Extracting prog: 35m46.837518828s Minimizing prog: 2h42m41.958205823s Simplifying prog options: 0s Extracting C: 2m58.769678387s Simplifying C: 29m21.409398817s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-sendmsg$RDMA_NLDEV_CMD_DELLINK-syz_genetlink_get_family_id$nl80211-socket$nl_generic-listxattr-syz_open_dev$tty20-write$uinput_user_dev-socket$inet6_icmp_raw-connect$inet6-setsockopt$SO_BINDTODEVICE-write-syz_open_dev$tty1-dup-ioctl$EVIOCSFF-syz_open_dev$evdev-write$char_usb-socket$nl_netfilter-openat$uhid-write$UHID_CREATE2-ioctl$sock_inet_SIOCSIFFLAGS detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x24044055) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) listxattr(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000280)=""/93, 0x5d) syz_open_dev$tty20(0xc, 0x4, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000003c0)={'syz0\x00', {0x9, 0x0, 0x1, 0x400}, 0x36, [0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f1, 0x0, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x40000, 0x687, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x51, 0xfffffffc, 0xfffffff8, 0x0, 0x0, 0x1, 0x0, 0x80, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], [0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0xfffffffd, 0x0, 0x1, 0x0, 0x0, 0x40], [0x0, 0x0, 0x0, 0x0, 0x0, 0xbd8f, 0x0, 0x4, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x6, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x800000, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffe, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x1, 0x7ff, 0x0, 0x0, 0x4, 0x2000000, 0x0, 0x4], [0x4, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x80, 0x4, 0x0, 0x3, 0x0, 0x0, 0x8f3]}, 0x45c) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r1, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e", 0xc) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r2) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x0, 0x0, 0x2, {0x0, 0x1}, {0x46, 0xea}, @rumble={0x636, 0x2}}) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x12d8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[@ANYRES8=r5], 0x119) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89b0, &(0x7f0000000040)={'veth0_to_bridge\x00', 0x1900}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$inet6_sctp-userfaultfd-ioctl$UFFDIO_API-syz_usb_connect-sendmsg$key-madvise-syz_clone3-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_COPY-openat$vnet-ioctl$int_in-ioctl$VHOST_SET_FEATURES-ioctl$VHOST_NET_SET_BACKEND-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE-sendmmsg$inet-shutdown-syz_open_dev$usbmon-setsockopt$inet_sctp6_SCTP_DELAYED_SACK-socket$kcm-sendmsg$inet-socketpair$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-fanotify_init-memfd_create-dup-fanotify_mark-ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS detailed listing: executing program 0: r0 = socket(0x18, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00005f5000)={0x1000000, 0x0, 0x0}, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x19) syz_clone3(&(0x7f0000002740)={0x0, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005c1000/0x2000)=nil, 0x400000, 0x3, 0x2}) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000030c0), 0x40) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f0000000000)={0x3, 0x0, 0x0, 0xfdfdffff}) sendmmsg$inet(r1, &(0x7f00000007c0), 0x0, 0x4000) shutdown(r1, 0x1) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={0x0, 0x5}, 0x8) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000940)="8ff6c756b829cb06d6d9da3ac317fd860d4411d13e7e702d0dd102c01b4d0eff42284fe03fd92bde9f78270218b317f4899246be5e0b93c1608e953ee7e5f20197b0e2f2fafd8a7d87f0d9ae0763b4f30f2b90b2f43903b14a0fd52a54c590f6eed0ae65d56d9a3e66f73ce1e37a041d380cbd42aedbf14ac1053a4e96f833db0ec098e73e1a0f57dd97955424ad47b51274c18b0e5ae4be9dd4e4ed7189fbbeb242a85622c5e195c052a4e107548b8aace2fad7489a27aea5bdb9d0588d7ec3963906a7e2191091616c1ae4dfcd58103da3bab5f2395cd69f3e535e756181750d4999e0a95b64915ac1bdfa076065d97f8093b1ea97c2f88e46618d95565e7d8562531fb3e15ccb8eac7a3f5d18ff915c93e9dd85c6302cf2e8b707537870e1c60957397db244a01c32cb1e52ac3cd73f20763b9f396c79e0f5437e1a140dcb866022915ada7ee3fb1ec7d487f3b428c6e5a34f8802408f55b7f1a0f56b98721e37fc04d3cbc7a71b9ce89dac49dbd46ec2c5fa1fb4be3a8a0df04e00f77ec1e49b8f4af06dda1ed64e7f3e82eda6b55ba5ebdd52f05df3523eff12a2fbc46e61c858a55186287cd858af1a733ff657612c8c31c7390e664058b191f1b9b50df371a2e62f8c43b69c8d04d6d14f8601d358a43751593b9e9433d8d124ae383c7f12f74391e5bfc9d50fb12f7b15a199d16ece6389cc3a9b08f35e92190ff765d3f653d21bec3dcbd08dd8fc61f8dd1c9a10da8ec5ccb55f6554ab5ac71a4c3e89a40d0f47f675fd66bd83b9abcf90c293110f192f2f046a6ba517abf627d4edb09b4637ab165e94a8f44b307f22a1ed0a244c7ed3e86d227534816d5956a6441e8e3b5c79530816682ff1b4b7f2f1a6b730093a8243f8d5781d5c04ebbb491dfcbea205d44a935eb3b210080218eb07532a59ed56842f3bad6b8c662375ee3d653e97e6dbdc6ee4e42bed077556efd499f27a4ddf5438728cae8304df0335e5270f92629e6177755d7c3a940cf6d6ee19b0b450c120d604bcd7db9bcf052a95c16c3fe35261b019362a87fc7e6b644ab0419d069e76a45c9db9fd23b976d453db7ac5f1286b62faedacd465e7a599a448cdcd9b6d439be3888a5d308adfbc7356a0b7bda7d65d17cb80388b271f2b8ae2445aff49a4cc153cb91cf81a2d449d0c2df1b97494c05f2b28a01e0b5b00546d434d31cf6e0fecdb0a81e087de9f26505e43006030b4fbcff073de8658e703d7086cc022a980faff1f36442d28