Extracting prog: 34m11.874987743s Minimizing prog: 1h20m38.324569234s Simplifying prog options: 0s Extracting C: 3m6.56270657s Simplifying C: 54m41.360558562s extracting reproducer from 69 programs testing a last program of every proc single: executing 20 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-bpf$PROG_LOAD-write$UHID_INPUT-unshare-msgget$private-msgsnd-msgrcv-syz_create_resource$binfmt-openat$binfmt-write$binfmt_script-close-execveat$binfmt detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc000, &(0x7f00000006c0), 0x2, 0x246, &(0x7f0000000ac0)="$eJzs3T9oM2UcB/DvXRJf+75BXnURxD8gIloor5vg8rooFKQUEUGFioiL0gq1xa1xcnHQWaWTSxE3q6N0KS6K4FS1Q10ELQ4WBx0iybVS24ja1Jz0Ph+43l3vee73HLnvkyyXBGisq0muJ2klmU7SSVIcb3B3tVw93F2f2l5I+v0nfiqG7ar9ylG/K0l6SR5KslUWeamdrG4+s/fLzmP3vbnSuff9zaenJnqRh/b3dh8/eG/ujY9mH1z94qsf5opcT/dP13X+ihH/axfJLf9Fsf+Jol33CPgn5l/78OtB7m9Ncs8w/52UqV68t5Zv2OrkgXf/qu/bP355+yTHCpy/fr8zeA/s9YHGKZN0U5QzSartspyZqT7Df9O6XL68tPzq9ItLK4sv1D1TAeelm+w++smlj6+cyP/3rSr/wMU1yP+T8xvfDrYPWnWPBpiIO6rVIP/Tz63dH/mHxpF/aC75h+aSf2gu+Yfmkn9oLvmHC6xztNEbeVj+obnkH5pL/qG5jucfAGiW/qW6n0AG6lL3/AMAAAAAAAAAAAAAAAAAAJy2PrW9cLRMquZn7yT7jyRpj6rfGv4ecXLj8O/ln4tBsz8UVbexPHvXmCcY0wc1P31903f11v/8znrrry0mvdeTXGu3T99/xeH9d3Y3/83xzvNjFviXihP7Dz812fon/bZRb/3ZneTTwfxzbdT8U+a24Xr0/NM9/hXLZ/TKr2OeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIn5PQAA//8PK23M") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) unshare(0x2c020400) r3 = msgget$private(0x0, 0x0) msgsnd(r3, &(0x7f0000000180)=ANY=[@ANYRESOCT], 0x2000, 0x0) msgrcv(r3, 0x0, 0x0, 0x2, 0x3000) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) write$binfmt_script(r5, &(0x7f0000000080)={'#! ', './file1'}, 0xb) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-bpf$PROG_LOAD-write$UHID_INPUT-unshare-msgget$private-msgsnd-msgrcv-syz_create_resource$binfmt-openat$binfmt-write$binfmt_script-close-execveat$binfmt-openat$cgroup_ro detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc000, &(0x7f00000006c0), 0x2, 0x246, &(0x7f0000000ac0)="$eJzs3T9oM2UcB/DvXRJf+75BXnURxD8gIloor5vg8rooFKQUEUGFioiL0gq1xa1xcnHQWaWTSxE3q6N0KS6K4FS1Q10ELQ4WBx0iybVS24ja1Jz0Ph+43l3vee73HLnvkyyXBGisq0muJ2klmU7SSVIcb3B3tVw93F2f2l5I+v0nfiqG7ar9ylG/K0l6SR5KslUWeamdrG4+s/fLzmP3vbnSuff9zaenJnqRh/b3dh8/eG/ujY9mH1z94qsf5opcT/dP13X+ihH/axfJLf9Fsf+Jol33CPgn5l/78OtB7m9Ncs8w/52UqV68t5Zv2OrkgXf/qu/bP355+yTHCpy/fr8zeA/s9YHGKZN0U5QzSartspyZqT7Df9O6XL68tPzq9ItLK4sv1D1TAeelm+w++smlj6+cyP/3rSr/wMU1yP+T8xvfDrYPWnWPBpiIO6rVIP/Tz63dH/mHxpF/aC75h+aSf2gu+Yfmkn9oLvmHC6xztNEbeVj+obnkH5pL/qG5jucfAGiW/qW6n0AG6lL3/AMAAAAAAAAAAAAAAAAAAJy2PrW9cLRMquZn7yT7jyRpj6rfGv4ecXLj8O/ln4tBsz8UVbexPHvXmCcY0wc1P31903f11v/8znrrry0mvdeTXGu3T99/xeH9d3Y3/83xzvNjFviXihP7Dz812fon/bZRb/3ZneTTwfxzbdT8U+a24Xr0/NM9/hXLZ/TKr2OeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIn5PQAA//8PK23M") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) unshare(0x2c020400) r3 = msgget$private(0x0, 0x0) msgsnd(r3, &(0x7f0000000180)=ANY=[@ANYRESOCT], 0x2000, 0x0) msgrcv(r3, 0x0, 0x0, 0x2, 0x3000) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) write$binfmt_script(r5, &(0x7f0000000080)={'#! ', './file1'}, 0xb) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.parent_freezing\x00', 0x275a, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-bpf$PROG_LOAD-write$UHID_INPUT-unshare-msgget$private-msgsnd-msgrcv-syz_create_resource$binfmt-openat$binfmt-write$binfmt_script-close-execveat$binfmt-openat$cgroup_ro detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc000, &(0x7f00000006c0), 0x2, 0x246, &(0x7f0000000ac0)="$eJzs3T9oM2UcB/DvXRJf+75BXnURxD8gIloor5vg8rooFKQUEUGFioiL0gq1xa1xcnHQWaWTSxE3q6N0KS6K4FS1Q10ELQ4WBx0iybVS24ja1Jz0Ph+43l3vee73HLnvkyyXBGisq0muJ2klmU7SSVIcb3B3tVw93F2f2l5I+v0nfiqG7ar9ylG/K0l6SR5KslUWeamdrG4+s/fLzmP3vbnSuff9zaenJnqRh/b3dh8/eG/ujY9mH1z94qsf5opcT/dP13X+ihH/axfJLf9Fsf+Jol33CPgn5l/78OtB7m9Ncs8w/52UqV68t5Zv2OrkgXf/qu/bP355+yTHCpy/fr8zeA/s9YHGKZN0U5QzSartspyZqT7Df9O6XL68tPzq9ItLK4sv1D1TAeelm+w++smlj6+cyP/3rSr/wMU1yP+T8xvfDrYPWnWPBpiIO6rVIP/Tz63dH/mHxpF/aC75h+aSf2gu+Yfmkn9oLvmHC6xztNEbeVj+obnkH5pL/qG5jucfAGiW/qW6n0AG6lL3/AMAAAAAAAAAAAAAAAAAAJy2PrW9cLRMquZn7yT7jyRpj6rfGv4ecXLj8O/ln4tBsz8UVbexPHvXmCcY0wc1P31903f11v/8znrrry0mvdeTXGu3T99/xeH9d3Y3/83xzvNjFviXihP7Dz812fon/bZRb/3ZneTTwfxzbdT8U+a24Xr0/NM9/hXLZ/TKr2OeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIn5PQAA//8PK23M") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) unshare(0x2c020400) r3 = msgget$private(0x0, 0x0) msgsnd(r3, &(0x7f0000000180)=ANY=[@ANYRESOCT], 0x2000, 0x0) msgrcv(r3, 0x0, 0x0, 0x2, 0x3000) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) write$binfmt_script(r5, &(0x7f0000000080)={'#! ', './file1'}, 0xb) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='freezer.parent_freezing\x00', 0x275a, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$nl_route-sendmsg$nl_route-write$tun detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) write$tun(r0, &(0x7f00000038c0)={@void, @val={0x0, 0x83, 0x8, 0xe057, 0x19, 0x9}, @ipv4=@dccp={{0x5, 0x4, 0x2, 0x7, 0xfe6, 0x66, 0x0, 0x4, 0x21, 0x0, @remote, @remote}, {{0x4e21, 0x4e24, 0x4, 0x1, 0x0, 0x0, 0x0, 0x2, 0x1, "18ab71", 0x2, "76fdca"}, "0c013f39ca6b858e3546ef112852a53badb6dfdb21343ebd2db09a6d0c82d0cfed10aa7d3b88d62a0c7b3efbee4e7b0831a681ad9fd6b83130962e15d7fe787059805a3eb3e50df2a86bb91f54b9f54b9625c2d8277575613a9f6b365ff01ba6032229e42c70a7ee9e211799bbcb636e8c3e12e1fba20fb3ee447b08ff0c5444df9f707697e7ec77aa1ea4eadc0d5f0692cb010c959100dde3ffd1583e6e774215c4b26992cb912f296484548fd2eb95feaa9b806d190b54682570739e16bbf58307191b91a287dcff5cc4e983ef7bb8b4aa6050c0258308fc2a660623ce2168bf7626c53a7a923a8bc37aea9984a277fec2bcaff5a205390554984c1afd93e2759b0f4209b31bd62db6ee7d85c40029a42d5d4b4a7340f864674767a70e1fbdcc476089518fa12bec27c99528fef14e9ce9b07cbc16dd9b7839f20f81dfc9cd9c11a4cdfbe975b9511fd48fe640ac348d765ddda897555e766734baacaf8eb8de0a82b147d53d18161bd702ad87df218b88df70aad063a876219ad06c576b7431b74be367a0f79ca6c6a4528f733613f72ddcd47a1338131540e994786884447ddb807100060079cd656d358f8d446a4e63c080cbffc1959b2e239e6fc505b4553b5fa8ba07372f9bc6ec9177c5c0bb6688b01324265a7e97673bd640e7590b35dbe71d05c45392e0f48871270fbfb1e36efc3028a457dd034e6ff5ce825c3d5a24e7ca28fe07e0c526e11c305ba73ba433f769e5f47542e1708959d00e5d2318b115c1306c6aa1f678227f54e2aadf5323acd91c8917850a9d25a7b8bbac9bfd9b3837bf68a572f8ca3e88fb95f7753f86f000f18a984a992e95d25a6c43b836ccb028492d268ba466795c0d52ea3c6fbde6a4e585936bc8b088e4857e57cd3235051bf980fb6f24b51c891ee85f9c1ab265ebb91fd22832d4db7b5008e49093526b8fba8805e07ecf5f3d4e6eb41b6a3fb4a8e676683b19389bcd26aa34478d7748edf173ed5fb7b3c7df6ad23492f2681c5b4ac9bb257316cfec9dcb0aa05bd6fe48fa119e049c3b5218e49fedecd637e87caf06a23691b14cc6e09f52d57695d88ffcb9d3804187a2ffc7ba185be7f5a555e433537006359a8033ec512a43bd4f890b6dd0749fa6590c484cc711cd7802d6e6b37566cc5c7e464d754b6a5679e9e653afc3a2488487be2b5b32aa5eb94b2ed9c5a2aac6911658868f786c114fc8fab40c60c50087ab1a965b95e8e59418fb9b8a268af2ebce206b2c0fb683d047383386b080929145b0e277ccf3b6e2b2c231d61c73a916c59e68e8b6fbaebf8060d42fd824470764c2bcfc3d7106f130142610e77c48b3890beddc279226edf1fb7d248e7e56f03b485505ccbfcf6de8f3be541c648152833437d646654a3d4b83fb416561eb17695e5fd3df02ce37ab795b3324b34585d0ca8068e46bc857a9e883b0806f9bffe7dc542409a1393716a48fbe4f6faf652511c5cd6e6d96479d5f5d1b63ee36f2c71246f3a7b7b2f3d174b066eb68dcda7c99f4a158fdedb596089a3946555b54cea6560d272ed953aa128bab8cc6f1b879564188988ccf4683732de1a567d1a8ae46b32dcb1da008b8adef2a4f423589e07c29f37eae9afb554867052c1c03156b2303160c62da30a963c14a0bba1db739fe6b8e12ca8eee19712bd749153de89fc034605ef5829fbf72eb6d797152ddd9be2e00b4733eb71979424c9b8be3c110975dd718964f0c91d681118f572edfd4c1c6acd2fef5d588e274b9c4401a9ddba21d96726117af2805a3ce699836c693b966446373543ac765026014a382a5c31f3835844faa7cff905fecec99a737cc0d87886c9718822407177c1e0723774590e4f96061d5b2a2e8281840d60405df64dd5194028eb13bcc854e6b88a42ef36139e28d2e34d531460e3c70d707a71aae46a9e39dc4b1e2a7cb5e2cce4e93b8411059e38082749b67a78052ab9d6c29e13304570edbf092c41bc09eeee88f9629c8f0054c279cd13cfcdc6cf878815bb8994e8162dcc316fc1385ed543ea47665599e397084da1df236cd8110a654402550accc6f454a99747f4c337af9fdf8701ac