Extracting prog: 1h11m27.916915063s Minimizing prog: 1h24m21.927735504s Simplifying prog options: 15m42.216566138s Extracting C: 5m14.794670935s Simplifying C: 0s extracting reproducer from 53 programs testing a last program of every proc single: executing 13 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_connect$midi-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac2 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "ca258375"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect$midi(0x4, 0x68, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x56, 0x1, 0x1, 0xc9, 0xd0, 0xfa, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x0, 0x8, [], [{{0x9, 0x5, 0x2, 0x10, 0x200, 0xc5, 0x5, 0x96, {0xf, 0x25, 0x1, 0xb, "a851828924dc4291615247"}}}, {{0x9, 0x5, 0x8, 0x2, 0x8, 0x7, 0x8, 0x12, {0x10, 0x25, 0x1, 0xc, "1af259beadbc2759470e531d"}}}, {{0x9, 0x5, 0x8, 0x10, 0x400, 0x60, 0x5, 0x5, {0xa, 0x25, 0x1, 0x6, "75198191fa69"}}}]}}}}}]}}, &(0x7f0000000ac0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0xff, 0x7, 0x1, 0xff, 0x65}, 0x2b, &(0x7f00000000c0)={0x5, 0xf, 0x2b, 0x3, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x3, 0x6, 0x1}, @ssp_cap={0x1c, 0x10, 0xa, 0x8, 0x4, 0x9, 0xf0f, 0xffff, [0x3fff, 0xf0, 0xcf, 0x0]}]}, 0xa, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x1809}}, {0x8d, &(0x7f0000000140)=@string={0x8d, 0x3, "a5f483c0abec68f04bd40dce3f5f6a28e0c712aaa24beac207afc851edb753a651c7c7cfd49294fbcaabd417461487b1bda20f763971d1f0a23a2258724135d6ae82359e7d0438841889d278faf23709ac91f8f640da612e0cf10fac73e031e4f98f8d4fcd4dbe15f99c8f6a91e627863a1072a80df8b81194c21859dc2d99aac38efc131f04f852f25abf"}}, {0x56, &(0x7f0000000240)=@string={0x56, 0x3, "e9575b5fd832a416f8bda908b67ff0fded9880110522f98714153aaa735cb7d2531c6c13b5e884d1aa717c1bcbfcb8b3db643edcf08dc2f1ff1bf3149149db3e7a3856dfbe9edf71d08aaeb6c6cd7fe70a84f5a0"}}, {0xea, &(0x7f00000002c0)=@string={0xea, 0x3, "aee13596aaa31899c3754adc0bf6ff862f3e4eaa88c483ac6502efb844e8a30dbbae2c46971241a1393547d22f8981a3d3cc500bc9b35b7175eb79df343a323eb7f07144b653da57ff51c8d75a9bdce7121a887ca714cc64991a9882702e38ef08c2f2948c3e80cac8b6d8017320e3c88dbbf3d5305d16f91bceaf2df7bbe9a762a1dfc4a52b5fe2e021b3a777c173e3aaa7f6088f7e1d2e8c93fccde93b4a73e609632afe6d7387fc15445def262e0b52c306ee1c07027785431ec032729031eb1668b573a74a44fceb9e9e6766fd79b780c209a785c38a11746355820b0148d01bdec66adb3c95"}}, {0xce, &(0x7f00000006c0)=@string={0xce, 0x3, "1ebd5bfd13ef627e71fd04f933385abf8e0ae82aee71a46ffcc3c1eae55aa9bdc4e4b1c00db6460b6a54a11d3b1d7644d7ab2d31a92ff23321a9af9ee3b0a4b3478fce52bd6de3fdefcd47c32024486c15e37db242e73093f7f952f9de2550139cab2476005fcd24a84ab44777f4963ce38259ce991860d3e7a75010314ac1f1eeb977366da2cf7582e3754d8862c56a636bb8d55bfa5340593edd0cc570fa17bac2996fb38f96174c7d27a9aff5453c728c1eb8c1ee0a8f403cc03e02cc6d9edadd85953f7ca55fd51cf5bd"}}, {0x7e, &(0x7f00000007c0)=@string={0x7e, 0x3, "3eb8ddcbbef82525b493707c83f821607f8241978948e657a1d9d24bb9eb5d7d5f99092111a8312dc0d3fdb9815b0d949fc46029f70c60159fcb910d69b7eec511171af8f516ef275a5460590b6bfed687c79232a5f1956dea5c42fcea7da244d9f9eb6a8112feddbe700e31f106fb15821da94c752cabe7fd0eed7b"}}, {0x3a, &(0x7f0000000840)=@string={0x3a, 0x3, "aac2674eb7be3c69069ea2dec228dde66d2b6908b5af7a017d4799881cf61aaa5906ab9609703c420d299153ff8d3b69b2981c43a0245694"}}, {0x65, &(0x7f0000000880)=@string={0x65, 0x3, "a994fb752562b43ae1b6241caa955b924eeb073f852667c4079ccbb3c985a4a4344af97989e1f745eaf1a37c79718750e1185a9f39403d951e5ba5d6dad6853d9bd6c9e54788d308e3e09fe4ac959c0668793ccc73d1a0ef563b1fcf611fa97bb40b07"}}, {0xe2, &(0x7f0000000980)=@string={0xe2, 0x3, "73463981fa85f330add0600a41ff29a0264e5b4d66f9876a97570886cdc453f57ad39c9ce0d56a58dd1dd064da21e6111ef19fe0977e1a3ede8f0872defae81898dfb1e648e09a52e39fbe907aae742998c167cfe571867412fd5d52388812e007e77df757a071465c240045beb1c9cc28bb406339d6fd9e5132c6105b9c0d78b1733cec62a24246e1dacb6b67bcf2a274c5dd5f48470798d738689b5cc70f77c2ce0533f003a49dd739634e329346b129affee73dcfdec8a73268ba816c56fabb00eec491eed5b741e06e6f7ae8ae1cee34a6eaf46d08c3336471283852a110"}}, {0x1a, &(0x7f0000000a80)=@string={0x1a, 0x3, "2598772b554eff53ea57498bc755ed6d0e5a0769d3321228"}}]}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000002c80)={0x44, &(0x7f0000002a40)={0x0, 0x14, 0x4, "9ee802cb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-ioctl$COMEDI_INSN-ioctl$COMEDI_INSN-mmap$IORING_OFF_SQ_RING-ioctl$KVM_CREATE_VM-syz_init_net_socket$bt_sco-socket$inet6-sendto$inet6-getsockopt$inet6_int-shutdown-ioctl$KVM_CREATE_DEVICE-openat$sequencer-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD-setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD-sendto$inet6-setsockopt$inet_sctp6_SCTP_RECVRCVINFO-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_RM_DEV_V2-recvmmsg-ioctl$SNDCTL_SEQ_CTRLRATE-ioctl$SNDCTL_SEQ_CTRLRATE-socket$nl_generic-socket$nl_generic-syz_open_procfs-syz_open_procfs-fchdir-fchdir-syz_clone-syz_clone-mount-syz_open_procfs-pread64-syz_genetlink_get_family_id$ipvs-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_NEW_DAEMON-sendmsg$IPVS_CMD_NEW_DAEMON-ioctl$KVM_SET_TSS_ADDR-ioctl$KVM_SET_DEVICE_ATTR detailed listing: executing program 0: r0 = openat$comedi(0xffffff9c, &(0x7f0000000240)='/dev/comedi4\x00', 0x22380, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000280)={0xc000003, 0xf, &(0x7f00000002c0)=[0x138a, 0xfff, 0x4, 0xb, 0x660, 0x1, 0x1c4, 0xffffffd7, 0x9, 0xf5, 0x1, 0x2, 0x5, 0x101, 0x86], 0x0, 0x4}) (async) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000280)={0xc000003, 0xf, &(0x7f00000002c0)=[0x138a, 0xfff, 0x4, 0xb, 0x660, 0x1, 0x1c4, 0xffffffd7, 0x9, 0xf5, 0x1, 0x2, 0x5, 0x101, 0x86], 0x0, 0x4}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20004048, &(0x7f00000003c0)={0xa, 0x4a20, 0x7ffff, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}, 0x4}, 0x1c) getsockopt$inet6_int(r3, 0x29, 0x10, 0x0, &(0x7f0000000400)) shutdown(r2, 0x1) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x448200, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r6, &(0x7f0000000140)='\x00', 0x1, 0x8491, &(0x7f0000000180)={0xa, 0x4e23, 0xb, @mcast1, 0xda8}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r6, 0x84, 0x20, &(0x7f00000001c0)=0x2, 0x4) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000000440)={0x0, 0x9, 0x0, [0x4, 0x5, 0xa, 0x3753b8fa, 0x4], [0x28f, 0x0, 0x6, 0x3, 0x4, 0x3, 0x6, 0x1a0000000000, 0x1, 0x4, 0x5, 0x6, 0x1, 0x8000000000000001, 0x6, 0x5, 0x9f7, 0x0, 0x80000001, 0x5f71e5e5, 0x80, 0xfffffffffffffffd, 0x6, 0x9, 0x3, 0x0, 0x174, 0x3, 0x3ff, 0x8, 0x1, 0x8fc, 0x9, 0x7fffffffffffffff, 0x6, 0xb71, 0x7fffffff, 0x1, 0xffffffffffffffff, 0x8, 0x4bf4, 0x10001, 0x877, 0x8000000008, 0x9, 0xfff, 0x7, 0x800, 0x0, 0x7, 0x6, 0x6, 0xb, 