d4b7b00e6a86edc7e31407443caeb12792883e72f9413e41c47453f7312b1c0fe3726776bbb4c7d4672a5975401459d89db523098d1fe81b6bc39bd5cbe3720ec90e0c96f64d18a7fc530f754c304ebad7a4a7ed0ab1165c9c01834ecb3a8b8ab7ba89a9faa5bd9c3fad523b155d8975ba853bad4992d4b0540357353d29f843d9c61209e6ef8cc7f27cb54dd37062afce358068ab8d2a37d2a2539f3ec61e9db28c16eab4fc28b0f937708d612f7f10e18fccfad80916e374f24aa4525c395f5baa9cd988ebe5096ea124eee8970ebcc7160cdb907a85af2fc85389bbba2d03c0d44ac016681e0d39df79b307e3d965fb39362bec08cc168f1a4f7a4a3bf9d39771a8e418b4b798a6e6b882d8e214bdea67c8bf279ab6f2314eba1ff032d68514432384aaa5589cd66d689f27b04dbdfded96b3f58f9d34f7dd5edae3996a001cbc445e650773f132d4f28d8a83d563b5813f16d17991117c74716c7937eb97d8d46249f2dffbaabb50b49356cd5377920ae4e3965129ecd7ed19dfa139d277b320c4d394256e4294382f453cb280e81873b88d57c544c4397f2b3951b3749795f54512ca4aeea2ac301f8d334abcf58bcc3ccb3a751dfeb5b50f4c293035a9a6a2fb0cde2a6ac7fcaa1cd1a1d0c89da90ceb3adf266289660c5b2211a10ee210a391d2ccb9e5e8aa1d7527efa25fc6a809a2185c83abb9f1c26ad7e391c395d851daede893df292d5b9b8806725a245d79b502e4615883ade29fd47bf310585bf795b9799c2e77515c775b3efb8dd6da828670b57a146788b178ea7faf8eede34e4cd9b356c05130c6cdd2b969f25104f4c4b01f88b0f4eb31f329d2b7abaa1a668fa99cbe40752684b9ad1b2a5f7d2017475c8b3020c01e0e48e5bf72dd36e9fa81a0985e25911731625af3fb11702dd62a52f37c41da05300dfb28aec14af62409afda6f6c401849f47769a06e4c3c3ce250c3e1a78ba42f7eeac8bfd573af14763770f8125dac08f024aab2a6ef2fe150459eb2dbbeca54e05afb9914a163bc16d2296ced54061b592e937351dc18900b3d5ff6f0b78afdbcb3ed0e401252bff356148434a5f06150cb0663a2a425a54cb2f6fe77531c78ffede53fd1b6cefa533deeca6ac725d1d0886c8aafd76f68d32533ff4b5d40a4e633156bff4eab24429dd9d4884e4702657fcd581489261a7938e2806d506b7f41170db23c89c2add8dd64d62057daa4b4cc0ce6759612e225b74353b171c4e0a3a9e0f1b073c1449bf202e4cdf62e87ad70960c30db247fae773035931c6e750b45f35dfc2e2d71348f59676e74aff8bd987efe1276cb353adb286c81e9b58ab56eaf543847219e86d52fbf8b62dc58c3d4b81b37687e94f80c889ae4ea4ac5e7925e7c2a5910f3b4e46b0df570f7f99a1d0c7b812c141c496d976e3027d33255abe2070be6d15ea3d6874e989de7a98bf0feaa03cbdf8f8a2dcc3283e95affae79fb3c0d484720b12add61c573fe3949a0beaddd7bc3ba3533645053d1d381f4e2297a6cbf7a003b9fde19e7f67ab5ccd5d67532a8574d3c9f21848d7911b1d9491091eeeddb010762ccc1a99bab0707478967d79a0378b0bd3ebd5acd3a7a7830bf1c3fd18ea79c9f5471ca03ce3c3ce1a56dc88af547b4516c164b56a7a6712d1f25f91429705962cdf087c3e23b47c5afe6af0122f22154180a5b5aa6a2228f4f2aa82ddc5bded79a68e1a76e6f38d0980ed2585e68fb11054f80aa71243d824795512062ff35906bad2bfc1bad1fdb8e6fed57303a45a861ade8fba005f4c3cccec578511ecb24dd04af4970c8a9be4b50544722b4ae67b82fda3dcc659453b0d41db3df55c6fb26de8f30f14b24582ca22b3c29976650ddb81f90c8df93443ad24e4138da8c5f9f51a55aec2cb087567a568550853e9a96cfd172f43769bae3168885674ba45124552a7edb617de0acb235139227b3fe614315c613abf4ed865b1ea59556b69f87a984809f0b02e5ba6ef3ae3a61ccd09ea0cf0aa7b46f524da4bc73af38e58e25f56593590d263f8633af202ea3a83ce23a41f34324535577eb6f72aefbcf862a396136fe5a6f2e76c5c1ba100212222b4bdaa588121818c24982939cfa5afdf5d346af311f94d38f777075a0117766c6ffca997227f313388a9e1ac965ca9f0fcf2197f35e9d73c1de4590ad8cf9f4905eee65d426365913849875e6a889dd274492b695903a4c6fe73c9c48d8624e960bc9daf6d9de82d556fc3c30de7bd25dd228168962fca0c0bbff635d824724cdd079798c41d8928f616028e3f35cc6e92f6cb91c7f276864e7e16814f2797084a73f847e89da791cb9fa7c344452915f26b714ff5d4bb29a64d7e260ca891af0db7a570194ed2c5f272e6daf7500abea85964ac0748a46c8804d14c1ecd80612b36e7645325636d074208a21360574fe8cd5ecfa4b6bddbd4e8672eb5fb80e4384069bb1778a2f4ab5964f61aca16793f54ea9e1c5f3bd868ad478db514bc7144129ee55a34db3f9888b9ae6f97344564dc3add5baeca2fae88bc10cebb9e3a96a29c73a15eeec9e6a0b21eb8c64935d72065cd40cf7cf68e6dcf6dde2ba8f2da8ee03dbd31381e2c1079f9b7d69cefcc107e48816b46cf2c2ae2c777686dc7f45cdc91b7e25c86e8533518129a624287c1ae942360024e3e4a983dd925b14f5c36c381fb0d3d73c829bc1bddbed9f4f14d831d0a2e1061b48f624139a942f497fb77ff392a18585e8a510bcec29296c95356783b11b43a6b6ac7ef3ee10967abbf78a81292e6e5c5006b45f653dfc5c3c314ad8c21302e90687b3b2d53466b81352e997ee38f239dbf41bc9a1fe3fb8c704a6a6b35c459e3d63d0b12e7c3f076300f65d5117416242fe83b1c0df71bc79d582fb7be2d3e7a8a8b93d8e36557f974106d1280f638e695a3abcdb71e31c0aa12722a94464b25f241b24feae8fdf37178f6eec24b918ea7a79f038dfaf62735720236fa6a2f85337a7b013e42fcdc65b790b7b29edf791dc7792411695aba1ddc127b9f1e7a6b316e1dd7b1d378317e2ee0f788f13a87b59902c666f8258877a01c959fd42be791ee399202a83aa18eece0aaf25b65d178527038f6df202729640e2ef336241854c02920310f7fae50fc2a95b43aba507df90714fb4f9c6e675130aa89192553eb81ba6d8d5c2a49bc1afd3b33b30bce482bbf70466948d6f285146e3a1d25610bd54e653bcee1b331e063a94dfbb6cccab1346b2da67c59eadc06ae897dfc1af57bf6f89c7f2242bf01ab551b2b3470832caef430334e155843b513c05ccb214dc459974eab46823a6529eadd88e1948af86c7c66642852de0f95462aaaa44ec6355ca3c00f4f18c62adc370239f2b83ed1da123573a7d90733033f71e24d58352e9634b25bf00d56917d715a59051b2d5026e420f7aa98a74b6fa0647f7f984713772e6f59d2a478b55d4dddbdf03c619ba6102ee2645b1fd77e4be1b18790b44fc9d896ced38d03bb2be08b8a1e875d6cd2b3828397414cf51f9a97f278f4f8bbc22cc64aabd321f94c4dd7fce15f0ff76f6947825d67ccc9252b5ba5779b20996568c34b01444ee1be4e86927bbfc207a410f7c2984509aa2b756d78672194a9e0156495422bc292ee99956f430c764b624ad85232f5575c8ddc9549cb9cfbbe49f24aabb48333e1c2a8a2f3fa7a730a6e797b4a27c6dc94d05faf276cc7d1961b544066da585233e4a6ba40ced42701416aaadbd6ec60f5d29