Extracting prog: 1h2m25.855122514s Minimizing prog: 22m26.953621272s Simplifying prog options: 0s Extracting C: 4m45.649556612s Simplifying C: 31m50.706435681s extracting reproducer from 52 programs testing a last program of every proc single: executing 12 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vnet-ioctl$VHOST_SET_FEATURES-write$vhost_msg_v2-write$vhost_msg_v2-write$vhost_msg_v2-write$vhost_msg_v2 detailed listing: executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000280)={0x2, 0x0, {&(0x7f0000000740)=""/255, 0xff, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000039c0)={0x2, 0x0, {&(0x7f0000000680)=""/184, 0xfffffefd, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f0000000400)=""/185, 0xb9, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000e40)=""/187, 0xbb, 0x0, 0x2, 0x3}}, 0x48) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$fuse-openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_TIMER_IOCTL_START-mremap-ioctl$SNDRV_TIMER_IOCTL_PAUSE-open-ioctl$FIDEDUPERANGE-ioctl$SNDRV_TIMER_IOCTL_CONTINUE-connect$inet-ioctl$sock_SIOCGIFINDEX-socket$nl_netfilter-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-sendmsg$IPSET_CMD_ADD detailed listing: executing program 0: openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000400)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x0, &(0x7f000063c000/0x3000)=nil) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000100)={0x6}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x5422) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x9}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000280)={0x0, 0x224e, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000ffff00000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): execve-open-openat$fuse-mount$fuse-read$FUSE-write$FUSE_INIT-openat-dup2-fallocate detailed listing: executing program 0: execve(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r3 = dup2(r2, r0) fallocate(r3, 0x40, 0x8000000008, 0x10000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-openat$kvm-ioctl$KVM_CREATE_VM-socket$netlink-getsockopt$sock_cred-sendmsg$netlink-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_ENABLE-syz_kvm_setup_cpu$x86-ioctl$KVM_X86_SETUP_MCE-ioctl$KVM_RUN-syz_usb_connect-syz_usb_control_io$cdc_ncm-syz_init_net_socket$bt_hci-bind$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-syz_usb_control_io-accept4$bt_l2cap-getsockopt$bt_l2cap_L2CAP_OPTIONS-syz_open_dev$char_usb-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_IRQCHIP-ioctl$EVIOCGMASK detailed listing: executing program 0: r0 = syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r3, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000480)={0x17c, 0x2c, 0x1, 0x0, 0x25dfdbfe, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r4}, @nested={0x163, 0x2, 0x0, 0x1, [@generic="976b6408686030", @nested={0x158, 0x30, 0x0, 0x1, [@generic="b1ab4a3777752eb72aadc7c89145e4d288a18464b10e48fbb4ab96f0c1ba4d2409297615d5e84f3c4224c54b624693d78a6d87c4272a662839fb3a0eef54e55cb44a83123efebbbdc8c402e429a18d7e9caaa8fccb2f728e6d84bb2771", @generic="d470eabb2129102c68bbc67aeaec8594501983da8b56f7318fce73a601eb874d807d58ae0bf06b40c78b53bc3b730ad3fcbf6fd898d1e7c00ec0b9fd5d594d03dcaf2925cfb143eccfca1990cce2d3e8a1580e690e8a3589e514f2569de085622fd1859ff4ce8ff0b6b8a5d991808d9b4096bdcd1727360bb8711dddf1f229760576359c69f274e92670abaaaa06dc0dc2db10510aa32c74635787086ea5664d92123152d8f4dc578a80a703e29ba67c4660b57dd68924dc44cb944efad67c60c702ba361cf5655f0f3185c0b14799d4efb34a2ba00f141147642298d863f54e5852dfbff0a288f435d731", @typed={0xc, 0x61, 0x0, 0x0, @u64}]}]}]}, 0x17c}], 0x1, 0x0, 0x0, 0x2000c000}, 0xcc000) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000000c0)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900600000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000b9a6080000b800000100ba000000000f300f300fc79d53bf00000f015b00012202", 0x5a}], 0x1, 0xc, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000003000000580001800d0001007564703a73797a300000000044000400200001000a004e2400000044fe80000000000000000000000000002a37200000200002"], 0x6c}}, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000900)=[@text16={0x10, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_X86_SETUP_MCE(r5, 0x4008ae9c, &(0x7f0000000080)={0x4, 0x5, 0x7}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r8, 0x0, 0x0) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x4}, 0x6) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x4}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000380)={0x1f, 0x0, @none}, &(0x7f00000003c0)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r11, 0x6, 0x1, &(0x7f0000000400), &(0x7f0000000440)=0xc) r12 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r14, 0x4048aec9, &(0x7f0000000140)={0x6, 0x0, @ioapic={0x1000000, 0x4, 0x1, 