3e89a0856b2b50468d78e77b1e27bc36d8d9c669644c45d319121e9748fb73893a088e1a898bab8902c6e56df3c438bd39220209810fd357bf2b1a09a8850b6a3b66a65854eed75e9dc5c560cb0b1fb5fc7aa3c9c787db4ed6a438ae380211253483c040176e25c33e19f59a6ac7c662b5eaa9f21369e298e7a2bee6d643f38bd53623a392a96ffaa02b00e74f873c91e4d5685ddbeb5f68eac0cd6ee846ed3504a1dd4da5671651bcedb3373a57d0e7fc679c720d4f9830a6e889e647e70d5dabc0a02ac64422a06297ac965298acb20edf201bda46c764231c74c4628b2c6c07d5ab586d5a1a79f4bde0cb8fab7edf22b08b6084d4ad4dc3553b9559bf4521bca6d78fdf8899ece8e6904da792164987182955d9f1abb3084daa3e2d5e591cfcf68cc0ffa060e69ecaed92272fb464b5d2f77fa19c39102a56a56f6a070a3e9c914c0e00afb6bafed448e7a59b6506b17f4227ffe913a1175c01e66a30e8814f517b6ce72f98e444599225fa447cde4523d128ce3ea9b2173fc3d3449c913d98d7659c826d96d9327b0f28227cb839c31a89c019f2cf7134d8555d29331a94e6df8d2856d1da2e3285443a3fb0bf73fe7639ff9e26dee8323f15378048a776ee19c2c6a08fd12c3e1738e7dc95cc169dd4bbb3d78e991968fcda9bcc6626d594f21c83304b3a9e61a396f67f56e5ba95e410c982ea100d36d9a72c5f90b10d172ad7d5270f5cb2687d2bfe236cef8aa29a55d0ac213493cbc77f89b03421269e5981f669a9bf62728fd5cff9b6e341232ac2ce30c0d8bfcbd2b524f88cc9a7fbbe10994ed509113124cbe971bf01c70580e5f595489479e29e64286eb737a39051f4bd43403f9129fec7200e2677c16b15baefb92cf2b1f662e0db216ddda6d6d33e5ab479c7ac88fcadb7978d49da6faae0e69c55b555f44c84a7bd2dd6e3907962debef1515d470a49106838f9170f8aa944b02220b0c26b237c3c40d5e3f7ceb6415dc3ea1d0237d98fff56ab6d51980bd6309318b8cefcfe1f2bc021915cb1784e6d4789393469d42a2309080baafd5ff87e9fa4255f2f127f3d6c8bea5c6331b620a93bdceafa10e1842088bd74b3ace514bf3ff39af26373e530ba9b5b42b51c14ded1a72b785dc2226ce63ff5ce656c3d210de28ef754485b1612fb16de8320285b4add7dacae34d0675bec58872ea56dfc12cc667cba15a8b6d0be6ded10c57e2f257d5072ec1bba84f0cecbc9b7deaefef347eed43cf47e674374b7e7e6ba801a13818ce3f517fad5c28389ce42dff6fd89e2032e6c07ce91cbe66baba8e1965310a42a4d343a4322349862e2a152c7c2a268b948e0a35150ba48787af780645906750a54911dc0b91f2b17d8f784800775f15cc60b1e2c90843434b7348e43d76c5b33de15109be409f4abe68192413cc8be1189b6fd6d3d9deeeb2825a6da58bde6aa9369422fecd08a608662dfdd0f817e0bf031a12a3b9776c7378a4d64e5db6e0ad3da4019a147586007069caabdf83a93f6142a3859328b321241a5a777bf7f8615fdc39f40d0b8ef27a8061a385881a714d8fdd591646307305c45a4caae8b49927aed8288418358c3bdbce6b2c2f144d00c9c5febab8f285db021885e5175d7b49426bb51a866af7ab6177b68d9ef643208fd94b47dbe41aa5781b5000ecb16cf17edc6c068c17741a13e3a2accf3429e65a2e18ac5d4fa679ff4930753cc577068fed9d912256e335ab0bd671b0ce7eb2fb27b9e6ff5fe4633abfe57a40efe0a8d92ab666ae3df15add0e4092d60a7c885d24e72c7aa7e0eb53083929a0fb85aaa2f365644ad79846ce5c8fb097041de1f959305d0d84916d7c093c71c93a5e58020f7c598f90ec31dbad08daeaa5b08f306004b32a409e85573e423f72c94682037234054dd78821ac0355b9d1e9ea8852b201b3b2d2c10ddd8af4615337bc7f65d1e5e4ee926a4156104d4be497dbd06501e4d13acc60ddfd29bc859ee79a2922ef9462ba14d8dc9fd528640e06d2bfcef4cde4cbf4522aade62b636478c0276e954f0a0d635604fc58dd7dc6537c0e4b094a77ed6be88172f6d6fa82d662eba2027e249919ea2364ee3964f42909474d7561d5dda1d44edeadad0f897e0ed032a984e21e9c431263aa98849b72d6a024c24675cd69f78073423f4bd57addc02c8f4730b3a8d1f618cf325fb4348a90e0b7ff0aecd186114d13edf7013d4e2ebe05eb230e8b1409b67c819c86969a0f3acc18c09ddb0335161823cd8e27870198eea1a3fee8a8b7a96a0ace218b65b658d74c13f4ff59e38e518f34237b1f7fab51800959bb38ef0bad830c42133bd691088b5c50620a0f17a56e032c92d57fd2ff1659583a3dcaa8a9083f2ede49dccda782bc15dc39f3371751205d6f66aff8c302d872be6ed38c506cb47ed6c64f04c7ac963b80691b5f4802c5315f7a2ae7748e62ad79a7c44fdd22060fcfd62cb0a1bd37161ef5ec3cead350c16f734bb20390e83fd54c36c6943a4b05cc9f9da97ef05fc63942bc2db3aa84350764547d90c9d38c42840b6416ef0e7fff6138ef443ca47f5922d04048456e252c3b1a7d7d482160cf07311c24849dc580f0495678ebea82f3ee4fc99bf7c18b663e743af132c7fd8f35e04357abfad70bafe4267f1b1b4bdfd4fcbfe293aacaa63608a9be3c96ea8c46273f1e022739415d19d8dcaf8d8eea29b4f8471e4d46a06b3de50e621bed3d94e5bc1f7f59a9dc2106e0d6b3409af7bf9408eae97b0975604c4f02adcf939efde5f78dd0220947f8b961f976b5aa34cc4b5e80b2bfec3a562b21e9ab9a28a6c2c02bac94e65d0c30df2bcb46c82f0e57a5ed0b62c1eea9f9f91b4403774ceffa95c2654ee257932e42407fe85cdc9100f91df2f79fc4c6f40d32f888fec31c3e3f140a3071d7b216b05ec708b63e74c3f6013a1071e5e2ea033a6d69d5be6a7d86bf79ad39982e73898fde5226c3351de5dfca340d1cd45022f2db5a0987c60552f9612092346207633680660031f510a92383a28174b5cbdc746db0cfc31cd5edcbf14247df543616bfa9c82868719d943b2d15036487701b1ec3ffbd18a2f4df317ae4a5e3e1b0a60afecefff6f072aafee0ed0e8031deb9f58179b12942af69ff12b80a076f2bb9239b15a1cfed818b3786c1f49d29c7a40ae203cf70e224d7f9e28df4d32710e734ac46fcfc32b5d9659ab0c179338b02df42259f036cd8ff4ef64b91a03786c7a09e01185385e331ac1385ab52bd43270542585b1a4b658c4a8aa676768a15f8d5df8ec37e2c389d8817d062d151dcfd24ec29b62fe53812d324412041bc0e9ba4f8a47ff4b357b97193c96ea90b7a268c20c691fb0f6ce37a19153adabb71f9a0e33a2043ca833305a4e5569a98b684f4ff53f242b50074bf12922180d5edba20b0122f28e6ed1536116067731b6eb49408ca29f76fa3bab8bfcbdb8354d0c69309ae82b007f2bd7b283c6f0b2255ea973dc5cc8f2cd1b601a9dac51930160439119cc590fe3e6e4c92bd83b13d77d5775f32002e1614c1aa39adfa35fa439f81ba6f91ba9a971d1f172fd4943f65f6f697c8333a901772f9e5"}}}, 0xff0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in synchronize_rcu single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-openat-mount$9p_fd detailed listing: executing program 0: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0184800, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x0, 0x0}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r0, 0xc0184800, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, 0x0, &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in synchronize_rcu testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in p9_fd_close a never seen crash title: INFO: task hung in p9_fd_close, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in addrconf_dad_work a never seen crash title: INFO: task hung in addrconf_dad_work, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: BUG: workqueue lockup a never seen crash title: BUG: workqueue lockup, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd program crashed: INFO: task hung in p9_fd_close a never seen crash title: INFO: task hung in p9_fd_close, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in synchronize_rcu validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in linkwatch_event validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-openat$dma_heap-ioctl$DMA_HEAP_IOCTL_ALLOC-openat-mount$9p_fd detailed listing: executing program 0: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x40081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000480), 0x2004888, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) program crashed: INFO: task hung in synchronize_rcu validation run: crashed=true reproducing took 3h2m12.39768559s repro crashed as (corrupted=false): INFO: task kworker/u4:0:9 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:0 state:D stack:25232 pid: 9 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930 fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:1:144 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:1 state:D stack:24304 pid: 144 ppid: 2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 synchronize_rcu_expedited+0x5c1/0x750 kernel/rcu/tree_exp.h:861 tipc_sk_rht_destroy+0x3c/0x70 net/tipc/socket.c:3065 tipc_exit_net+0x5d/0x130 net/tipc/core.c:117 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x706/0xba0 net/core/net_namespace.c:635 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:4:1236 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:4 state:D stack:24976 pid: 1236 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz-executor:4325 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21808 pid: 4325 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] __sys_sendto+0x46d/0x620 net/socket.c:2072 __do_sys_sendto net/socket.c:2084 [inline] __se_sys_sendto net/socket.c:2080 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2080 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7ff7bfe0868e RSP: 002b:00007ffcdd4278f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555593703500 RCX: 