0x3, 0x3, 0x6, 0x3, 0xf5, 0x7, 0x8000000000000000, 0x800, 0x0, 0xfa7, 0xfffffffffffff801, 0x2, 0x10, 0x2, 0x9, 0x8, 0x7, 0x5b5, 0x180000000, 0x7, 0x0, 0xf, 0x2, 0xc1, 0x8, 0x7fff, 0x10, 0x2, 0x8, 0x8, 0xffffffff80000001, 0x5, 0x81, 0x1, 0xb8e, 0xfffffffffffffff8, 0x4, 0x135, 0x81, 0x1, 0x8, 0x8, 0x8000, 0x2, 0x4, 0x0, 0x401, 0x0, 0x5, 0x98c6, 0xa934, 0x8, 0xc950, 0x120, 0x9, 0x7fffffffffffffff, 0xba, 0x8000, 0x6, 0x4, 0x3, 0x1ff, 0x4, 0x173b, 0x197c, 0x9, 0xd1b, 0xfffffffffffffffb]}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000000440)={0x0, 0x9, 0x0, [0x4, 0x5, 0xa, 0x3753b8fa, 0x4], [0x28f, 0x0, 0x6, 0x3, 0x4, 0x3, 0x6, 0x1a0000000000, 0x1, 0x4, 0x5, 0x6, 0x1, 0x8000000000000001, 0x6, 0x5, 0x9f7, 0x0, 0x80000001, 0x5f71e5e5, 0x80, 0xfffffffffffffffd, 0x6, 0x9, 0x3, 0x0, 0x174, 0x3, 0x3ff, 0x8, 0x1, 0x8fc, 0x9, 0x7fffffffffffffff, 0x6, 0xb71, 0x7fffffff, 0x1, 0xffffffffffffffff, 0x8, 0x4bf4, 0x10001, 0x877, 0x8000000008, 0x9, 0xfff, 0x7, 0x800, 0x0, 0x7, 0x6, 0x6, 0xb, 0x3, 0x3, 0x6, 0x3, 0xf5, 0x7, 0x8000000000000000, 0x800, 0x0, 0xfa7, 0xfffffffffffff801, 0x2, 0x10, 0x2, 0x9, 0x8, 0x7, 0x5b5, 0x180000000, 0x7, 0x0, 0xf, 0x2, 0xc1, 0x8, 0x7fff, 0x10, 0x2, 0x8, 0x8, 0xffffffff80000001, 0x5, 0x81, 0x1, 0xb8e, 0xfffffffffffffff8, 0x4, 0x135, 0x81, 0x1, 0x8, 0x8, 0x8000, 0x2, 0x4, 0x0, 0x401, 0x0, 0x5, 0x98c6, 0xa934, 0x8, 0xc950, 0x120, 0x9, 0x7fffffffffffffff, 0xba, 0x8000, 0x6, 0x4, 0x3, 0x1ff, 0x4, 0x173b, 0x197c, 0x9, 0xd1b, 0xfffffffffffffffb]}) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000880)={{r0}, 0x0, 0x0, @unused=[0x80000000, 0xda85, 0x7fff, 0x7fffffff], @devid=r7}) recvmmsg(r6, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}, 0x8001}], 0x1, 0x10140, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r5, 0xc0045103, 0x0) (async) ioctl$SNDCTL_SEQ_CTRLRATE(r5, 0xc0045103, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000001880)='task\x00') (async) r9 = syz_open_procfs(0x0, &(0x7f0000001880)='task\x00') fchdir(r9) (async) fchdir(r9) syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) (async) r10 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) mount(0x0, &(0x7f00000018c0)='.\x00', &(0x7f0000001900)='proc\x00', 0x0, 0x0) r11 = syz_open_procfs(r10, &(0x7f0000001940)='coredump_filter\x00') pread64(r11, 0x0, 0x0, 0x4) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='TL\b\x00', @ANYRES16=r12, @ANYBLOB="010028bd7000fddbdf25090000000c0003800800010001000000"], 0x20}}, 0x48040) (async) sendmsg$IPVS_CMD_NEW_DAEMON(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='TL\b\x00', @ANYRES16=r12, @ANYBLOB="010028bd7000fddbdf25090000000c0003800800010001000000"], 0x20}}, 0x48040) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000100)=@attr_riscv64=@attr_addr={0x0, 0x1, @aplic, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-syz_ublk_setup_io_uring-socket$nl_netfilter-syz_io_uring_submit-syz_ublk_add_dev-ioctl$SNDRV_TIMER_IOCTL_PARAMS-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x1, 0x0, 0x0, 0x3}}) r1 = syz_ublk_setup_io_uring(0x1f, &(0x7f00000002c0)={0x0, 0xf8c8, 0x80, 0x2, 0x35}, &(0x7f0000000340)=0x0, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000400)=@IORING_OP_RECVMSG={0xa, 0x34, 0x4, r5, 0x0, 0x0, 0x0, 0x121, 0x0, {0x1}}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000480)={0x2e, 0x41, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@any_dev={0x1, 0xee5, 0x0, 0x0, 0x1000, 0x6489, 0x0, 0x0, 0x114560f04ac8842e}}}, &(0x7f0000000540)) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000180)={0x6, 0x0, 0x9, 0x0, 0x4}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$fscrypt_v1-pipe2$watch_queue-pipe2$watch_queue-keyctl$KEYCTL_WATCH_KEY-keyctl$KEYCTL_WATCH_KEY-unshare-sendmsg$TEAM_CMD_OPTIONS_SET-sendmsg$TEAM_CMD_OPTIONS_SET-syz_clone3-syz_init_net_socket$nl_generic-socket-sendto-recvmmsg-ioctl$XFS_IOC_START_COMMIT-ioctl$XFS_IOC_START_COMMIT-sendmsg$IPSET_CMD_HEADER-syz_clone-socketpair$unix-socketpair$unix-ioctl$sock_SIOCGIFBR-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$netlbl_cipso-mkdirat-mkdirat-mount-mount-socketpair$tipc-socketpair$tipc-shutdown-shutdown-openat-syz_init_net_socket$x25-setsockopt-write-write-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-syz_usb_connect$uac1-sendmsg$sock detailed listing: executing program 0: r0 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @desc1}, &(0x7f00000004c0)={0x0, "5d9bc136c963254c661fb620148b6f72ca6ae2a44829bfa79ec13499f8ec9077d85d879711d98bb1687ad36dfe5f14a7b0ce15c1e6be0e7ecabfdfde0dfa00b1"}, 0x48, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000540), 0x80) (async) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0xfffffffdffffffff) (async) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0xfffffffdffffffff) unshare(0x22020600) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, 0x0, 0x405, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x20004080) (async) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, 0x0, 0x405, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x20004080) syz_clone3(&(0x7f0000000140)={0x44000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x2}, 0x53) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000a00)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000000a40)=[{{&(0x7f0000000a80)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000b00)=[{&(0x7f0000000b80)=""/100, 0x365}, {&(0x7f0000000c00)=""/85, 0x14c}, {&(0x7f0000000c80)=""/4096, 0x197}, {&(0x7f0000001c80)=""/106, 0x645}, {&(0x7f0000001d00)=""/73, 0x1b}, {&(0x7f0000001d80)=""/77, 0x188}, {&(0x7f0000001e00)=""/154, 0x8}, {&(0x7f0000001ec0)=""/17, 0x1d8}], 0x21, &(0x7f0000001f00)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000001fc0)={0x77359400}) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000740)) (async) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000740)={0xffffffffffffffff}) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, 0xc, 0x6, 0x181, 0x0, 0x0, {0x3}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x8001) syz_clone(0x90420600, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCGIFBR(r5, 0x8940, &(0x7f00000005c0)=@generic={0x1, 0x5, 0x8000000000000001}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r6) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000008c0)='./sys\x00', &(0x7f0000000900)='sysfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f00000008c0)='./sys\x00', &(0x7f0000000900)='sysfs\x00', 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000009c0)) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000009c0)={0xffffffffffffffff}) shutdown(r7, 0x2) (async) shutdown(r7, 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt(r9, 0xf2, 0xc, 0x0, 