a6430b48d43d2babd779d7d2be974459425bad8e30bd0ec5d42f41caa1fc8bc01b7958ef76cdfa011cd1eeb2c119e2a31fc060e273fe6270529658118267aec57b80d3333b6ecacd4532bceca12b08f30eac13a95683d73eb41f188e1591636bb0ef5f54fe57b449486fac505602dfca88bd28a2e9dfb722924fbd313733e9eec11f3e4833d499972018223ec54ad741776c176efed90c26c37e3622aa85d10b174aabac08feb37e5107770f931344fefb027d8e51a9bceeb5500f3b97d033d67b2cac32e9e20a8ffa6f2abff005497b18fa10813c8ab2e905b9372a708585ffcb5d864f65fc16f9a485cfd59a7304e1e5b65e42789060138fabcb0c52458e27e24b65bc4401df9ddd9cd2e95ee0c5afdc598b137a9e2d6eaf0b5b2d57fae9815f0e0ec16a755683af89986470f39b3899aa93a09ffd95c1675f561b93ba6e454dc9044d45c9c89e704687e4732f2b1fe91bab5721580fed2480b04d60d15e0011328196fc3fe622637320edf72c6878114041112a01c5f658c31937c40dfde51180b7ac1420529e18307a04bd8d08c6c9a1230561ed359c86465ed43b3c2f965d90e523b3fb779592b0b6065e5c44d9c3b9322083d62aeba78a7c8bdee50cee7e2292cc190ecc89535f0d415a2c9410564a419d325fd99f071f46a68b8357ff357073c38ad2e13e1db5cd7c198b6a6d69f3198270e03d2676cd0a20703c2a5bb96c29778d1692b65ce4ce8835812f277dd67b2d20fb268d23", 0x1000}, {&(0x7f0000003100)="5e27be8e0378125ace5f3d52196a538e6b732473b19eb6b5f2105dee385105052ebdf9962b107610ba00b3dac7d505dc3fd105d9e95ab746bd59e0734c2eb44ef4d158d162f46380954c04e667fc536ee4a52aa15bbec0b1530b04bb52a43dc1ea82ed84f26930b8df2402e2c84775da50a7b01ca672632baa7690a4347141fc6c6c5283479dd45e732bba7acf4233ffff442f3d42713a3ba68a392bb5aa3fcc98c1c7f5c9220e3177381f735b53dbd28ebdaf95aba6c57babd0315ed810914575431a563095927471ccf7f9b8295d0bf162c5cf6c4dde729c96f9a5bd54d87702ea9681b714a02181235e8f2eeddc9d34b43a265e36fa7a21490548066b1f66596858aa542a0864102b8a20fd4dc0bc2da8a3d78814f94ee58149430c5195c314f173f0d137ee1cb2080901740826a078339fdf4d8a53eea11a14438693e15821cef9e7254f17fc489df7be0f1e17132fb980342aee07de1ec2bbb3f2c229aa69ce278ab06a802b27aa8eb445ea09aeb586bb862e860ad0b575e569411f630895bfedfde6aac0a8f4731401ebbc56b52b978b3b9ef3f4f5b78219defb7f8f94d15d44416fc407367b8dad9d9fd59736f9013ad8360b3438323d2f7836758a9fdf8ba3c1166352d99cfe6e498e52154fd27d0ae4f7549af461a7687d4016fd994820f9235f5170926d142c8b56745b36d446c45a3aea3524f7ab0f051aaa78bb8240a3b849f0021388edd258a813ad7a93ed79aef595c73ac4e9cb914043f34c4084a8d847fcd78321c7bf67f8d9cdaf4f7e5edce4eab95ffdf02f80cf7e2996dda38f584b7601e00533d17027551b16d950f676bda07d37f76e2b1bbfdb46763bed4884ad3d49d53d5b15d41e4551951e8e42d828671f723b8599c7054bf0376cae1ce797a496c4d16950ad3f47fba2da9b99d6589df07e02d4e7612fa00a4a868469ee3002738942bb6881db4eee7439fbffa00030765b4180490042dd9782b9e6852c4166c3145d351ff7bfac4fdb4790a74933798efd502ca3a3bbd04f82bb25005281ccb30d201b2238bf7316fddd785d3b94998d161da740e1369540f4f79b3c8e7c481bad5c161f6b59f57c067931d54f5f0e6caee4b94caa693a5822beae44a94488093906bbe383bb9e4fe5af05531425266e741a1a6c7cbcd151d099e60016f1840c3b835b7f5d6dac1c5d4b18caed8f45f123290b7bd7dc47bb757f31fb4aa1c6048e63818e28688097731edec4d098a68c2f56879e2125b4096686927e130f1684d27b45860ecf2cec696a0b8e6a71ea9337dfe5acd740209f1c71d382be266f99381bfa92f67f46b4390306b994dd37e0914cfe6f5a4304f957436086af0a805b9d05d0348eeb4b8b4c08756db3b34b377989439f601622b4e59a348d8ef4f3228371652e8e5f11857a1a47609f4576c16a8f3afa1db74f07e75b21b9cdff9bcf09a4ca44dfb7cecc39f531737299b1814eea8b8e56e0e4955c921cf3ecb2b2e808ac5203dbfd7e892ba0c9923bfdde7c6be06f38239ab8379705a829b36696b8dc8947a6c3f0170725175e403a0126a803e792619907e6679f9eeed113de92587910fb6423eb8ac24f63f8e0f1e06801c8782e12ce6b5cccd7f7c7b60bcd6f2aadf616ee97fbf36359e4e56f62fec97581c2aac5568cf9c3c90cf964d9e073ca996bb056d42c5c37796d674a405ea3a790a7461552d1c5bdef264b8a66d1260d1eed61d38ea0959917e58538ae162af397229f9739dadb83f7fb255c0458491008e2daf0dea711c58e80330be62be471255858c65d2f695b0cff833690a2b9ff0426f8bbd56ba5c441e35ac2b9fd76f61189edca87bc4e5085207a5eb5d95cc5de8409834e0230bfdcec3a66266540af38344ff6beab4c004550a11b1307b1ec9d8702a7f897b0b6140f63e4bd4df3acd583c928dc58310cfec153ecbc831dd4041a06fdba8f84ede0d0743e30224a403c335da6cd5e44ad80fda7a22479eaa208835bb2cd6cba417bdd4bdbdc313ce445c86393aa684dc4fd3fe4fc60e70a04f9dc42083302a9560ee1d7e7f31ed196f3a4e688321ce8d1b7aa69b2eb0763310b12356f7ed26938dccdeb1c230d5d5564a58b83f942aafb20a9649948c59bfc6fdca9ad6765c644ee03898fceeeec81efed8fb131fe472e366203f23156c51d8d1fea4f45a4e3a35f13b81713c8824a4c029553ffda65fd07a16909cc3a5813fce1bd7cb5d2489a58fb8d2d110010d54e21236a9a70b7155a117ac85a1a87c4219d62de55cf31c71a8db1416189c91b7bd7811f5f479f981136c830e4591cfd51a0c8a9e0aa256a013034c5856e046bbe90a95dde9e24e07ffdc460f0e20a52ed8f3738a34ce76f4d498fe2a003f6558277bc7f4d86a452472406fe4172ea186d8c6e2683c26f72db5c7f1ffd878f0eec8b3ddc0f196a48f4fdb3eac585774ba7ef080a73bdde3734af8b5a9254082ba9392404dbda9f4130a384f6e993380b4b7a94227eeca603e00518c797123b1cbe1aa2003960289051e867626f41b985eca04363dd8e36c09c9eac4450d5fd56c5d4353d210b61d2c9aa9e1ee839d5a137aed523f494747ce38dda1720f62eef369b78f75691563f957d5892865a1118b829120112ac3546968e1c61f43f8cad1c7a63c00dbf2b3ec69ec341e31a89cd417493578b050ce17b6bf8822d5a502d863e6b50652efaaa8b7b8eea9fe233e3efc813f75f0e5e01cdb964eac5319242873d86f6e4f04d2dc0ee65a3ea51ef93dc841fb417fe3cb861aa08c44b351fc09c37b54b7fb5ce6e342e483ca31a5b9428f389f86b93064b19683be30d0fc6b47f0495d668b86a5f34dc52b0d47cf610af05ecf271951c1a1f7c7e612826777dd3af0d3e8bcbb1a342c50179aea21734f90022d602e3b7377128cf5b8141d8ad2ad3287680c560ed6b0550984bb3070968fb43b3108b443d9fb4c7c12b468e3947c332cf669e909426482