Extracting prog: 7m22.687691587s
Minimizing prog: 1h38m51.592413493s
Simplifying prog options: 15m40.191166721s
Extracting C: 5m9.065060066s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r2=>0xffffffffffffffff}, 0x0)
r3 = dup(r1)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB])

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r2=>0xffffffffffffffff}, 0x0)
r3 = dup(r1)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB])

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r2=>0xffffffffffffffff}, 0x0)
r3 = dup(r1)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
single: successfully extracted reproducer
found reproducer with 8 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900), 0x0)
dup(r1)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r2=>0xffffffffffffffff}, 0x0)
r3 = dup(r1)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-pipe2$9p-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000))
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-syz_mount_image$fuse-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
r2 = dup(r1)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-socketpair$unix-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
pipe2$9p(&(0x7f0000001900)={<r2=>0xffffffffffffffff}, 0x0)
r3 = dup(r1)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-setsockopt$SO_TIMESTAMPING-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(0xffffffffffffffff)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socket$unix(0x1, 0x1, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r0=>0xffffffffffffffff}, 0x0)
r1 = dup(0xffffffffffffffff)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, 0x0, 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(0x0, 0x0)
r1 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900), 0x0)
dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900), 0x0)
dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB, @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_mount_image$fuse-pipe2$9p-dup-syz_usb_connect$uac3-mount$9p_fd
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
syz_mount_image$fuse(0x0, &(0x7f0000002300)='./file0\x00', 0x5008a, 0x0, 0x5, 0x0, 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff}, 0x0)
r2 = dup(r0)
syz_usb_connect$uac3(0x0, 0x80, 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB])

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
reproducing took 2h19m22.36920411s
repro crashed as (corrupted=false):
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 4828 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: hci25 hci_cmd_sync_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3899 [inline]
 validate_chain kernel/locking/lockdep.c:3920 [inline]
 __lock_acquire+0xed4/0x2b08 kernel/locking/lockdep.c:5288
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 down_read+0x58/0x2bc kernel/locking/rwsem.c:1574
 kernfs_remove_by_name_ns+0x3c/0xd0 fs/kernfs/dir.c:1791
 kernfs_remove_by_name include/linux/kernfs.h:644 [inline]
 sysfs_unmerge_group+0xd0/0x12c fs/sysfs/group.c:408
 dpm_sysfs_remove+0x68/0xc8 drivers/base/power/sysfs.c:830
 device_del+0x15c/0x71c drivers/base/core.c:3940
 device_unregister+0x2c/0xf0 drivers/base/core.c:4006
 hci_conn_del_sysfs+0xf0/0x194 net/bluetooth/hci_sysfs.c:92
 hci_conn_cleanup net/bluetooth/hci_conn.c:170 [inline]
 hci_conn_del+0x9d8/0xf44 net/bluetooth/hci_conn.c:1339
 hci_conn_failed+0x254/0x37c net/bluetooth/hci_conn.c:1443
 hci_abort_conn_sync+0x5a4/0x938 net/bluetooth/hci_sync.c:6035
 abort_conn_sync+0x58/0x8c net/bluetooth/hci_conn.c:3215
 hci_cmd_sync_work+0x1e8/0x380 net/bluetooth/hci_sync.c:338
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Bluetooth: hci61: command tx timeout
Bluetooth: hci64: command tx timeout
Bluetooth: hci62: command tx timeout
Bluetooth: hci63: command tx timeout
Bluetooth: hci69: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci69: unexpected cc 0x1003 length: 249 > 9

final repro crashed as (corrupted=false):
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 1 UID: 0 PID: 4828 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: hci25 hci_cmd_sync_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3899 [inline]
 validate_chain kernel/locking/lockdep.c:3920 [inline]
 __lock_acquire+0xed4/0x2b08 kernel/locking/lockdep.c:5288
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 down_read+0x58/0x2bc kernel/locking/rwsem.c:1574
 kernfs_remove_by_name_ns+0x3c/0xd0 fs/kernfs/dir.c:1791
 kernfs_remove_by_name include/linux/kernfs.h:644 [inline]
 sysfs_unmerge_group+0xd0/0x12c fs/sysfs/group.c:408
 dpm_sysfs_remove+0x68/0xc8 drivers/base/power/sysfs.c:830
 device_del+0x15c/0x71c drivers/base/core.c:3940
 device_unregister+0x2c/0xf0 drivers/base/core.c:4006
 hci_conn_del_sysfs+0xf0/0x194 net/bluetooth/hci_sysfs.c:92
 hci_conn_cleanup net/bluetooth/hci_conn.c:170 [inline]
 hci_conn_del+0x9d8/0xf44 net/bluetooth/hci_conn.c:1339
 hci_conn_failed+0x254/0x37c net/bluetooth/hci_conn.c:1443
 hci_abort_conn_sync+0x5a4/0x938 net/bluetooth/hci_sync.c:6035
 abort_conn_sync+0x58/0x8c net/bluetooth/hci_conn.c:3215
 hci_cmd_sync_work+0x1e8/0x380 net/bluetooth/hci_sync.c:338
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Bluetooth: hci61: command tx timeout
Bluetooth: hci64: command tx timeout
Bluetooth: hci62: command tx timeout
Bluetooth: hci63: command tx timeout
Bluetooth: hci69: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci69: unexpected cc 0x1003 length: 249 > 9