00007ff7bfe0868e RDX: 0000000000000040 RSI: 00007ff7c0bef670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffcdd427974 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007ff7c0bef670 R15: 0000000000000000 INFO: task syz-executor:4332 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22000 pid: 4332 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] __sys_sendto+0x46d/0x620 net/socket.c:2072 __do_sys_sendto net/socket.c:2084 [inline] __se_sys_sendto net/socket.c:2080 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2080 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f840e29e68e RSP: 002b:00007ffe01aba148 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055558effa500 RCX: 00007f840e29e68e RDX: 0000000000000020 RSI: 00007f840f085670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe01aba1c4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f840f085670 R15: 0000000000000000 INFO: task kworker/0:14:4340 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:14 state:D stack:25272 pid: 4340 ppid: 2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 addrconf_dad_work+0xca/0x1540 net/ipv6/addrconf.c:4110 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:6:4374 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:6 state:D stack:26320 pid: 4374 ppid: 2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 dev_deactivate_many+0x605/0xc10 net/sched/sch_generic.c:1313 dev_deactivate+0x114/0x1b0 net/sched/sch_generic.c:1339 linkwatch_do_dev+0x105/0x160 net/core/link_watch.c:165 __linkwatch_run_queue+0x4b1/0x7c0 net/core/link_watch.c:213 linkwatch_event+0x48/0x50 net/core/link_watch.c:252 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xd60/0x1290 kernel/workqueue.c:2459 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz.0.17:4383 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:26224 pid: 4383 ppid: 4315 flags:0x00004204 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __flush_work+0x15a/0x210 kernel/workqueue.c:3094 p9_mux_poll_stop net/9p/trans_fd.c:179 [inline] p9_conn_destroy net/9p/trans_fd.c:910 [inline] p9_fd_close+0x23c/0x420 net/9p/trans_fd.c:946 p9_client_create+0xa22/0x1010 net/9p/client.c:1082 v9fs_session_init+0x1f0/0x1830 fs/9p/v9fs.c:409 v9fs_mount+0x72/0x850 fs/9p/vfs_super.c:126 legacy_get_tree+0xe6/0x180 fs/fs_context.c:611 vfs_get_tree+0x88/0x270 fs/super.c:1530 do_new_mount+0x24a/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f6f446f0e59 RSP: 002b:00007fff753da588 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f6f44969fa0 RCX: 00007f6f446f0e59 RDX: 0000200000000480 RSI: 0000200000000040 RDI: 0000000000000000 RBP: 00007f6f44786d6f R08: 0000200000000140 R09: 0000000000000000 R10: 0000000002004888 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6f44969fac R14: 00007f6f44969fa0 R15: 00007f6f44969fa0 Showing all locks held in the system: 2 locks held by kworker/u4:0/9: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc90000ce7d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 1 lock held by khungtaskd/27: #0: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 4 locks held by kworker/u4:1/144: #0: ffff888016dcd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc9000113fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 #2: ffffffff8d431cd0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589 #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 2 locks held by kworker/u4:4/1236: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc900057d7d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 2 locks held by getty/3946: #0: ffff88802d27b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5df/0x1a70 drivers/tty/n_tty.c:2158 1 lock held by syz-executor/4325: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4332: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 3 locks held by kworker/0:14/4340: #0: ffff88802b8d2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc90002f6fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 #2: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xca/0x1540 