0x0) write(r8, &(0x7f0000000980)='+bond0', 0x6) (async) write(r8, &(0x7f0000000980)='+bond0', 0x6) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002000), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r11, 0xae60) syz_usb_connect$uac1(0x6, 0x72, &(0x7f0000002040)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x95, 0x60, 0xf7, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x1, 0x2, 0xf, {0x7, 0x25, 0x1, 0xc, 0x6, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x1, 0x6, 0x3, {0x7, 0x25, 0x1, 0xc, 0x9, 0x5}}}}}}}}]}}, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002100)=[{&(0x7f0000002140)="cd94", 0x2}], 0x1}, 0x40000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$uac1-syz_usb_control_io-syz_usb_control_io$uac1-syz_usb_connect$midi-syz_usb_control_io$cdc_ncm-syz_usb_control_io$uac2 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "ca258375"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect$midi(0x4, 0x68, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x56, 0x1, 0x1, 0xc9, 0xd0, 0xfa, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x0, 0x8, [], [{{0x9, 0x5, 0x2, 0x10, 0x200, 0xc5, 0x5, 0x96, {0xf, 0x25, 0x1, 0xb, "a851828924dc4291615247"}}}, {{0x9, 0x5, 0x8, 0x2, 0x8, 0x7, 0x8, 0x12, {0x10, 0x25, 0x1, 0xc, "1af259beadbc2759470e531d"}}}, {{0x9, 0x5, 0x8, 0x10, 0x400, 0x60, 0x5, 0x5, {0xa, 0x25, 0x1, 0x6, "75198191fa69"}}}]}}}}}]}}, &(0x7f0000000ac0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0xff, 0x7, 0x1, 0xff, 0x65}, 0x2b, &(0x7f00000000c0)={0x5, 0xf, 0x2b, 0x3, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x3, 0x6, 0x1}, @ssp_cap={0x1c, 0x10, 0xa, 0x8, 0x4, 0x9, 0xf0f, 0xffff, [0x3fff, 0xf0, 0xcf, 0x0]}]}, 0xa, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x1809}}, {0x8d, &(0x7f0000000140)=@string={0x8d, 0x3, "a5f483c0abec68f04bd40dce3f5f6a28e0c712aaa24beac207afc851edb753a651c7c7cfd49294fbcaabd417461487b1bda20f763971d1f0a23a2258724135d6ae82359e7d0438841889d278faf23709ac91f8f640da612e0cf10fac73e031e4f98f8d4fcd4dbe15f99c8f6a91e627863a1072a80df8b81194c21859dc2d99aac38efc131f04f852f25abf"}}, {0x56, &(0x7f0000000240)=@string={0x56, 0x3, "e9575b5fd832a416f8bda908b67ff0fded9880110522f98714153aaa735cb7d2531c6c13b5e884d1aa717c1bcbfcb8b3db643edcf08dc2f1ff1bf3149149db3e7a3856dfbe9edf71d08aaeb6c6cd7fe70a84f5a0"}}, {0xea, &(0x7f00000002c0)=@string={0xea, 0x3, "aee13596aaa31899c3754adc0bf6ff862f3e4eaa88c483ac6502efb844e8a30dbbae2c46971241a1393547d22f8981a3d3cc500bc9b35b7175eb79df343a323eb7f07144b653da57ff51c8d75a9bdce7121a887ca714cc64991a9882702e38ef08c2f2948c3e80cac8b6d8017320e3c88dbbf3d5305d16f91bceaf2df7bbe9a762a1dfc4a52b5fe2e021b3a777c173e3aaa7f6088f7e1d2e8c93fccde93b4a73e609632afe6d7387fc15445def262e0b52c306ee1c07027785431ec032729031eb1668b573a74a44fceb9e9e6766fd79b780c209a785c38a11746355820b0148d01bdec66adb3c95"}}, {0xce, &(0x7f00000006c0)=@string={0xce, 0x3, "1ebd5bfd13ef627e71fd04f933385abf8e0ae82aee71a46ffcc3c1eae55aa9bdc4e4b1c00db6460b6a54a11d3b1d7644d7ab2d31a92ff23321a9af9ee3b0a4b3478fce52bd6de3fdefcd47c32024486c15e37db242e73093f7f952f9de2550139cab2476005fcd24a84ab44777f4963ce38259ce991860d3e7a75010314ac1f1eeb977366da2cf7582e3754d8862c56a636bb8d55bfa5340593edd0cc570fa17bac2996fb38f96174c7d27a9aff5453c728c1eb8c1ee0a8f403cc03e02cc6d9edadd85953f7ca55fd51cf5bd"}}, {0x7e, &(0x7f00000007c0)=@string={0x7e, 0x3, "3eb8ddcbbef82525b493707c83f821607f8241978948e657a1d9d24bb9eb5d7d5f99092111a8312dc0d3fdb9815b0d949fc46029f70c60159fcb910d69b7eec511171af8f516ef275a5460590b6bfed687c79232a5f1956dea5c42fcea7da244d9f9eb6a8112feddbe700e31f106fb15821da94c752cabe7fd0eed7b"}}, {0x3a, &(0x7f0000000840)=@string={0x3a, 0x3, "aac2674eb7be3c69069ea2dec228dde66d2b6908b5af7a017d4799881cf61aaa5906ab9609703c420d299153ff8d3b69b2981c43a0245694"}}, {0x65, &(0x7f0000000880)=@string={0x65, 0x3, "a994fb752562b43ae1b6241caa955b924eeb073f852667c4079ccbb3c985a4a4344af97989e1f745eaf1a37c79718750e1185a9f39403d951e5ba5d6dad6853d9bd6c9e54788d308e3e09fe4ac959c0668793ccc73d1a0ef563b1fcf611fa97bb40b07"}}, {0xe2, &(0x7f0000000980)=@string={0xe2, 0x3, "73463981fa85f330add0600a41ff29a0264e5b4d66f9876a97570886cdc453f57ad39c9ce0d56a58dd1dd064da21e6111ef19fe0977e1a3ede8f0872defae81898dfb1e648e09a52e39fbe907aae742998c167cfe571867412fd5d52388812e007e77df757a071465c240045beb1c9cc28bb406339d6fd9e5132c6105b9c0d78b1733cec62a24246e1dacb6b67bcf2a274c5dd5f48470798d738689b5cc70f77c2ce0533f003a49dd739634e329346b129affee73dcfdec8a73268ba816c56fabb00eec491eed5b741e06e6f7ae8ae1cee34a6eaf46d08c3336471283852a110"}}, {0x1a, &(0x7f0000000a80)=@string={0x1a, 0x3, "2598772b554eff53ea57498bc755ed6d0e5a0769d3321228"}}]}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000002c80)={0x44, &(0x7f0000002a40)={0x0, 0x14, 0x4, "9ee802cb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_mptcp-openat$ttyS3-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-ioctl$SNDRV_PCM_IOCTL_DRAIN-ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32-connect$inet6-socket$inet6_mptcp-openat$ttyS3-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-ioctl$SNDRV_PCM_IOCTL_DRAIN-ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32-connect$inet6 detailed listing: executing program 0: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f00000003c0)={0xc73e, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x2, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4001, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_DRAIN(r3, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r3, 0xc06c4124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x1ff) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_procs(r1, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) (async) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x2) (async) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f00000003c0)={0xc73e, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x2, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4001, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) (async) ioctl$SNDRV_PCM_IOCTL_DRAIN(r3, 0x4144, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r3, 0xc06c4124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) (async) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_mptcp-openat$ttyS3-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-ioctl$SNDRV_PCM_IOCTL_DRAIN-ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32-connect$inet6-socket$inet6_mptcp-openat$ttyS3-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-ioctl$SNDRV_PCM_IOCTL_DRAIN-ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32-connect$inet6 detailed listing: executing program 0: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f00000003c0)={0xc73e, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x2, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4001, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_DRAIN(r3, 