Extracting prog: 7m15.150097996s
Minimizing prog: 30m51.756667113s
Simplifying prog options: 10m2.436148612s
Extracting C: 5m24.822764515s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program crashed: INFO: task hung in uevent_show
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid
detailed listing:
executing program 0:
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$UHID_CREATE
detailed listing:
executing program 0:
write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', 0x0}}, 0x120)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
program crashed: INFO: task hung in uhid_char_release
a never seen crash title: INFO: task hung in uhid_char_release, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
a never seen crash title: INFO: task hung in uhid_char_release, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001380)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000380)=""/4096, 0x1000}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
a never seen crash title: INFO: task hung in uhid_char_release, ignore
reproducing took 53m34.165696134s
repro crashed as (corrupted=false):
INFO: task udevd:5196 blocked for more than 143 seconds.
task:udevd           state:D
 stack:25136 pid:5196  tgid:5196  ppid:1      task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5377 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6764
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730
 device_lock include/linux/device.h:1030 [inline]
 uevent_show+0x188/0x3b0 drivers/base/core.c:2729
 dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5408716b6a
RSP: 002b:00007ffd19a6e408 EFLAGS: 00000246
 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000055f54eef5e00 RCX: 00007f5408716b6a
RDX: 0000000000001000 RSI: 000055f54ef44260 RDI: 000000000000000c
RBP: 000055f54eef5e00 R08: 000000000000000c R09: 0000000000000000
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000003fff R14: 00007ffd19a6e8e8 R15: 000000000000000a
 </TASK>
INFO: task udevd:5825 blocked for more than 148 seconds.
      Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:27136 pid:5825  tgid:5825  ppid:5196   task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5377 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6764
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730
 seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x886/0xbf0 fs/read_write.c:565
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RDX: 0000000000001000 RSI: 000055f54eebe640 RDI: 0000000000000008
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000
 </TASK>
      Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
task:syz.0.16        state:D
 stack:26304 pid:5997  tgid:5997  ppid:5931   task_flags:0x400040 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:5377 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6764

final repro crashed as (corrupted=false):
INFO: task udevd:5196 blocked for more than 143 seconds.
task:udevd           state:D
 stack:25136 pid:5196  tgid:5196  ppid:1      task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5377 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6764
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730
 device_lock include/linux/device.h:1030 [inline]
 uevent_show+0x188/0x3b0 drivers/base/core.c:2729
 dev_attr_show+0x53/0xe0 drivers/base/core.c:2423
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5408716b6a
RSP: 002b:00007ffd19a6e408 EFLAGS: 00000246
 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000055f54eef5e00 RCX: 00007f5408716b6a
RDX: 0000000000001000 RSI: 000055f54ef44260 RDI: 000000000000000c
RBP: 000055f54eef5e00 R08: 000000000000000c R09: 0000000000000000
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000003fff R14: 00007ffd19a6e8e8 R15: 000000000000000a
 </TASK>
INFO: task udevd:5825 blocked for more than 148 seconds.
      Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:27136 pid:5825  tgid:5825  ppid:5196   task_flags:0x400140 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5377 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6764
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730
 seq_read_iter+0x4f4/0x12b0 fs/seq_file.c:230
 new_sync_read fs/read_write.c:484 [inline]
 vfs_read+0x886/0xbf0 fs/read_write.c:565
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RDX: 0000000000001000 RSI: 000055f54eebe640 RDI: 0000000000000008
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000
 </TASK>
      Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
task:syz.0.16        state:D
 stack:26304 pid:5997  tgid:5997  ppid:5931   task_flags:0x400040 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:5377 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6764