Extracting prog: 6m33.161715118s
Minimizing prog: 24m38.489569397s
Simplifying prog options: 12m16.483644774s
Extracting C: 5m17.049255123s
Simplifying C: 0s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in worker_thread
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-syz_usb_connect_ath9k
detailed listing:
executing program 0:
fsmount(0xffffffffffffffff, 0x1, 0x1)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in worker_thread
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
reproducing took 1h7m41.788232223s
repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P72/3:b..l
rcu: (detected by 1, t=10502 jiffies, g=16585, q=1592 ncpus=2)
task:kworker/u8:4 state:R running task stack:21792 pid:72 tgid:72 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
preempt_schedule_common+0x7f/0xd0 kernel/sched/core.c:7463
preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
rt_mutex_wake_up_q kernel/locking/rtmutex.c:583 [inline]
rt_mutex_slowunlock+0x6d3/0xa30 kernel/locking/rtmutex.c:1483
rt_spin_unlock+0x10f/0x200 kernel/locking/spinlock_rt.c:84
spin_unlock_irqrestore include/linux/spinlock_rt.h:141 [inline]
get_from_partial_node+0x426/0x460 mm/slub.c:3943
get_from_partial mm/slub.c:4034 [inline]
___slab_alloc+0xc2/0x920 mm/slub.c:4564
slab_alloc_node mm/slub.c:4987 [inline]
kmem_cache_alloc_noprof+0xec/0x690 mm/slub.c:5010
kmem_alloc_batch lib/debugobjects.c:371 [inline]
fill_pool+0x163/0x610 lib/debugobjects.c:420
debug_objects_fill_pool+0x63/0x80 lib/debugobjects.c:780
debug_object_activate+0x6c/0x3b0 lib/debugobjects.c:869
debug_rcu_head_queue kernel/rcu/rcu.h:245 [inline]
kvfree_call_rcu+0x42/0x3c0 mm/slab_common.c:2039
cfg80211_update_known_bss+0x8e5/0x1430 net/wireless/scan.c:2008
__cfg80211_bss_update+0x147/0x2060 net/wireless/scan.c:2053
cfg80211_inform_single_bss_data+0xc3b/0x1bf0 net/wireless/scan.c:2440
cfg80211_inform_bss_data+0x263/0x3cc0 net/wireless/scan.c:3300
cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3392
ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
ieee80211_rx_bss_info net/mac80211/ibss.c:1065 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1546 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 net/mac80211/ibss.c:1573
ieee80211_iface_process_skb net/mac80211/iface.c:1802 [inline]
ieee80211_iface_work+0x78a/0x1010 net/mac80211/iface.c:1856
cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:564
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: rcu_preempt kthread timer wakeup didn't happen for 10497 jiffies! g16585 f0x0 RCU_GP_WAIT_FQS(5) ->state=I
rcu: Possible timer handling issue on cpu=1 timer-softirq=9019
rcu: rcu_preempt kthread starved for 10498 jiffies! g16585 f0x0 RCU_GP_WAIT_FQS(5) ->state=I ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27784 pid:18 tgid:18 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7376
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2122
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2330
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: cc 5a 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 dc 11 00 fb f4 7c d8 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc900001d7e40 EFLAGS: 00000242
RAX: 0000000000071fbf RBX: ffffffff819a9cac RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8d86bf0c RDI: ffffffff8bcc4580
RBP: ffffc900001d7f10 R08: ffff8880b8733e9b R09: 1ffff110170e67d3
R10: dffffc0000000000 R11: ffffed10170e67d4 R12: 0000000000000000
R13: 1ffff110039d3000 R14: 1ffff9200003afd0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125cc8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbebd80e040 CR3: 0000000063c38000 CR4: 00000000003526f0
Call Trace:
arch_safe_halt arch/x86/kernel/process.c:767 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:768
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x1cc/0x540 kernel/sched/idle.c:355
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x157
report is corrupted, running repro again
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in corrupted
report is corrupted, running repro again
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
report is corrupted, running repro again
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsmount-getsockopt$PNPIPE_ENCAP-syz_usb_connect_ath9k
detailed listing:
executing program 0:
r0 = fsmount(0xffffffffffffffff, 0x1, 0x1)
getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, 0x0, 0x0)
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
final repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P3293/1:b..l P29/3:b..l P6140/1:b..l P31/1:b..l
rcu: (detected by 1, t=10502 jiffies, g=21833, q=822 ncpus=2)
task:kworker/1:0 state:D stack:21880 pid:31 tgid:31 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: wg-crypt-wg0 wg_packet_tx_worker
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
schedule_rtlock+0x30/0x70 kernel/sched/core.c:7440
rtlock_slowlock_locked+0x35c9/0x3c20 kernel/locking/rtmutex.c:1895
rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:45 [inline]
tasklet_lock_callback kernel/softirq.c:900 [inline]
tasklet_action_common+0xc5/0x600 kernel/softirq.c:950
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
__local_bh_enable_ip+0x16f/0x2b0 kernel/softirq.c:325
wg_packet_create_data_done drivers/net/wireguard/send.c:247 [inline]
wg_packet_tx_worker+0x16b/0x7e0 drivers/net/wireguard/send.c:276
