Extracting prog: 6m14.084612512s Minimizing prog: 1h9m26.225073793s Simplifying prog options: 21m17.104860953s Extracting C: 7m44.786788377s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program crashed: INFO: task hung in hci_cmd_sync_clear single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program did not crash testing program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m50.476437534s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program crashed: INFO: task hung in hci_cmd_sync_clear extracting C reproducer testing compiled C program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program crashed: INFO: task hung in hci_cmd_sync_clear extracting C reproducer testing compiled C program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc VM was preempted during C execution: failed to run command in VM: instance is preempted, retrying testing compiled C program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program crashed: INFO: task hung in hci_cmd_sync_clear validation run: crashed=true testing program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program crashed: INFO: task hung in hci_cmd_sync_clear validation run: crashed=true testing program (duration=6m50.476437534s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-syz_init_net_socket$bt_hci-write$sysctl-bind$bt_hci-write$binfmt_misc detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000000)='2\x00', 0x2) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) program crashed: INFO: task hung in hci_cmd_sync_clear validation run: crashed=true reproducing took 1h52m7.469140336s repro crashed as (corrupted=false): INFO: task syz-executor:5767 blocked for more than 143 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23192 pid:5767 tgid:5767 ppid:1 task_flags:0x40054c flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x125c/0x6730 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7326 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 __flush_work+0x7c7/0xcb0 kernel/workqueue.c:4374 __cancel_work_sync kernel/workqueue.c:4494 [inline] cancel_work_sync+0xd1/0xf0 kernel/workqueue.c:4531 hci_cmd_sync_clear+0x33/0x100 net/bluetooth/hci_sync.c:655 hci_unregister_dev+0x1e4/0x690 net/bluetooth/hci_core.c:2674 vhci_release+0x17d/0x230 drivers/bluetooth/hci_vhci.c:700 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x951/0x2ae0 kernel/exit.c:1009 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152 get_signal+0x1ec7/0x21e0 kernel/signal.c:3046 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efdedf5e68e RSP: 002b:00007fff38e5de48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 000055555683e500 RCX: 00007efdedf5e68e RDX: 0000000000000030 RSI: 00007fff38e5df40 RDI: 00000000000000f9 RBP: 00007fff38e5deec R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000258 R13: 00000000000927c0 R14: 000000000002be8a R15: 00007fff38e5df40 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/u9:1/4928: #0: ffff88802a974140 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc9000819fd08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88802e8f8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331 1 lock held by syslogd/4960: #0: ffff8880b843b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:667 3 locks held by kworker/1:3/5344: #0: ffff88801bc0b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc90004d9fd08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88805b462250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x6310 drivers/net/netdevsim/fib.c:1490 2 locks held by getty/5368: #0: ffff888033e990a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/14053: #0: ffff8880b853b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:667 2 locks held by syz-executor/14195: #0: ffff8880b853b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:667 #1: ffff8880b8524568 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline] #1: ffff8880b8524568 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2e8e/0x6730 kernel/sched/core.c:7228 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x21c/0x2a0 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 14053 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 RIP: 0010:get_entries net/ipv4/netfilter/ip_tables.c:1019 [inline] RIP: 0010:do_ipt_get_ctl+0x5f6/0xbf0 net/ipv4/netfilter/ip_tables.c:1669 Code: 18 44 8b ac 24 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a0 05 00 00 <44> 8b 75 00 44 89 ef 41 bc f5 ff ff ff 44 89 f6 44 89 74 24 20 e8 RSP: 0018:ffffc9000596fa10 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888070862380 RCX: ffffffff8a49e6b8 RDX: 1ffff1100fbf7900 RSI: ffffffff8a49e6ca RDI: ffff888070862398 RBP: ffff88807dfbc800 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff888070862380 R11: 0000000000000000 R12: 0000000000000338 R13: 0000000000000310 R14: ffff88802672a730 R15: ffff88802c9c4a90 FS: 0000555590e5f500(0000) GS:ffff888123eea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa418feb158 CR3: 00000000765b1000 CR4: 00000000003526f0 Call Trace: nf_getsockopt+0x7c/0xe0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x192/0x1e0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0xa1/0x110 net/ipv4/tcp.c:4864 do_sock_getsockopt+0x50a/0x6e0 net/socket.c:2474 __sys_getsockopt+0x148/0x260 