Extracting prog: 19m23.520407947s
Minimizing prog: 18m41.727090664s
Simplifying prog options: 16m5.625702908s
Extracting C: 3m32.927666595s
Simplifying C: 0s
extracting reproducer from 67 programs
testing a last program of every proc
single: executing 17 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_COALESCE_SET
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000018000180140002006e657464657673696d3000000000000005000c000100000208000600480a000005000b"], 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x800)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): semget$private-semop-semctl$SETALL
detailed listing:
executing program 0:
semget$private(0x0, 0x6, 0x583)
semop(0x0, &(0x7f0000000040)=[{0x0, 0xffff}, {0x0, 0x19}], 0x2)
semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0x40])
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2-syz_usb_ep_write$ath9k_ep1
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}})
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x20, &(0x7f0000000540)=ANY=[@ANYBLOB="0c00004e15602547000000007f3b68d00c00004e"])
program crashed: INFO: task hung in ath9k_hif_usb_firmware_cb
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=6m14.058768714s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k-syz_usb_ep_write$ath9k_ep2
detailed listing:
executing program 0:
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}})
program crashed: INFO: task hung in linkwatch_event
testing program (duration=6m14.058768714s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program crashed: INFO: rcu detected stall in schedule_timeout
testing program (duration=6m14.058768714s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m14.058768714s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
program crashed: INFO: rcu detected stall in worker_thread
a never seen crash title: INFO: rcu detected stall in worker_thread, ignore
simplifying guilty program options
testing program (duration=6m14.058768714s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
testing program (duration=6m14.058768714s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect_ath9k
detailed listing:
executing program 0:
syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
program did not crash
reproducing took 57m43.800889041s
repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 1, t=10502 jiffies, g=10729, q=544 ncpus=2)
rcu: All QSes seen, last rcu_preempt kthread activity 10030 (4294958672-4294948642), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10030 jiffies! g10729 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:26264 pid:17 tgid:17 ppid:2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1850/0x4c30 kernel/sched/core.c:6756
preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7078
irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__mod_timer+0x4/0xeb0 kernel/time/timer.c:1065
Code: 00 00 00 5b 41 5e eb 1e 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec 20 01
RSP: 0018:ffffc90000167b98 EFLAGS: 00000246
RAX: 1ffff9200002cf7a RBX: ffff88801cec0000 RCX: ffff88801cec0000
RDX: 0000000000000004 RSI: 00000000ffffb725 RDI: ffffc90000167bc0
RBP: ffffc90000167c90 R08: ffffc90000167bff R09: ffffc90000167bf0
R10: dffffc0000000000 R11: fffff5200002cf80 R12: dffffc0000000000
R13: 1ffff9200002cf74 R14: ffffc90000167bc0 R15: 00000000ffffb725
schedule_timeout+0x155/0x290 kernel/time/sleep_timeout.c:98
rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2045
rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2247
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 80 Comm: kworker/1:1 Not tainted 6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: events_power_efficient neigh_periodic_work
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 de 0f 3a f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 43 b6 a1 f5 65 8b 05 b4 f8 37 74 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc90000a188c0 EFLAGS: 00000206
RAX: 3e02692e14088200 RBX: 1ffff9200014311c RCX: ffffffff817b387a
RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: 0000000000000001
RBP: ffffc90000a18950 R08: ffffffff942a5957 R09: 1ffffffff2854b2a
R10: dffffc0000000000 R11: fffffbfff2854b2b R12: dffffc0000000000