0x4144, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r3, 0xc06c4124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz0\x00', 0x1ff) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_procs(r1, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) (async) write$cgroup_pid(r2, &(0x7f0000000380), 0x12) (async) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x2) (async) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, &(0x7f00000003c0)={0xc73e, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x2, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4001, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) (async) ioctl$SNDRV_PCM_IOCTL_DRAIN(r3, 0x4144, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r3, 0xc06c4124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) (async) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$uac2-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_open_dev$dvb_frontend-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000180)={0x14, &(0x7f0000000040)={0xf35109ed58237ec0, 0x6, 0x91, {0x91, 0x23, "bb7cbf29a7e7f1f6d4b4a1bf3af403a4d62b2515060210101577f26561dd5929341227759b028f3980fb2042e8f9f70b641b81712e9511a064ecd20a0d328533ac9bcbacd7389a58dc14cf6a17504f368a5e4b4ad2ac5b9255083a726b7311e6ead1f6b2c1fa2ae6bd6f0b900dc460f6345d2421201f0b7331541397401659658c7f4d996c7f0afedc129d4f4ed60b"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3801}}}, &(0x7f0000000440)={0x44, &(0x7f00000001c0)={0xc0, 0x5, 0x9f, "295b92c8f3a7719c8a9fbc4b94256a05bc5ad2a2a63f3f3486e19b9544173b20763b079e677fa8a536de27eec06c4c27492414974ff5e874d7ae41a9dcd8b05a581c3c1d2c313e01fd483efac00b806d0a92dae7a04d545b16599a3dda7a929b23864ac68dde06615f5111738533e3941ab09e902e6d65e590de96b12f97b537b37e8ec1ec5f2b61e3ffc2f48a30a0d92a58449fcf23cbcbfe580514b75ff1"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000300)={0x20, 0x81, 0x2, 'nr'}, &(0x7f0000000340)={0x20, 0x82, 0x2, "60b7"}, &(0x7f0000000380)={0x20, 0x83, 0x3, "bbc435"}, &(0x7f00000003c0)={0x20, 0x84, 0x1, '#'}, &(0x7f0000000400)={0x20, 0x85, 0x3, "2fa667"}}) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000004c0)={0x0, 0x30b5, 0x0, 0xfffffffe, 0x12c}, &(0x7f0000000580)=0x0, &(0x7f00000005c0)=0x0, &(0x7f0000000600)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000680)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000700)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000740)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$uac2-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_open_dev$dvb_frontend-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000180)={0x14, &(0x7f0000000040)={0xf35109ed58237ec0, 0x6, 0x91, {0x91, 0x23, "bb7cbf29a7e7f1f6d4b4a1bf3af403a4d62b2515060210101577f26561dd5929341227759b028f3980fb2042e8f9f70b641b81712e9511a064ecd20a0d328533ac9bcbacd7389a58dc14cf6a17504f368a5e4b4ad2ac5b9255083a726b7311e6ead1f6b2c1fa2ae6bd6f0b900dc460f6345d2421201f0b7331541397401659658c7f4d996c7f0afedc129d4f4ed60b"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3801}}}, &(0x7f0000000440)={0x44, &(0x7f00000001c0)={0xc0, 0x5, 0x9f, "295b92c8f3a7719c8a9fbc4b94256a05bc5ad2a2a63f3f3486e19b9544173b20763b079e677fa8a536de27eec06c4c27492414974ff5e874d7ae41a9dcd8b05a581c3c1d2c313e01fd483efac00b806d0a92dae7a04d545b16599a3dda7a929b23864ac68dde06615f5111738533e3941ab09e902e6d65e590de96b12f97b537b37e8ec1ec5f2b61e3ffc2f48a30a0d92a58449fcf23cbcbfe580514b75ff1"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000300)={0x20, 0x81, 0x2, 'nr'}, &(0x7f0000000340)={0x20, 0x82, 0x2, "60b7"}, &(0x7f0000000380)={0x20, 0x83, 0x3, "bbc435"}, &(0x7f00000003c0)={0x20, 0x84, 0x1, '#'}, &(0x7f0000000400)={0x20, 0x85, 0x3, "2fa667"}}) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000004c0)={0x0, 0x30b5, 0x0, 0xfffffffe, 0x12c}, &(0x7f0000000580)=0x0, &(0x7f00000005c0)=0x0, &(0x7f0000000600)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000680)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000700)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000740)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-socket$kcm-socket$nl_netfilter-sendmsg$nl_xfrm-sendmsg$kcm-sendmsg$NFT_BATCH-socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$NFT_BATCH-sendmsg$kcm-sendmsg$nl_xfrm-openat$tun-sendmsg$nl_xfrm-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-prctl$PR_SET_IO_FLUSHER-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$nl_rdma-sendmsg$netlink-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_LEAVE_IBSS detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x8000) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000300)="d800000004021dff0010000000e8fe55a1180015000600144003600e1205875d000008000000000000000001402000", 0x2f}], 0x1}, 0x8800) sendmsg$NFT_BATCH(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=@updpolicy={0x17c, 0x19, 0x1, 0x3, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x5ee76b3ce2b5fd35}, [@tmpl={0xc4, 0x5, [{{@in6=@mcast2, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0xd1f}, {{@in6=@remote, 0x0, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, 0xa, @in6=@private1, 0x0, 0x5}]}]}, 0x17c}}, 0x40800) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$kcm(r1, &(0x7f00000006c0)={&(0x7f0000000700)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f0000000780)=[{&(0x7f00000007c0)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYRES32=0x0], 0xc4}}, 0x4c050) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048000}, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) (async) write$tun(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) prctl$PR_SET_IO_FLUSHER(0x34, 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000980)={0x114, 0x32, 0x1, 0x0, 0x0, "", [@nested={0x104, 0x5a, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64}, @generic='\x00\x00\x00\x00\x00\x00\x00', @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb47d96219c08c029d1608a487f26fbe816b89f7cb81bff81a8b7a82565856555ee923c65973deb0a96ae52bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875cf0d972df9e99f07976773f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fdc2f4393c05a007d12b505a84dfdb98d568175b62421d726d1e5331e1ddfd", @typed={0xc, 0x0, 0x0, 0x0, @u64=0x79}]}]}, 0x114}], 0x1}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x28, r7, 0x1, 0x70bd25, 0x25dfdc01, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_TTL={0x5, 0x6, 0x9}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x3404c816) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x1c, r7, 