net/ipv6/addrconf.c:4110 2 locks held by kworker/1:8/4368: 4 locks held by kworker/u4:6/4374: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc90003c2fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 #2: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251 #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 1 lock held by dhcpcd/4392: #0: ffff888023a04120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888023a04120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4393: #0: ffff8880205b8120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff8880205b8120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4394: #0: ffff888079814120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888079814120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4395: #0: ffff88805b404120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88805b404120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4396: #0: ffff88807270c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88807270c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4397: #0: ffff88802457e120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88802457e120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by syz-executor/4401: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4402: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4403: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4414: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4417: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4423: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4426: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4427: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4435: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4437: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4445: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4446: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4453: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe0f/0xe50 kernel/hung_task.c:369 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 1272 Comm: kworker/u4:5 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: bat_events batadv_nc_worker RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:331 [inline] RIP: 0010:rcu_is_watching+0x36/0xa0 kernel/rcu/tree.c:1123 Code: e8 1f 08 58 08 89 c3 83 f8 08 73 5c 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 20 38 e3 8b 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 20 73 59 00 48 c7 c3 08 b3 03 00 49 03 1e 48 89 RSP: 0018:ffffc900055f7bc0 EFLAGS: 00000246 RAX: 1ffffffff17c6705 RBX: 0000000000000001 RCX: f84a93d9a71a5a00 RDX: 0000000000000000 RSI: ffffffff8a7a06e0 RDI: ffffffff8a7a06a0 RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff203ac18 R10: dffffc0000000000 R11: fffffbfff203ac19 R12: 000000000000011e R13: fffffffffffffe38 R14: ffffffff8be33828 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdc25dcb080 CR3: 0000000073f15000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_unlock include/linux/rcupdate.h:769 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline] batadv_nc_worker+0x1dc/0x5c0 net/batman-adv/network-coding.c:723 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 final repro crashed as (corrupted=false): INFO: task kworker/u4:0:9 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:0 state:D stack:25232 pid: 9 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930 fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:1:144 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:1 state:D stack:24304 pid: 144 ppid: 2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 synchronize_rcu_expedited+0x5c1/0x750 kernel/rcu/tree_exp.h:861 tipc_sk_rht_destroy+0x3c/0x70 net/tipc/socket.c:3065 tipc_exit_net+0x5d/0x130 net/tipc/core.c:117 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x706/0xba0 net/core/net_namespace.c:635 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:4:1236 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:4 state:D stack:24976 pid: 1236 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz-executor:4325 