622ddbcf29dcce048e05d1dd544431e0d268172dc010647da43005ada6ca89a804eb7b95d1acd07caa964f0628a517eb5d60a6664d6d0d7c79232f0021482e475c5bd866d4c0f44ba2122adc953a618a9a0ebafb882041332ad671724b8124781bf054df5b4e0ea1cdcc616b768ba712fc62cb46d6b6b5ea47ffcb6964def2adaec1d6832706064e095f5a41fd09f68f4ceaaa7861924d25067968f748649ddc82cc51762b344b73d39225028b7a8c3bef3b3cad178886b84397915e7633f257abfd3123ee50a42d59101fb3e8c00c1e4ff003db103c037dc31ef6d2bac35241394e0f88d809c32de9c335efc959df760e2ec53dfb0428dff1e8eafcd74e024abb1546351dab4dbe6b0bb0ca170993f0fbe3418d8b1b76fe0824185ad272caa817d683af7c8a149abb7d1361a770a54dfd023b51022ef0244ebb4c6c32c35ef9c9e0fdf079c85a6fabb27a66de6a15dfc96bbeb76a4e8873b11b279ed5ed1feaa2ffafcc870ab1714455a9d5dba462ea875ff92fa122e43aa299bf1547d067db312e0b682aedffeb63084089711b9e7ac08466d96b9afccb445c4f04faa4c2d5393b1dd8b76e138c9b076f491413fadc88e5e585ae9f1caad21296f7de8a60d66a944a35eaefda8209b37b6ce490d47e9c6f5f3d2da1cbf8d5446d06972ba48fd88195bd2d9f64a2f48c5f6b84415710820a4a6ad0c85320846549ebd3171efa7345ee2648eb62f8071b4aacaecf15e85d3d7cce1248ac21a717c6db0e4359bb8be604c4dd1b2d945e365f8bd1f50fb0502be41e7219bcac02b7d3224867d5aed2a842abe781e32b65477f80363e1fdb1c8e49e194f5fb775615ab83a932ec880d952ae8842853167982e88bd307dde252ba2d7fdceb8855a159f34090555c77c5f2f5cadc819f9ec0f1afe7ca5fbbc54bd79458d5285a791e820861c1af52eac698fb4baa5fd6aeed7f38d44f5c3f5cd3e43695f8f8914e631c79aada388c16dcddc540c3ad30da67437e0d73859d6d3935db20fc90da2271c52ce04bd73e834072f2764333ffc5583f966a008dbaf17a730a075f6ac46b1c6d8397c0121de9ece38065af1c3c26b2b977c5666f530e25bfe305becfa3b69fa869c0d09126b1e59e615b1eb665f541c6cbbf9b0a61a9bb8fb114f0d088f0b355090a5f3436490e6fb4bc184547966f38a7ac7c17ddd3dd97e63db01061d514403446de4878cae062c3679ce2b4567316dfc28d4d33d86b5f22a6040b266b3a91edbb0e9daff5b8e66999f9f18633c2c4cbaac135a3498a0153f7f9cca5de5a1d5dd2ab195985b639d81e112f88063b98e8e6cbe77f2c468550559a22d397ba150e0eb16f46e25c83a0cda0aa69e5a40ce2455f4d231376c60d7663b7d7d3642658b5ddeb60ce9b44adf61eec8c3d2ab24eadfbda520f07b75c6e11300f44219734811ec362e43c985bb16572f75f628ba697abcafe96cfc2692ef4bbc71e3949a1564fc735bd927fe5cdf59941ad7a0b055e51b51fc32134cb9f0ceabf4b49aecd62eb4f9a4a2b414ceeb455737d7d02b09d5ba644c84358ca85847b75dc0bb9247ab38b124129cbce3f29230878f06efcd305e420c6086d20d5a039046b7e49e1ee05e708bfce7013ffc1219f74919a1dcfa00e5e0011ad04ebb3b69d88fb95e7040296e475f1ccad3b89dcf81b25c9ad8400bae47604002b7d041c96ee1bd71c9229b86f7cc1717de48dfd395d2aa2a0e1169f51a9ac7a037da939001b4fa75d829aabb4e9066c80d9f7f346a8c5140e231599a0ac962f9d732e69659acf3324104d5ec528a7f302f6cde7eeecc35a6b83ed5e2046c8733e44aa06c16a7bec2680c037e1cb7485132ccc25862e51b75724dbdd347ef37da0d26ecfbbc37296fb51259038603623bb1ed2fca0177ae018cdf0963114cd25589c4988c09feaf0aa80af698021abd3be79a1c0922885838e8ada068948010cd18cfedcd998116a3fcd742ca6165479c84f9c163e562239f97cf87790b44f8f9504c04a1252c9aa946cf3e6476c6fd6692d30fb5d0cc19332532bd06ac20de80a6d4bfbb20c6b6a108bcc7985d4d8c767c85fb87319f4fb99a9df5d90cacbe41771efa45873ef086daf8ec6851a900613fd7f2f7cd2e00b421ec84df53efa6a648a96add190c612f6b94c7f1f56e66e3dbe92b67f9133a819f007cc7b1badf8489d29a18fa8f1d1692ce334307cda7930deff13ec65676e2175cde34b588171fb76d4a408fa54ba7d35004cabcfc3a173bfceeb0cd675c134e73b879f30178291cc5ee240c1aebf612791538a6dad18d6be0f40d8331b8198464bae005ff404f2b32568dedb7236d9ce521fc42bc7e6dac716408a43a326b8918283efd75b2018c52a5b6187f4ef9cd4bc92b1cc058c6e595a43c79f558a37f01348ae9ab53a6bed98a6d758b5e60df5ee3e21848ddc1733805464b27b584d167ffd4f9e31f9ad17f16413e153d6d9af90e80d5f4adfd3e8938f18fa0e0cd81dbddcc6a6b794f1c7b40cb86878d71f44a5acb3f70b9795ee678eb9076a73a7077430e5236701eb41db29949b78404a33a867493c8d2bdcd68a62feaa4b92b27fcc44dddcf6ddf6da180f3f2c0cc4e0cc2172dc51b5124bf37a1b5cde1e52ed92ceb0e931ef511492293485cc1999d18245f0a037331a895fb43dcf042c1a335e75b1aa52d0db6d80b4c0ab541f3212588e3d7974e50721cee8bb973082d95bb5ab869ec79968c94996c213fcea9e87ee21bae4260b063eebc1ca62dc681dbd8d7afda77ef15e18a7d22ad3a290000ae759936", 0x1000}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x80) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newqdisc={0x28, 0x24, 0x20, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r7, {0xffe0, 0x6}, {0x4, 0xc}, {0xfff1, 0xb}}, [@TCA_STAB={0x4}]}, 0x28}}, 0x20008095) r8 = fanotify_init(0x200, 0x0) r9 = memfd_create(&(0x7f0000000180)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00\x00\x00\x00', 0x6) r10 = dup(r9) fanotify_mark(r8, 0x2, 0x48001059, r10, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r10, 0x4040534e, &(0x7f00000000c0)={0xb8, @tick, 0x5, {0x1, 0x9}, 0x8, 0x2, 0x9}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-syz_usb_connect$uac1-socket$nl_route-socket$inet6_udp-connect$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-ioctl$KVM_SET_MSRS-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL-syz_io_uring_submit-syz_open_dev$dri-ioctl$DRM_IOCTL_SET_CLIENT_CAP-ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES-ioctl$DRM_IOCTL_MODE_ATOMIC-sendmsg$nl_route detailed listing: executing program 0: syz_open_dev$loop(&(0x7f0000000240), 0x8, 0x4400) (async) syz_usb_connect$uac1(0x0, 