net/socket.c:2505 __do_sys_getsockopt net/socket.c:2512 [inline] __se_sys_getsockopt net/socket.c:2509 [inline] __x64_sys_getsockopt+0xbd/0x160 net/socket.c:2509 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa418d9f62a Code: 48 83 ec 10 89 d2 48 63 ff 45 31 c9 6a 2a 45 31 c0 31 c9 e8 d8 99 fb ff 48 83 c4 18 c3 0f 1f 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 RSP: 002b:00007ffc90facee8 EFLAGS: 00000202 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007ffc90facf70 RCX: 00007fa418d9f62a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007ffc90facf0c R09: 0000000000000000 R10: 00007ffc90facf70 R11: 0000000000000202 R12: 00007fa418fee680 R13: 00007ffc90facf0c R14: 0000000000000000 R15: 00007fa418ff0180 final repro crashed as (corrupted=false): INFO: task syz-executor:5767 blocked for more than 143 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23192 pid:5767 tgid:5767 ppid:1 task_flags:0x40054c flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x125c/0x6730 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7326 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 __flush_work+0x7c7/0xcb0 kernel/workqueue.c:4374 __cancel_work_sync kernel/workqueue.c:4494 [inline] cancel_work_sync+0xd1/0xf0 kernel/workqueue.c:4531 hci_cmd_sync_clear+0x33/0x100 net/bluetooth/hci_sync.c:655 hci_unregister_dev+0x1e4/0x690 net/bluetooth/hci_core.c:2674 vhci_release+0x17d/0x230 drivers/bluetooth/hci_vhci.c:700 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x951/0x2ae0 kernel/exit.c:1009 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152 get_signal+0x1ec7/0x21e0 kernel/signal.c:3046 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x666/0x870 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efdedf5e68e RSP: 002b:00007fff38e5de48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 000055555683e500 RCX: 00007efdedf5e68e RDX: 0000000000000030 RSI: 00007fff38e5df40 RDI: 00000000000000f9 RBP: 00007fff38e5deec R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000258 R13: 00000000000927c0 R14: 000000000002be8a R15: 00007fff38e5df40 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8ebe6100 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/u9:1/4928: #0: ffff88802a974140 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc9000819fd08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88802e8f8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331 1 lock held by syslogd/4960: #0: ffff8880b843b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:667 3 locks held by kworker/1:3/5344: #0: ffff88801bc0b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc90004d9fd08 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffff88805b462250 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b8/0x6310 drivers/net/netdevsim/fib.c:1490 2 locks held by getty/5368: #0: ffff888033e990a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/14053: #0: ffff8880b853b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:667 2 locks held by syz-executor/14195: #0: ffff8880b853b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:667 #1: ffff8880b8524568 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline] #1: ffff8880b8524568 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2e8e/0x6730 kernel/sched/core.c:7228 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x21c/0x2a0 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 14053 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 RIP: 0010:get_entries net/ipv4/netfilter/ip_tables.c:1019 [inline] RIP: 0010:do_ipt_get_ctl+0x5f6/0xbf0 net/ipv4/netfilter/ip_tables.c:1669 Code: 18 44 8b ac 24 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a0 05 00 00 <44> 8b 75 00 44 89 ef 41 bc f5 ff ff ff 44 89 f6 44 89 74 24 20 e8 RSP: 0018:ffffc9000596fa10 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888070862380 RCX: ffffffff8a49e6b8 RDX: 1ffff1100fbf7900 RSI: ffffffff8a49e6ca RDI: ffff888070862398 RBP: ffff88807dfbc800 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff888070862380 R11: 0000000000000000 R12: 0000000000000338 R13: 0000000000000310 R14: ffff88802672a730 R15: ffff88802c9c4a90 FS: 0000555590e5f500(0000) GS:ffff888123eea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa418feb158 CR3: 00000000765b1000 CR4: 00000000003526f0 Call Trace: nf_getsockopt+0x7c/0xe0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x192/0x1e0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0xa1/0x110 net/ipv4/tcp.c:4864 do_sock_getsockopt+0x50a/0x6e0 net/socket.c:2474 __sys_getsockopt+0x148/0x260 net/socket.c:2505 __do_sys_getsockopt net/socket.c:2512 [inline] __se_sys_getsockopt net/socket.c:2509 [inline] __x64_sys_getsockopt+0xbd/0x160 net/socket.c:2509 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa418d9f62a Code: 48 83 ec 10 89 d2 48 63 ff 45 31 c9 6a 2a 45 31 c0 31 c9 e8 d8 99 fb ff 48 83 c4 18 c3 0f 1f 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 RSP: 002b:00007ffc90facee8 EFLAGS: 00000202 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007ffc90facf70 RCX: 00007fa418d9f62a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007ffc90facf0c R09: 0000000000000000 R10: 00007ffc90facf70 R11: 0000000000000202 R12: 00007fa418fee680 R13: 00007ffc90facf0c R14: 0000000000000000 R15: 00007fa418ff0180