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21808 pid: 4325 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] __sys_sendto+0x46d/0x620 net/socket.c:2072 __do_sys_sendto net/socket.c:2084 [inline] __se_sys_sendto net/socket.c:2080 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2080 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7ff7bfe0868e RSP: 002b:00007ffcdd4278f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555593703500 RCX: 00007ff7bfe0868e RDX: 0000000000000040 RSI: 00007ff7c0bef670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffcdd427974 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007ff7c0bef670 R15: 0000000000000000 INFO: task syz-executor:4332 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22000 pid: 4332 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] __sys_sendto+0x46d/0x620 net/socket.c:2072 __do_sys_sendto net/socket.c:2084 [inline] __se_sys_sendto net/socket.c:2080 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2080 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f840e29e68e RSP: 002b:00007ffe01aba148 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055558effa500 RCX: 00007f840e29e68e RDX: 0000000000000020 RSI: 00007f840f085670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe01aba1c4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f840f085670 R15: 0000000000000000 INFO: task kworker/0:14:4340 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:14 state:D stack:25272 pid: 4340 ppid: 2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 addrconf_dad_work+0xca/0x1540 net/ipv6/addrconf.c:4110 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:6:4374 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:6 state:D stack:26320 pid: 4374 ppid: 2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 dev_deactivate_many+0x605/0xc10 net/sched/sch_generic.c:1313 dev_deactivate+0x114/0x1b0 net/sched/sch_generic.c:1339 linkwatch_do_dev+0x105/0x160 net/core/link_watch.c:165 __linkwatch_run_queue+0x4b1/0x7c0 net/core/link_watch.c:213 linkwatch_event+0x48/0x50 net/core/link_watch.c:252 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xd60/0x1290 kernel/workqueue.c:2459 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz.0.17:4383 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:26224 pid: 4383 ppid: 4315 flags:0x00004204 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __flush_work+0x15a/0x210 kernel/workqueue.c:3094 p9_mux_poll_stop net/9p/trans_fd.c:179 [inline] p9_conn_destroy net/9p/trans_fd.c:910 [inline] p9_fd_close+0x23c/0x420 net/9p/trans_fd.c:946 p9_client_create+0xa22/0x1010 net/9p/client.c:1082 v9fs_session_init+0x1f0/0x1830 fs/9p/v9fs.c:409 v9fs_mount+0x72/0x850 fs/9p/vfs_super.c:126 legacy_get_tree+0xe6/0x180 fs/fs_context.c:611 vfs_get_tree+0x88/0x270 fs/super.c:1530 do_new_mount+0x24a/0xa40 fs/namespace.c:3034 do_mount fs/namespace.c:3377 [inline] __do_sys_mount fs/namespace.c:3585 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3562 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f6f446f0e59 RSP: 002b:00007fff753da588 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f6f44969fa0 RCX: 00007f6f446f0e59 RDX: 0000200000000480 RSI: 0000200000000040 RDI: 0000000000000000 RBP: 00007f6f44786d6f R08: 0000200000000140 R09: 0000000000000000 R10: 0000000002004888 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6f44969fac R14: 00007f6f44969fa0 R15: 00007f6f44969fa0 Showing all locks held in the system: 2 locks held by kworker/u4:0/9: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc90000ce7d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 1 lock held by khungtaskd/27: #0: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 4 locks held by kworker/u4:1/144: #0: ffff888016dcd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc9000113fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 #2: ffffffff8d431cd0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589 #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 2 locks held