0x93, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000086b1d01014000010203010902810003010060000904000000010100000a240100000002010205240506000904010000010200000904010101010200000e240201000000009290d2199a5a09050109000000040007250180000000090402000001020000090402010101021b00082402010000000007240100000000090582090002"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000280), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f00000083c0)={{0x1}}) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f00000000c0)={0x1, 0x1000000, 0x2, 0x0, 0xc}) (async) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000000000006d0200"]) (async, rerun: 32) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 32) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000180)=ANY=[], 0x2c}}, 0x0) (async, rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_SHUTDOWN={0x22, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x1}) (async, rerun: 32) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r7, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) (rerun: 64) ioctl$DRM_IOCTL_MODE_ATOMIC(r7, 0xc03864bc, &(0x7f00000001c0)={0x400, 0x1, &(0x7f0000000340)=[r8], &(0x7f0000000180)=[0x1], &(0x7f0000000200), &(0x7f0000000240)}) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000010a0000000000000000000000003058f1954051950e89f97f0e5e5eddc52941212bd9375ca7cf8c4c254d9358ab6df28a08d8ff46f81714f9df4dbd3e3cc8bce26b1da87ec8cdd8b81e83726e2e1c6803d52e7dad736e83d0e28d6f8c543c85ca40bb1f2de445fba38d4c99", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006d616373656300001800028005000300100000000c0004000300000100c28000"], 0x48}}, 0x0) (rerun: 32) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-syz_usb_connect-syz_emit_ethernet-add_key$keyring-add_key-mmap$IORING_OFF_SQ_RING-ioctl$KVM_CREATE_VM-syz_open_dev$vim2m-socket$netlink-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_TREAD-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_PARAMS-syz_open_procfs-syz_open_procfs-add_key$keyring-keyctl$KEYCTL_RESTRICT_KEYRING-getpid-openat$mixer-socket$netlink-sendmsg$nl_route-add_key$user-keyctl$dh_compute-syz_pidfd_open-setns detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) syz_emit_ethernet(0x52, &(0x7f0000000000)=ANY=[], 0x0) r2 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000001c0)='big_key\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, r2) mmap$IORING_OFF_SQ_RING(&(0x7f0000e90000/0x3000)=nil, 0x3000, 0x0, 0x100012, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x3, 0x2) socket$netlink(0x10, 0x3, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f0000000040)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x3, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net/udp\x00') syz_open_procfs(0x0, &(0x7f0000000080)='net/vlan/vlan0\x00') r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000180)=@keyring={'key_or_keyring:', 0x0, 0x2}) r5 = getpid() openat$mixer(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r7, r7, r7}, &(0x7f0000000100)=""/58, 0x3a, &(0x7f0000000000)={&(0x7f0000000080)={'sha512-generic\x00'}}) r8 = syz_pidfd_open(r5, 0x0) setns(r8, 0x24020000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$cdc_ecm-syz_open_dev$I2C-ioctl$I2C_RDWR detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0x88, 0x5, 0x20, 0x8086, 0x9500, 0xb6d8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0x15, 0xcc, 0x1c}}]}}]}}, 0x0) (async) syz_usb_connect$cdc_ecm(0x6, 0x64, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x52, 0x1, 0x1, 0x0, 0x40, 0x7, [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x2, 0x6, 0x0, 0x2, {{0x6, 0x24, 0x6, 0x0, 0x0, 'O'}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x5, 0xb960, 0x4, 0xf}, [@mbim={0xc, 0x24, 0x1b, 0x5, 0x8, 0x9, 0x2, 0xff}, @obex={0x5, 0x24, 0x15, 0x4f}, @obex={0x5, 0x24, 0x15, 0x8000}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x18, 0x0, 0x8}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x9, 0xa5, 0x80}}}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x300, 0x30, 0x6, 0x9, 0x10, 0x2}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0x8, [{0xc, &(0x7f0000000140)=@string={0xc, 0x3, "23021b8e7c9d1b2dd098"}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x3001}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x1004}}, {0xf, &(0x7f0000000200)=@string={0xf, 0x3, "f035dff467d634fd89850da149"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x80c}}, {0xe9, &(0x7f00000002c0)=@string={0xe9, 0x3, "de9012683467af9fe20e0f9038a913327d82eb10292da9dfbf7dc6ee99ce2cf562e8d7bf4fff1f645e7bd5073de6764b92ae24eac675600e68226839a61dea96376db28492b338f2fc3113adcef59c007285df7d032c7db65acb5e2ae5bd76d06c20eac92e6a5ace835cda5af20a34f6008b2766a1303111d9e04debb7db26339e1fa7605d5c58a506d3026c598e9c47d9295447532f0e81d80f3d12d5bdbc7288ca336fff2ee14479c9606286b7e0972a0e47c09f9f45e78abedb191b0ac1f0f6b48f83b9da5279bc3750f889d8a7e5240173ec378adce779e7bdbe1e2b98d0f0067375a490fa"}}, {0x8b, &(0x7f00000003c0)=@string={0x8b, 0x3, "f5391d13472c341824ddd8d5df25ebcef6261fad830c3a402c9f6cffc633218d2665be8595ee9a55916adf20f55afae5ef2c0d429c69c2743974ade828312b3b6e7e4cd44e0025c4426f8d61efb1409678a4c0c51725641ed826bd6f24bf66d423adaaead1e884238b674a02cef1208727373ad1865d436d25086f373a78899b3896f19cb916964eb4"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0xc0c}}]}) (async) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000280)={&(0x7f0000000600)=[{0x7, 0x211, 0x0, 0x0}, {0x8, 0x4000, 0x20, 0x0}], 