0x200, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20020000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-socket$kcm-socket$nl_netfilter-sendmsg$nl_xfrm-sendmsg$kcm-sendmsg$NFT_BATCH-socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$NFT_BATCH-sendmsg$kcm-sendmsg$nl_xfrm-openat$tun-sendmsg$nl_xfrm-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-prctl$PR_SET_IO_FLUSHER-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$nl_rdma-sendmsg$netlink-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_LEAVE_IBSS detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = socket$kcm(0xa, 0x3, 0x3a) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x8000) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000300)="d800000004021dff0010000000e8fe55a1180015000600144003600e1205875d000008000000000000000001402000", 0x2f}], 0x1}, 0x8800) sendmsg$NFT_BATCH(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=@updpolicy={0x17c, 0x19, 0x1, 0x3, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x5ee76b3ce2b5fd35}, [@tmpl={0xc4, 0x5, [{{@in6=@mcast2, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0xd1f}, {{@in6=@remote, 0x0, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, 0xa, @in6=@private1, 0x0, 0x5}]}]}, 0x17c}}, 0x40800) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$kcm(r1, &(0x7f00000006c0)={&(0x7f0000000700)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f0000000780)=[{&(0x7f00000007c0)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYRES32=0x0], 0xc4}}, 0x4c050) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048000}, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) (async) write$tun(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) prctl$PR_SET_IO_FLUSHER(0x34, 0xffffffffffffffff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000980)={0x114, 0x32, 0x1, 0x0, 0x0, "", [@nested={0x104, 0x5a, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64}, @generic='\x00\x00\x00\x00\x00\x00\x00', @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb47d96219c08c029d1608a487f26fbe816b89f7cb81bff81a8b7a82565856555ee923c65973deb0a96ae52bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875cf0d972df9e99f07976773f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fdc2f4393c05a007d12b505a84dfdb98d568175b62421d726d1e5331e1ddfd", @typed={0xc, 0x0, 0x0, 0x0, @u64=0x79}]}]}, 0x114}], 0x1}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x28, r7, 0x1, 0x70bd25, 0x25dfdc01, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_TTL={0x5, 0x6, 0x9}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x3404c816) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x1c, r7, 0x200, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20020000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-creat-mount-sendmsg$key-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) r1 = socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x40) mount(&(0x7f0000000200)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='cgroup2\x00', 0x4, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0xa, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xc0000000}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x10, 0x0, '4-'}]}, 0x60}, 0x1, 0x7}, 0x0) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected single: successfully extracted reproducer found reproducer with 10 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-creat-mount-sendmsg$key-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) r1 = socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x40) mount(&(0x7f0000000200)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='cgroup2\x00', 0x4, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0xa, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xc0000000}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x10, 0x0, '4-'}]}, 0x60}, 0x1, 0x7}, 0x0) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-creat-mount-sendmsg$key-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) r1 = socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x40) mount(&(0x7f0000000200)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='cgroup2\x00', 0x4, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0xa, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xc0000000}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x10, 0x0, '4-'}]}, 0x60}, 0x1, 0x7}, 0x0) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-creat-mount-sendmsg$key-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) r1 = socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x40) mount(&(0x7f0000000200)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='cgroup2\x00', 0x4, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0xa, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0xc0000000}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x10, 0x0, '4-'}]}, 0x60}, 0x1, 0x7}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-creat-mount-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x40) mount(&(0x7f0000000200)=@sg0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='cgroup2\x00', 0x4, 0x0) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-creat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x40) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-socket$key-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) socket$key(0xf, 0x3, 0x2) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-getsockopt-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f00000002c0)) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) socket(0x15, 0x5, 0x0) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f drivers/scsi/scsi_scan.c]: fork/exec scripts/get_maintainer.pl: no such file or directory program crashed: INFO: task hung in scsi_scan_host_selected testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program crashed: INFO: task hung in scsi_scan_host_selected extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program crashed: INFO: task hung in scsi_scan_host_selected validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program crashed: INFO: task hung in scsi_scan_host_selected validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0 - 0', 0x5) program crashed: INFO: task hung in scsi_scan_host_selected validation run: crashed=true reproducing took 3h8m35.660781816s repro crashed as (corrupted=false): INFO: task syz.8.25:6261 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.25 state:D stack:27592 pid:6261 tgid:6261 ppid:6219 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4aa/0x540 drivers/scsi/scsi_sysfs.c:191 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:1036 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0a39e559 RSP: 002b:00007ffe6f399bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3b0a625fa0 