by kworker/u4:4/1236: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc900057d7d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 2 locks held by getty/3946: #0: ffff88802d27b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5df/0x1a70 drivers/tty/n_tty.c:2158 1 lock held by syz-executor/4325: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4332: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 3 locks held by kworker/0:14/4340: #0: ffff88802b8d2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc90002f6fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 #2: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xca/0x1540 net/ipv6/addrconf.c:4110 2 locks held by kworker/1:8/4368: 4 locks held by kworker/u4:6/4374: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1 #1: ffffc90003c2fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285 #2: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251 #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #3: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 1 lock held by dhcpcd/4392: #0: ffff888023a04120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888023a04120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4393: #0: ffff8880205b8120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff8880205b8120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4394: #0: ffff888079814120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888079814120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4395: #0: ffff88805b404120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88805b404120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4396: #0: ffff88807270c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88807270c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by dhcpcd/4397: #0: ffff88802457e120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88802457e120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213 1 lock held by syz-executor/4401: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4402: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4403: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4414: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4417: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4423: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4426: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4427: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4435: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4437: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4445: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4446: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 1 lock held by syz-executor/4453: #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe0f/0xe50 kernel/hung_task.c:369 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 1272 Comm: kworker/u4:5 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: bat_events batadv_nc_worker RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:331 [inline] RIP: 0010:rcu_is_watching+0x36/0xa0 kernel/rcu/tree.c:1123 Code: e8 1f 08 58 08 89 c3 83 f8 08 73 5c 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 20 38 e3 8b 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 20 73 59 00 48 c7 c3 08 b3 03 00 49 03 1e 48 89 RSP: 0018:ffffc900055f7bc0 EFLAGS: 00000246 RAX: 1ffffffff17c6705 RBX: 0000000000000001 RCX: f84a93d9a71a5a00 RDX: 0000000000000000 RSI: ffffffff8a7a06e0 RDI: ffffffff8a7a06a0 RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff203ac18 R10: dffffc0000000000 R11: fffffbfff203ac19 R12: 000000000000011e R13: fffffffffffffe38 R14: ffffffff8be33828 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdc25dcb080 CR3: 0000000073f15000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_unlock include/linux/rcupdate.h:769 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline] batadv_nc_worker+0x1dc/0x5c0 net/batman-adv/network-coding.c:723 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457 kthread+0x436/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287