0x2}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter-socket$netlink-socket$netlink-sendmsg$nl_route-sendmsg$nl_route-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_DISABLE detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r1, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r2, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r2, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r2, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r1, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r6 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r9}}) (async) syz_io_uring_submit(r7, r8, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r9}}) io_uring_enter(r6, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r6, 0x3516, 0xf0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r0) sendmsg$TIPC_NL_BEARER_DISABLE(r10, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xd8, r11, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x74, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NODE={0x4}, @TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x41, 0x4, {'gcm(aes)\x00', 0x19, "84c9f414482db1409b1e8be89cb9c0e9875781eb24d95b24ba"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4}, 0x42) program crashed: INFO: task hung in io_uring_enter single: successfully extracted reproducer found reproducer with 28 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter-socket$netlink-socket$netlink-sendmsg$nl_route-sendmsg$nl_route-syz_genetlink_get_family_id$tipc2 detailed listing: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r1, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r2, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r2, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r2, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r1, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r6 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r9}}) (async) syz_io_uring_submit(r7, r8, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r9}}) io_uring_enter(r6, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r6, 0x3516, 0xf0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r0) program crashed: INFO: task hung in io_uring_alloc_task_context testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter-socket$netlink-socket$netlink-sendmsg$nl_route-sendmsg$nl_route detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) program crashed: INFO: task hung in io_uring_alloc_task_context testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter-socket$netlink-socket$netlink-sendmsg$nl_route detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellinkprop={0x38, 0x6d, 0x2ec9b2c728e3c67, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x49a11, 0x2e804}, [@IFLA_PROP_LIST={0x4}, @IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter-socket$netlink-socket$netlink detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) program crashed: INFO: task hung in io_uring_alloc_task_context testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter-socket$netlink detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) program crashed: INFO: task hung in io_uring_alloc_task_context testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_uring_enter testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-syz_io_uring_submit detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1, {0x0, r8}}) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(0xffffffffffffffff, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_GET_BEARER_NAMES-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000814}, 0x24000018) (async) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r5, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_genetlink_get_family_id$tipc-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r3, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-socket$nl_generic-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r3, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-recvmmsg-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) recvmmsg(r0, &(0x7f00000016c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=""/64, 0x40}, 0x9}], 0x1, 0x20, 0x0) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r3, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-sendmsg$IPSET_CMD_FLUSH-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r3, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-socket$nl_netfilter-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r3, r4, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r2, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-sendto$inet6-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r1, &(0x7f0000000300), 0x5aa, 0x0, 0x0, 0xfffffffffffffdfd) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r3, r4, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r2, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-connect$inet6-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r3, r4, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r2, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-connect$inet6-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xffff, 0x0, @mcast2, 0x9}, 0x1c) (async) r2 