RCX: 00007f3b0a39e559 RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000003 RBP: 00007f3b0a435ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3b0a625fac R14: 00007f3b0a625fa0 R15: 00007f3b0a625fa0 Showing all locks held in the system: locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:11/4131: 3, last CPU#1: #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9168cce0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/1:3/5344: 3, on CPU#1: #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88807615e258 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1fd/0x3b0 drivers/net/netdevsim/fib.c:1490 locks held by getty/5367: 2, on CPU#1: #0: ffff8880367ab0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.7.24/6149: 7, on CPU#1: #0: ffff88802b974460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88802b974460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88806b926880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 #4: ffff888022bc82b8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4350 [inline] #4: ffff888022bc82b8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_init_allocated_queue+0x1011/0x13c0 block/blk-mq.c:4679 #5: ffff88802837dd80 (&q->q_usage_counter(io)#67){++++}-{0:0}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4359 [inline] #5: ffff88802837dd80 (&q->q_usage_counter(io)#67){++++}-{0:0}, at: blk_mq_init_allocated_queue+0x10b6/0x13c0 block/blk-mq.c:4679 #6: ffff88802837ddb8 (&q->q_usage_counter(queue)#50){++++}-{0:0}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4359 [inline] #6: ffff88802837ddb8 (&q->q_usage_counter(queue)#50){++++}-{0:0}, at: blk_mq_init_allocated_queue+0x10b6/0x13c0 block/blk-mq.c:4679 locks held by syz.8.25/6261: 4, on CPU#1: #0: ffff88802ab3a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88802ab3a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807753d480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.9.26/6420: 4, on CPU#0: #0: ffff888060a70460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888060a70460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888056b58880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.1.27/6474: 4, on CPU#1: #0: ffff8880237c6460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880237c6460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880555e0880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.0.28/6484: 4, on CPU#1: #0: ffff888079db8460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888079db8460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807ebf7480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.2.29/6634: 4, on CPU#0: #0: ffff88807769e460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88807769e460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880755e7080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.3.30/6686: 4, on CPU#0: #0: ffff8880761da460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880761da460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888056ac0480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.4.31/6753: 4, on CPU#1: #0: ffff888032ffe460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888032ffe460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888052dc9c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.6.32/6754: 4, on CPU#0: #0: ffff8880609f2460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880609f2460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888052852c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.5.33/6797: 4, on CPU#1: #0: ffff88806b33c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88806b33c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88805376f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.7.34/6840: 4, on CPU#1: #0: ffff888061a1a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888061a1a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888026ee1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.9.36/6927: 4, on CPU#1: #0: ffff888034b44460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888034b44460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804fd1bc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.8.35/6928: 4, on CPU#0: #0: ffff88805234c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88805234c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888053347c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.1.37/6965: 4, on CPU#1: #0: ffff888050e78460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888050e78460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804ec27480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.0.38/7000: 4, on CPU#1: #0: ffff888057d62460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888057d62460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888058fb1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.2.39/7072: 4, on CPU#0: #0: ffff888058156460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888058156460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88805699ec80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.3.40/7074: 4, on CPU#0: #0: ffff888035104460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888035104460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888055dd1080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.4.41/7115: 4, on CPU#0: #0: ffff888035778460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888035778460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804c778c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.6.42/7158: 4, on CPU#0: #0: ffff888036f24460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888036f24460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804f8bdc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.7.44/7241: 4, on CPU#1: #0: ffff88802d4a2460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88802d4a2460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a59a080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.5.43/7244: 4, on CPU#0: #0: ffff8880526a4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880526a4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a52b480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.8.45/7282: 4, on CPU#1: #0: ffff8880786c0460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880786c0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88802d4ee880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.9.46/7325: 4, on CPU#0: #0: ffff88806173a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88806173a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a528c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.1.47/7420: 4, on CPU#0: #0: ffff888034eac460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888034eac460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888046ca7080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.0.48/7421: 4, on CPU#0: #0: ffff888024aa4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888024aa4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888055aec880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.2.49/7439: 4, on CPU#1: #0: ffff888057360460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888057360460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804606ec80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.3.50/7477: 4, on CPU#1: #0: ffff888052382460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888052382460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a4e9c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.4.51/7574: 4, on CPU#1: #0: ffff888050096460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888050096460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888042c16480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.6.52/7622: 4, on CPU#1: #0: ffff88804536c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88804536c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804d004480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.5.53/7623: 4, on CPU#1: #0: ffff88805f6f4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88805f6f4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880575f4880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.7.54/7646: 4, on CPU#1: #0: ffff88801cb8c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88801cb8c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880420c5c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz-executor/7649: 1, last CPU#0: #0: ffffffff902b0930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline] #0: ffffffff902b0930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:320 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:425 Code: e8 ae 3c 3e fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 2f 11 b4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 RAX: 1ffffffff3842d00 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff858acaa0 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffffff9c216c40 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881233f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f117d81ae9c CR3: 000000007fa46000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:134 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:156 [inline] wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2036 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3294 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3369 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3520 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task syz.8.25:6261 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.25 state:D stack:27592 pid:6261 tgid:6261 ppid:6219 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4aa/0x540 drivers/scsi/scsi_sysfs.c:191 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:1036 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0a39e559 RSP: 002b:00007ffe6f399bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3b0a625fa0 RCX: 00007f3b0a39e559 RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000003 RBP: 00007f3b0a435ab8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3b0a625fac R14: 00007f3b0a625fa0 R15: 00007f3b0a625fa0 Showing all locks held in the system: locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9015a420 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:11/4131: 3, last CPU#1: #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000f167c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9168cce0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/1:3/5344: 3, on CPU#1: #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe12d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000367fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88807615e258 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1fd/0x3b0 drivers/net/netdevsim/fib.c:1490 locks held by getty/5367: 2, on CPU#1: #0: ffff8880367ab0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.7.24/6149: 7, on CPU#1: #0: ffff88802b974460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88802b974460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88806b926880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 #4: ffff888022bc82b8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4350 [inline] #4: ffff888022bc82b8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_init_allocated_queue+0x1011/0x13c0 block/blk-mq.c:4679 #5: ffff88802837dd80 (&q->q_usage_counter(io)#67){++++}-{0:0}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4359 [inline] #5: ffff88802837dd80 (&q->q_usage_counter(io)#67){++++}-{0:0}, at: blk_mq_init_allocated_queue+0x10b6/0x13c0 block/blk-mq.c:4679 #6: ffff88802837ddb8 (&q->q_usage_counter(queue)#50){++++}-{0:0}, at: blk_mq_add_queue_tag_set block/blk-mq.c:4359 [inline] #6: ffff88802837ddb8 (&q->q_usage_counter(queue)#50){++++}-{0:0}, at: blk_mq_init_allocated_queue+0x10b6/0x13c0 block/blk-mq.c:4679 locks held by syz.8.25/6261: 4, on CPU#1: #0: ffff88802ab3a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88802ab3a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807753d480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.9.26/6420: 4, on CPU#0: #0: ffff888060a70460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888060a70460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888056b58880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.1.27/6474: 4, on CPU#1: #0: ffff8880237c6460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880237c6460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880555e0880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.0.28/6484: 4, on CPU#1: #0: ffff888079db8460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888079db8460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807ebf7480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.2.29/6634: 4, on CPU#0: #0: ffff88807769e460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88807769e460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880755e7080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.3.30/6686: 4, on CPU#0: #0: ffff8880761da460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880761da460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888056ac0480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.4.31/6753: 4, on CPU#1: #0: ffff888032ffe460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888032ffe460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888052dc9c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.6.32/6754: 