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
task:syz-executor state:D stack:22016 pid:6140 tgid:6140 ppid:6135 task_flags:0x400140 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
schedule_rtlock+0x30/0x70 kernel/sched/core.c:7440
rtlock_slowlock_locked+0x35c9/0x3c20 kernel/locking/rtmutex.c:1895
rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:45 [inline]
tasklet_lock_callback kernel/softirq.c:900 [inline]
tasklet_action_common+0xc5/0x600 kernel/softirq.c:950
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
__local_bh_enable_ip+0x16f/0x2b0 kernel/softirq.c:325
local_bh_enable include/linux/bottom_half.h:33 [inline]
smack_netlbl_add+0x12b/0x170 security/smack/smack_lsm.c:2645
security_socket_post_create+0xac/0x330 security/security.c:4215
__sock_create+0x558/0x9d0 net/socket.c:1699
sock_create net/socket.c:1734 [inline]
__sys_socket_create net/socket.c:1771 [inline]
__sys_socket+0xd6/0x1b0 net/socket.c:1818
__do_sys_socket net/socket.c:1832 [inline]
__se_sys_socket net/socket.c:1830 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1830
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb53b64f9c7
RSP: 002b:00007ffc327457f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb53b64f9c7
RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00007ffc32745efc R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000004
R13: 0000000000000063 R14: 0000000000059c78 R15: 00007ffc32745f50
task:ktimers/1 state:D stack:24008 pid:29 tgid:29 ppid:2 task_flags:0x4208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
schedule_rtlock+0x30/0x70 kernel/sched/core.c:7440
rtlock_slowlock_locked+0x35c9/0x3c20 kernel/locking/rtmutex.c:1895
rtlock_slowlock kernel/locking/rtmutex.c:1922 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x165/0x400 kernel/locking/spinlock_rt.c:57
spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
cfg80211_inform_single_bss_data+0xc22/0x1bf0 net/wireless/scan.c:2439
cfg80211_inform_bss_data+0x263/0x3cc0 net/wireless/scan.c:3300
cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3392
ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
ieee80211_scan_rx+0x552/0xa40 net/mac80211/scan.c:364
__ieee80211_rx_handle_packet net/mac80211/rx.c:5427 [inline]
ieee80211_rx_list+0x2d23/0x3b40 net/mac80211/rx.c:5720
ieee80211_rx_napi+0x1ad/0x3d0 net/mac80211/rx.c:5743
ieee80211_rx include/net/mac80211.h:5449 [inline]
ieee80211_handle_queued_frames+0xe4/0x1d0 net/mac80211/main.c:452
tasklet_action_common+0x31c/0x600 kernel/softirq.c:961
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
run_ktimerd+0x6a/0x100 kernel/softirq.c:1174
smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
task:kworker/u8:29 state:R running task stack:22152 pid:3293 tgid:3293 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
preempt_schedule_common+0x7f/0xd0 kernel/sched/core.c:7463
preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
class_preempt_destructor include/linux/preempt.h:496 [inline]
raw_spin_unlock_irqrestore_wake include/linux/sched/wake_q.h:102 [inline]
rtlock_slowlock kernel/locking/rtmutex.c:1923 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x31a/0x400 kernel/locking/spinlock_rt.c:57
spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
cfg80211_inform_single_bss_data+0xc22/0x1bf0 net/wireless/scan.c:2439
cfg80211_inform_bss_data+0x263/0x3cc0 net/wireless/scan.c:3300
cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3392
ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
ieee80211_rx_bss_info net/mac80211/ibss.c:1065 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1546 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 net/mac80211/ibss.c:1573
ieee80211_iface_process_skb net/mac80211/iface.c:1802 [inline]
ieee80211_iface_work+0x78a/0x1010 net/mac80211/iface.c:1856
cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:564
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: rcu_preempt kthread timer wakeup didn't happen for 10507 jiffies! g21833 f0x0 RCU_GP_WAIT_FQS(5) ->state=I
rcu: Possible timer handling issue on cpu=1 timer-softirq=11905
rcu: rcu_preempt kthread starved for 10508 jiffies! g21833 f0x0 RCU_GP_WAIT_FQS(5) ->state=I ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27784 pid:18 tgid:18 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7376
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x30c/0x11f0 kernel/rcu/tree.c:2122
rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2330
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: cc 5a 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 dc 11 00 fb f4 7c d8 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc900001d7e40 EFLAGS: 00000242
RAX: 0000000000079985 RBX: ffffffff819a9dc0 RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8d86bf0c RDI: ffffffff8bcc4580
RBP: ffffc900001d7f10 R08: ffff8880b8733e9b R09: 1ffff110170e67d3
R10: dffffc0000000000 R11: ffffed10170e67d4 R12: 0000000000000000
R13: 1ffff110039d3000 R14: 1ffff9200003afd0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125cc8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5b17f72c0 CR3: 000000003701c000 CR4: 00000000003526f0
Call Trace:
arch_safe_halt arch/x86/kernel/process.c:767 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:768
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x2e0/0x540 kernel/sched/idle.c:355
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x157