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r3, r4, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r2, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-socket$inet6_icmp_raw-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r1, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-setsockopt$inet6_opts-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r0, 0x29, 0x4d, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x8) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r1, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-socket$inet6_icmp_raw-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$alg-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, 0x0, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(0x0, r1, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r1, 0x0, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, 0x0, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, &(0x7f0000000000)="f7fd13474975e94d6942267d389a2abfbf06ee507e1279f094a52e823cff8cf9c1cbfa2a171e4e072314c11796298f192578fc87f6e9356e520ff3dbb9f9db6280fb1ad4ff7a22d9e9b88d3f8af42227849e1e394ef986bcdb583fa3866f42ba274ff82c66957bdaee28433e04c3", 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, 0x0, 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program crashed: INFO: task hung in io_uring_del_tctx_node testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, 0x0, 0x9, 0x0, 0x1}) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter detailed listing: executing program 0: r0 = syz_io_uring_setup(0x10d, &(0x7f0000000980)={0x0, 0x5885, 0x80, 0x10000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x1, 0x0, 0x8001, 0x1, 0x0, 0x9, 0x0, 0x1}) (async) io_uring_enter(r0, 0x3516, 0xf0, 0x0, 0x0, 0x0) program crashed: INFO: task hung in io_uring_del_tctx_node extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-syz_io_uring_submit-io_uring_enter program crashed: INFO: task hung in io_uring_del_tctx_node reproducing took 3h50m48.974832665s repro crashed as (corrupted=false): INFO: task syz-executor170:5856 blocked for more than 143 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5856 tgid:5850 ppid:5849 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5858 blocked for more than 144 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5858 tgid:5852 ppid:5851 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5859 blocked for more than 145 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5859 tgid:5855 ppid:5853 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5864 blocked for more than 146 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5864 tgid:5857 ppid:5854 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5867 blocked for more than 147 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5867 tgid:5862 ppid:5861 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e13ccc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e13ccc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e13ccc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 2 locks held by getty/5595: #0: ffff8880313e50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 1 lock held by syz-executor170/5856: #0: ffff8880339f20a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 2 locks held by syz-executor170/5860: 1 lock held by syz-executor170/5858: #0: ffff8880339f00a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 1 lock held by syz-executor170/5863: 1 lock held by syz-executor170/5859: #0: ffff88803411e0a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 1 lock held by syz-executor170/5865: 1 lock held by syz-executor170/5864: #0: ffff88803411c0a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 1 lock held by syz-executor170/5866: 1 lock held by syz-executor170/5867: #0: ffff8880339f60a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 2 locks held by syz-executor170/5868: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:437 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5868 Comm: syz-executor170 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:369 Code: 3b 00 74 3a 48 83 c3 48 49 89 df 49 c1 ef 03 43 80 3c 37 00 74 08 48 89 df e8 5b 91 b0 00 48 8b 3b e8 43 cb 1a 00 85 c0 74 14 <43> 80 3c 37 00 74 08 48 89 df e8 40 91 b0 00 48 8b 03 eb 02 31 c0 RSP: 0018:ffffc9000471f508 EFLAGS: 00000202 RAX: 0000000000000001 RBX: ffffc9000471f570 RCX: 639e0dc71dbf0200 RDX: 0000000000000001 RSI: ffffffff8db495a4 RDI: ffffffff81000130 RBP: ffffc9000471f5b0 R08: ffffc9000471ff48 R09: 0000000000000000 R10: ffffc9000471f578 R11: fffff520008e3eb1 R12: ffff8880620e5a00 R13: ffff88814deca380 R14: dffffc0000000000 R15: 1ffff920008e3eae FS: 00007f8a122f96c0(0000) GS:ffff888125d8c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6d035016c8 CR3: 000000007aa8a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0xfc/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:905 [inline] io_add_buffers io_uring/kbuf.c:497 [inline] __io_manage_buffers_legacy io_uring/kbuf.c:538 [inline] io_manage_buffers_legacy+0x334/0xc90 io_uring/kbuf.c:551 __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1730 io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1753 io_queue_sqe io_uring/io_uring.c:1960 [inline] io_submit_sqe io_uring/io_uring.c:2216 [inline] io_submit_sqes+0xa38/0x1c50 io_uring/io_uring.c:2329 __do_sys_io_uring_enter io_uring/io_uring.c:3396 [inline] __se_sys_io_uring_enter+0x2df/0x2b20 io_uring/io_uring.c:3330 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8a122f9208 