Extracting prog: 1m22.025903973s
Minimizing prog: 14m40.081593061s
Simplifying prog options: 0s
Extracting C: 40.301597549s
Simplifying C: 4m54.274564529s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
socket(0x80000000000000a, 0x2, 0x0)
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev
detailed listing:
executing program 0:
socket(0x80000000000000a, 0x2, 0x0)
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300))
syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_ublk_setup_queues
detailed listing:
executing program 0:
socket(0x80000000000000a, 0x2, 0x0)
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
syz_ublk_setup_queues(0xffffffffffffffff, r5, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
socket(0x80000000000000a, 0x2, 0x0)
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140))
r1 = syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2)
syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r0}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r0}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r1, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$ublk_ctrl-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
socket(0x80000000000000a, 0x2, 0x0)
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r2=>0x0)
r3 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r1, 0x2)
syz_ublk_setup_queues(r3, r2, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r3, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
socket(0x80000000000000a, 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r0}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r0}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, 0x0, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, 0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, 0x0, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, 0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, 0x0)
r4 = syz_ublk_add_dev(r1, r2, r3, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r0 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
r4 = syz_ublk_add_dev(r0, r1, r2, r3, 0x0, &(0x7f0000000300)=<r5=>0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r4, 0x2)
syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r0}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r0}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, 0x0)
r6 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r6, 0x0, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(0x0, r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, 0x0, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, 0x0, 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
testing program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=33.607847209s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
simplifying C reproducer
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program did not crash
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing compiled C program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
program crashed: WARNING in ublk_uring_cmd_cancel_fn
testing program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
testing program (duration=33.607847209s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_ublk_setup_io_uring-syz_ublk_add_dev-syz_open_dev$ublk_chdev-syz_ublk_setup_queues
detailed listing:
executing program 0:
r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0)
r1 = syz_ublk_setup_io_uring(0x24, &(0x7f0000000280)={0x0, 0xa46, 0x0, 0x0, 0x1bd}, &(0x7f00000000c0)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0)
r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)=<r6=>0x0)
r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2)
syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0xc22f, 0x10, 0x1, 0x16f, 0x0, r1}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xbd35, 0x4, 0x20000000, 0x364}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x262f, 0x4, 0x2, 0x43, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9360, 0x2, 0x3, 0x42}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc264, 0x6, 0x1, 0xf4, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x3, 0xb44, 0x0, 0x0}}, 0x0)

program crashed: WARNING in ublk_uring_cmd_cancel_fn
validation run: crashed=true
reproducing took 24m23.058175604s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 322 at drivers/block/ublk_drv.c:1579 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Modules linked in:
CPU: 0 UID: 0 PID: 322 Comm: kworker/u8:3 Not tainted syzkaller #0 ed123329535d3916c4d79d0d059a7ed982e746fc
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Code: 5d e9 53 16 52 02 cc e8 5d a9 33 fe 0f 0b eb e3 e8 54 a9 33 fe 0f 0b eb da e8 4b a9 33 fe 0f 0b e9 4d fe ff ff e8 3f a9 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc90001b1f990 EFLAGS: 00010293
RAX: ffffffff8353c8b1 RBX: 1ffff11022d10e7d RCX: ffff88812872b900
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: ffffc90001b1f9e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff8353b890 R12: ffff888116f54c00
R13: ffff8881168873c0 R14: ffff88811526f200 R15: ffff88811526f210
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000074aa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1975
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 322 at drivers/block/ublk_drv.c:1579 ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Modules linked in:
CPU: 0 UID: 0 PID: 322 Comm: kworker/u8:3 Not tainted syzkaller #0 ed123329535d3916c4d79d0d059a7ed982e746fc
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 drivers/block/ublk_drv.c:1579
Code: 5d e9 53 16 52 02 cc e8 5d a9 33 fe 0f 0b eb e3 e8 54 a9 33 fe 0f 0b eb da e8 4b a9 33 fe 0f 0b e9 4d fe ff ff e8 3f a9 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89
RSP: 0018:ffffc90001b1f990 EFLAGS: 00010293
RAX: ffffffff8353c8b1 RBX: 1ffff11022d10e7d RCX: ffff88812872b900
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: ffffc90001b1f9e0 R08: 0000000000000003 R09: 0000000000000004
R10: 0000000000000000 R11: ffffffff8353b890 R12: ffff888116f54c00
R13: ffff8881168873c0 R14: ffff88811526f200 R15: ffff88811526f210
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000074aa000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ublk_ch_uring_cmd+0x6f/0xa0 drivers/block/ublk_drv.c:1975
 io_uring_try_cancel_uring_cmd+0x196/0x280 io_uring/uring_cmd.c:68
 io_uring_try_cancel_requests+0x4d6/0x5b5 io_uring/io_uring.c:3185
 io_ring_exit_work+0x23d/0x83b io_uring/io_uring.c:2971
 process_one_work kernel/workqueue.c:3273 [inline]
 process_scheduled_works+0x7f7/0x1060 kernel/workqueue.c:3354
 worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
 kthread+0x2c7/0x360 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
---[ end trace 0000000000000000 ]---