4, on CPU#0: #0: ffff8880609f2460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880609f2460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888052852c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.5.33/6797: 4, on CPU#1: #0: ffff88806b33c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88806b33c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88805376f880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.7.34/6840: 4, on CPU#1: #0: ffff888061a1a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888061a1a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888026ee1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.9.36/6927: 4, on CPU#1: #0: ffff888034b44460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888034b44460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804fd1bc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.8.35/6928: 4, on CPU#0: #0: ffff88805234c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88805234c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888053347c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.1.37/6965: 4, on CPU#1: #0: ffff888050e78460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888050e78460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804ec27480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.0.38/7000: 4, on CPU#1: #0: ffff888057d62460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888057d62460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888058fb1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.2.39/7072: 4, on CPU#0: #0: ffff888058156460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888058156460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88805699ec80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.3.40/7074: 4, on CPU#0: #0: ffff888035104460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888035104460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888055dd1080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.4.41/7115: 4, on CPU#0: #0: ffff888035778460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888035778460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804c778c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.6.42/7158: 4, on CPU#0: #0: ffff888036f24460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888036f24460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804f8bdc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.7.44/7241: 4, on CPU#1: #0: ffff88802d4a2460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88802d4a2460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a59a080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.5.43/7244: 4, on CPU#0: #0: ffff8880526a4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880526a4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a52b480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.8.45/7282: 4, on CPU#1: #0: ffff8880786c0460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff8880786c0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88802d4ee880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.9.46/7325: 4, on CPU#0: #0: ffff88806173a460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88806173a460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a528c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.1.47/7420: 4, on CPU#0: #0: ffff888034eac460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888034eac460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888046ca7080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.0.48/7421: 4, on CPU#0: #0: ffff888024aa4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888024aa4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888055aec880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.2.49/7439: 4, on CPU#1: #0: ffff888057360460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888057360460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804606ec80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.3.50/7477: 4, on CPU#1: #0: ffff888052382460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888052382460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804a4e9c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.4.51/7574: 4, on CPU#1: #0: ffff888050096460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff888050096460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888042c16480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.6.52/7622: 4, on CPU#1: #0: ffff88804536c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88804536c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804d004480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.5.53/7623: 4, on CPU#1: #0: ffff88805f6f4460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88805f6f4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880575f4880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz.7.54/7646: 4, on CPU#1: #0: ffff88801cb8c460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2760 [inline] #0: ffff88801cb8c460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880420c5c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff8880289911e8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffff888022bc80d0 (&shost->scan_mutex){+.+.}-{4:4}, at: scsi_scan_host_selected+0x19c/0x6c0 drivers/scsi/scsi_scan.c:1914 locks held by syz-executor/7649: 1, last CPU#0: #0: ffffffff902b0930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline] #0: ffffffff902b0930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:320 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:425 Code: e8 ae 3c 3e fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 2f 11 b4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 RAX: 1ffffffff3842d00 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: ffffffff858acaa0 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffffff9c216c40 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881233f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f117d81ae9c CR3: 000000007fa46000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:134 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:156 [inline] wait_for_lsr+0x184/0x2f0 drivers/tty/serial/8250/8250_port.c:2036 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3294 [inline] __serial8250_console_fifo_write+0xcd/0x3e0 drivers/tty/serial/8250/8250_port.c:3369 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline] serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3520 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline] nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245