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 00007f8a123f8338 RCX: 00007f8a1236e599 RDX: 00000000000000f0 RSI: 0000000000003516 RDI: 0000000000000003 RBP: 00007f8a123f8330 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffb0 R13: 00002000000000c0 R14: 0000200000000340 R15: 00007fffb6bb3388 INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.250 msecs final repro crashed as (corrupted=false): INFO: task syz-executor170:5856 blocked for more than 143 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5856 tgid:5850 ppid:5849 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5858 blocked for more than 144 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5858 tgid:5852 ppid:5851 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5859 blocked for more than 145 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5859 tgid:5855 ppid:5853 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5864 blocked for more than 146 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5864 tgid:5857 ppid:5854 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 INFO: task syz-executor170:5867 blocked for more than 147 seconds. Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor170 state:D stack:26952 pid:5867 tgid:5862 ppid:5861 task_flags:0x400548 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5392 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781 __schedule_loop kernel/sched/core.c:6859 [inline] schedule+0x165/0x360 kernel/sched/core.c:6874 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x68f/0x730 io_uring/io_uring.c:3204 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x56a/0x2550 kernel/exit.c:915 do_group_exit+0x21c/0x2d0 kernel/exit.c:1108 get_signal+0x125e/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:111 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 RSP: 002b:00007f8a12327218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f8a123f8328 RCX: 00007f8a1236e599 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8a123f8328 RBP: 00007f8a123f8320 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 00002000000000c0 R14: 0000200000000340 R15: 0000200000000980 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e13ccc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e13ccc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e13ccc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 2 locks held by getty/5595: #0: ffff8880313e50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 1 lock held by syz-executor170/5856: #0: ffff8880339f20a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 2 locks held by syz-executor170/5860: 1 lock held by syz-executor170/5858: #0: ffff8880339f00a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 1 lock held by syz-executor170/5863: 1 lock held by syz-executor170/5859: #0: ffff88803411e0a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 1 lock held by syz-executor170/5865: 1 lock held by syz-executor170/5864: #0: ffff88803411c0a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 1 lock held by syz-executor170/5866: 1 lock held by syz-executor170/5867: #0: ffff8880339f60a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 2 locks held by syz-executor170/5868: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:437 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5868 Comm: syz-executor170 Not tainted 6.15.0-syzkaller-03589-gfeacb1774bd5 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:369 Code: 3b 00 74 3a 48 83 c3 48 49 89 df 49 c1 ef 03 43 80 3c 37 00 74 08 48 89 df e8 5b 91 b0 00 48 8b 3b e8 43 cb 1a 00 85 c0 74 14 <43> 80 3c 37 00 74 08 48 89 df e8 40 91 b0 00 48 8b 03 eb 02 31 c0 RSP: 0018:ffffc9000471f508 EFLAGS: 00000202 RAX: 0000000000000001 RBX: ffffc9000471f570 RCX: 639e0dc71dbf0200 RDX: 0000000000000001 RSI: ffffffff8db495a4 RDI: ffffffff81000130 RBP: ffffc9000471f5b0 R08: ffffc9000471ff48 R09: 0000000000000000 R10: ffffc9000471f578 R11: fffff520008e3eb1 R12: ffff8880620e5a00 R13: ffff88814deca380 R14: dffffc0000000000 R15: 1ffff920008e3eae FS: 00007f8a122f96c0(0000) GS:ffff888125d8c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6d035016c8 CR3: 000000007aa8a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0xfc/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:905 [inline] io_add_buffers io_uring/kbuf.c:497 [inline] __io_manage_buffers_legacy io_uring/kbuf.c:538 [inline] io_manage_buffers_legacy+0x334/0xc90 io_uring/kbuf.c:551 __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1730 io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1753 io_queue_sqe io_uring/io_uring.c:1960 [inline] io_submit_sqe io_uring/io_uring.c:2216 [inline] io_submit_sqes+0xa38/0x1c50 io_uring/io_uring.c:2329 __do_sys_io_uring_enter io_uring/io_uring.c:3396 [inline] __se_sys_io_uring_enter+0x2df/0x2b20 io_uring/io_uring.c:3330 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a1236e599 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8a122f9208 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 00007f8a123f8338 RCX: 00007f8a1236e599 RDX: 00000000000000f0 RSI: 0000000000003516 RDI: 0000000000000003 RBP: 00007f8a123f8330 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffb0 R13: 00002000000000c0 R14: 0000200000000340 R15: 00007fffb6bb3388 INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.250 msecs