user+0x27/0x130 lib/usercopy.c:36
 copy_to_user include/linux/uaccess.h:169 [inline]
 copy_siginfo_to_user+0x1f/0x140 kernel/signal.c:3352
 __setup_rt_frame arch/x86/kernel/signal.c:491 [inline]
 setup_rt_frame arch/x86/kernel/signal.c:784 [inline]
 handle_signal arch/x86/kernel/signal.c:828 [inline]
 arch_do_signal_or_restart+0xd86/0x1310 arch/x86/kernel/signal.c:873
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f475219e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc2845dc88 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007ffc2845dd70 RCX: 00007f475219e159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000001c21b R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2e420000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4752425fac R14: 00007f4752425fa8 R15: 00007f4752425fa0
 </TASK>
sched: RT throttling activated

final repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P4408/1:b..l
	(detected by 1, t=10503 jiffies, g=10745, q=181 ncpus=2)
task:kworker/u4:6    state:R  running task     stack:26512 pid:4408  ppid:2      flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 preempt_schedule_irq+0xbb/0x160 kernel/sched/core.c:6875
 irqentry_exit+0x63/0x70 kernel/entry/common.c:442
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:lock_acquire+0x225/0x4a0 kernel/locking/lockdep.c:5682
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3d 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 43 c7 44 3d 08 00 00 00 00 65 48 8b 04
RSP: 0018:ffffc90003407ac0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: a668810ef8e13500
RDX: 0000000000000000 RSI: ffffffff8a8c2a20 RDI: ffffffff8adf68a0
RBP: ffffc90003407bc8 R08: dffffc0000000000 R09: 1ffffffff2161e48
R10: dffffc0000000000 R11: fffffbfff2161e49 R12: 0000000000000001
R13: 1ffff92000680f64 R14: 0000000000000246 R15: dffffc0000000000
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock include/linux/rcupdate.h:791 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
 batadv_nc_worker+0xeb/0x600 net/batman-adv/network-coding.c:719
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: rcu_preempt kthread starved for 10528 jiffies! g10745 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26800 pid:16    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_timeout+0x184/0x2d0 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x303/0x1350 kernel/rcu/tree.c:1706
 rcu_gp_kthread+0x99/0x3b0 kernel/rcu/tree.c:1905
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4484 Comm: syz.1.28 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_region_inline mm/kasan/generic.c:-1 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:189
Code: ff ff ff c3 0f 0b b8 ea ff ff ff c3 00 00 cc cc 00 00 cc cc 00 00 cc cc b0 01 48 85 f6 0f 84 ac 01 00 00 55 41 57 41 56 41 54 <53> 49 89 f8 49 01 f0 0f 82 0e 02 00 00 49 89 f8 49 c1 e8 2f 41 81
RSP: 0018:ffffc90003637858 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 00000000000001a0 RCX: ffffffff81641445
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b0f270
RBP: ffffc90003637ab0 R08: dffffc0000000000 R09: 1ffffffff2161e4e
R10: dffffc0000000000 R11: fffffbfff2161e4f R12: ffff88802729e4d8
R13: ffff88802729da00 R14: 9b0f82d77b983520 R15: 9b0f82d77b983520
FS:  00005555620c3500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000bbdffc CR3: 00000000231ae000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 hlock_class kernel/locking/lockdep.c:228 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3742 [inline]
 validate_chain kernel/locking/lockdep.c:3798 [inline]
 __lock_acquire+0x1465/0x7c40 kernel/locking/lockdep.c:5063
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
 __might_fault+0xc2/0x120 mm/memory.c:5850
 _copy_to_user+0x27/0x130 lib/usercopy.c:36
 copy_to_user include/linux/uaccess.h:169 [inline]
 copy_siginfo_to_user+0x1f/0x140 kernel/signal.c:3352
 __setup_rt_frame arch/x86/kernel/signal.c:491 [inline]
 setup_rt_frame arch/x86/kernel/signal.c:784 [inline]
 handle_signal arch/x86/kernel/signal.c:828 [inline]
 arch_do_signal_or_restart+0xd86/0x1310 arch/x86/kernel/signal.c:873
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f475219e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc2845dc88 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007ffc2845dd70 RCX: 00007f475219e159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000001c21b R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2e420000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4752425fac R14: 00007f4752425fa8 R15: 00007f4752425fa0
 </TASK>
sched: RT throttling activated