R13: 1ffff92000143118 R14: ffffc90000a188e0 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2eb5ffff CR3: 000000003345e000 CR4: 0000000000350ef0
Call Trace:
dummy_timer+0x44d6/0x4620
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x59d/0xd30 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:__local_bh_enable_ip+0x170/0x200 kernel/softirq.c:396
Code: 8c e8 d4 63 67 0a 65 66 8b 05 b4 00 a2 7e 66 85 c0 75 5d bf 01 00 00 00 e8 0d be 0b 00 e8 68 67 45 00 fb 65 8b 05 78 00 a2 7e <85> c0 75 05 e8 f7 81 a8 ff 48 c7 44 24 20 0e 36 e0 45 49 c7 04 1c
RSP: 0018:ffffc900023afa80 EFLAGS: 00000282
RAX: 0000000080000000 RBX: 1ffff92000475f54 RCX: ffffffff817b387a
RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: ffffffff8c5fb220
RBP: ffffc900023afb28 R08: ffffffff942a5957 R09: 1ffffffff2854b2a
R10: dffffc0000000000 R11: fffffbfff2854b2b R12: dffffc0000000000
R13: 1ffff92000475f58 R14: ffffc900023afac0 R15: 0000000000000201
neigh_periodic_work+0xbcb/0xde0 net/core/neighbour.c:968
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa68/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
final repro crashed as (corrupted=false):
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 1, t=10502 jiffies, g=10729, q=544 ncpus=2)
rcu: All QSes seen, last rcu_preempt kthread activity 10030 (4294958672-4294948642), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10030 jiffies! g10729 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:26264 pid:17 tgid:17 ppid:2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1850/0x4c30 kernel/sched/core.c:6756
preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7078
irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__mod_timer+0x4/0xeb0 kernel/time/timer.c:1065
Code: 00 00 00 5b 41 5e eb 1e 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec 20 01
RSP: 0018:ffffc90000167b98 EFLAGS: 00000246
RAX: 1ffff9200002cf7a RBX: ffff88801cec0000 RCX: ffff88801cec0000
RDX: 0000000000000004 RSI: 00000000ffffb725 RDI: ffffc90000167bc0
RBP: ffffc90000167c90 R08: ffffc90000167bff R09: ffffc90000167bf0
R10: dffffc0000000000 R11: fffff5200002cf80 R12: dffffc0000000000
R13: 1ffff9200002cf74 R14: ffffc90000167bc0 R15: 00000000ffffb725
schedule_timeout+0x155/0x290 kernel/time/sleep_timeout.c:98
rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2045
rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2247
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 80 Comm: kworker/1:1 Not tainted 6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: events_power_efficient neigh_periodic_work
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 de 0f 3a f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 43 b6 a1 f5 65 8b 05 b4 f8 37 74 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc90000a188c0 EFLAGS: 00000206
RAX: 3e02692e14088200 RBX: 1ffff9200014311c RCX: ffffffff817b387a
RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: 0000000000000001
RBP: ffffc90000a18950 R08: ffffffff942a5957 R09: 1ffffffff2854b2a
R10: dffffc0000000000 R11: fffffbfff2854b2b R12: dffffc0000000000
R13: 1ffff92000143118 R14: ffffc90000a188e0 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2eb5ffff CR3: 000000003345e000 CR4: 0000000000350ef0
Call Trace:
dummy_timer+0x44d6/0x4620
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x59d/0xd30 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1820
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:__local_bh_enable_ip+0x170/0x200 kernel/softirq.c:396
Code: 8c e8 d4 63 67 0a 65 66 8b 05 b4 00 a2 7e 66 85 c0 75 5d bf 01 00 00 00 e8 0d be 0b 00 e8 68 67 45 00 fb 65 8b 05 78 00 a2 7e <85> c0 75 05 e8 f7 81 a8 ff 48 c7 44 24 20 0e 36 e0 45 49 c7 04 1c
RSP: 0018:ffffc900023afa80 EFLAGS: 00000282
RAX: 0000000080000000 RBX: 1ffff92000475f54 RCX: ffffffff817b387a
RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: ffffffff8c5fb220
RBP: ffffc900023afb28 R08: ffffffff942a5957 R09: 1ffffffff2854b2a
R10: dffffc0000000000 R11: fffffbfff2854b2b R12: dffffc0000000000
R13: 1ffff92000475f58 R14: ffffc900023afac0 R15: 0000000000000201
neigh_periodic_work+0xbcb/0xde0 net/core/neighbour.c:968
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa68/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244