0x0, 0x0, [{0x9, 0x0, 0x0, '\x00', 0xff}, {0xfd}, {0x0, 0x7}, {0x0, 0x0, 0x0, '\x00', 0xfd}, {}, {0x0, 0x0, 0xc6, '\x00', 0x1}, {0x0, 0x0, 0x0, '\x00', 0x2}, {0x1, 0x2, 0x0, '\x00', 0x80}, {0x0, 0x0, 0x0, '\x00', 0x4}, {0x9}, {0x40, 0x0, 0x40, '\x00', 0x24}, {}, {0x0, 0x0, 0x8}, {}, {0x0, 0x9, 0x4}, {0x0, 0x2, 0xb, '\x00', 0x20}, {}, {0x3, 0x0, 0x0, '\x00', 0xfc}, {0x20, 0x0, 0x4}, {0x0, 0x0, 0x0, '\x00', 0x7}, {0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, '\x00', 0xb}, {0x0, 0x9}, {0x0, 0x0, 0x40}]}}) ioctl$EVIOCGMASK(r12, 0x80015b11, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dsp-prlimit64-prctl$PR_SCHED_CORE-socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-setsockopt$sock_int-connect$inet-accept-sendmsg$TEAM_CMD_OPTIONS_SET-recvfrom detailed listing: executing program 0: openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x3, @empty, 0x1}, 0x1c) listen(r1, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000140)=0x7, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dsp-prlimit64-prctl$PR_SCHED_CORE-socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-setsockopt$sock_int-connect$inet-accept-sendmsg$TEAM_CMD_OPTIONS_SET-recvfrom detailed listing: executing program 0: openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x3, @empty, 0x1}, 0x1c) listen(r1, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000140)=0x7, 0x4) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sync-open-fcntl$setsig-fcntl$setlease-timer_create-timer_settime-truncate detailed listing: executing program 0: sync() r0 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setsig(r0, 0xa, 0x13) fcntl$setlease(r0, 0x400, 0x0) timer_create(0x0, &(0x7f00000005c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000280)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sync-open-fcntl$setsig-fcntl$setlease-timer_create-timer_settime-truncate detailed listing: executing program 0: sync() r0 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setsig(r0, 0xa, 0x13) fcntl$setlease(r0, 0x400, 0x0) timer_create(0x0, &(0x7f00000005c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000280)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap-madvise-mlock detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) program crashed: INFO: task hung in do_madvise single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap-madvise detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mremap detailed listing: executing program 0: mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) program crashed: INFO: task hung in exit_mm validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) program crashed: INFO: task hung in exit_mm validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mremap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeed, 0x8031, 0xffffffffffffffff, 0xf6d0f000) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) program crashed: INFO: task hung in exit_mm validation run: crashed=true reproducing took 2h15m0.639958251s repro crashed as (corrupted=false): INFO: task syz.0.16:6003 blocked for more than 143 seconds. Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.16 state:D stack:25096 pid:6003 tgid:6003 ppid:5956 task_flags:0x40004c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5351 [inline] __schedule+0x1737/0x4d30 kernel/sched/core.c:6954 __schedule_loop kernel/sched/core.c:7036 [inline] schedule+0x165/0x360 kernel/sched/core.c:7051 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7108 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1088 __down_read_common kernel/locking/rwsem.c:1263 [inline] __down_read kernel/locking/rwsem.c:1276 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1541 mmap_read_lock include/linux/mmap_lock.h:412 [inline] exit_mm+0xcc/0x2c0 kernel/exit.c:557 do_exit+0x648/0x2300 kernel/exit.c:947 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100 __do_sys_exit_group kernel/exit.c:1111 [inline] __se_sys_exit_group kernel/exit.c:1109 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1109 x64_sys_call+0x21f7/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0f78e9a9 RSP: 002b:00007fff016dbba8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b0f78e9a9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 00000002016dbc9f R09: 00007f3b0f980260 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3b0f980260 R14: 0000000000000003 R15: 00007fff016dbc60 INFO: task syz.0.16:6004 blocked for more than 144 seconds. Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.16 state:D stack:25864 pid:6004 tgid:6003 ppid:5956 task_flags:0x40044c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5351 [inline] __schedule+0x1737/0x4d30 kernel/sched/core.c:6954 __schedule_loop kernel/sched/core.c:7036 [inline] schedule+0x165/0x360 kernel/sched/core.c:7051 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7108 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1088 __down_read_common kernel/locking/rwsem.c:1263 [inline] __down_read kernel/locking/rwsem.c:1276 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1541 mmap_read_lock include/linux/mmap_lock.h:412 [inline] exit_mm+0xcc/0x2c0 kernel/exit.c:557 do_exit+0x648/0x2300 kernel/exit.c:947 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100 get_signal+0x1286/0x1340 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:208 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0f78e9a9 RSP: 002b:00007f3b1067d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3b0f9b5fa8 RCX: 00007f3b0f78e9a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3b0f9b5fa8 RBP: 00007f3b0f9b5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3b0f9b5fac R13: 0000000000000000 R14: 00007fff016db760 R15: 00007fff016db848 Showing all locks held in the system: 3 locks held by kworker/u8:1/13: 1 lock held by khungtaskd/31: #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 3 locks held by kworker/u8:7/1154: #0: ffff88802f83a948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88802f83a948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319 #1: ffffc90003e07bc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc90003e07bc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319 #2: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 net/ipv6/addrconf.c:4189 2 locks held by getty/5610: #0: ffff88814d88d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 1 lock held by syz.0.16/6003: #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.0.16/6004: #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 2 locks held by syz.0.16/6005: 1 lock held by syz.1.17/6030: #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.1.17/6031: #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 2 locks held by syz.1.17/6032: 1 lock held by syz.2.18/6060: #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.2.18/6061: #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.2.18/6062: 1 lock held by syz.3.19/6084: #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.3.19/6085: #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.3.19/6086: 1 lock held by syz.4.20/6117: #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.4.20/6118: #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.4.20/6119: 1 lock held by syz.5.21/6155: #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.5.21/6156: #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 2 locks held by syz.5.21/6157: 1 lock held by syz.6.22/6187: #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.6.22/6188: #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.6.22/6189: 3 locks held by syz-executor/6192: #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4056 #1: ffff88805de80d28 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2757 [inline] #1: ffff88805de80d28 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #1: ffff88805de80d28 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: do_setlink+0x388/0x41c0 net/core/rtnetlink.c:3053 #2: ffffffff8e543338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #2: ffffffff8e543338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:967 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline] watchdog+0xf93/0xfe0 kernel/hung_task.c:491 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6189 Comm: syz.6.22 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:stack_trace_consume_entry+0x129/0x280 kernel/stacktrace.c:95 Code: 89 c5 e8 aa ba 76 00 49 89 e8 4c 89 e2 48 89 de 49 89 37 41 8b 18 41 0f b6 44 15 00 84 c0 0f 85 34 01 00 00 41 3b 1e 0f 92 c0 <48> 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d e9 44 c2 d5 09 cc 44 89 RSP: 0018:ffffc90000007758 EFLAGS: 00000287 RAX: 0000000000000001 RBX: 000000000000000f RCX: 1a987d52ba764400 RDX: dffffc0000000000 RSI: ffffffff8223185e RDI: ffffc90000007860 RBP: 1ffff92000000f0e R08: ffffc90000007870 R09: 000000000000000e R10: ffffc900000077f8 R11: ffffffff81ac9660 R12: 0000000000000000 R13: 1ffff92000000f0d R14: ffffc90000007868 R15: ffffc90000007960 FS: 00007f26114736c0(0000) GS:ffff8881257ab000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005631ca798a58 CR3: 0000000030714000 CR4: 00000000003526f0 Call Trace: arch_stack_walk+0x10d/0x150 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kfree+0x18e/0x440 mm/slub.c:4879 slab_free_after_rcu_debug+0x60/0x2a0 mm/slub.c:4717 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca5/0x1710 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:stack_trace_consume_entry+0x4/0x280 kernel/stacktrace.c:83 Code: 65 f0 5b 41 5e 5d e9 9b c3 d5 09 cc e8 e5 dd d2 09 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900041c72a0 EFLAGS: 00000286 RAX: ffffffff81000130 RBX: ffffc900041c7360 RCX: 1a987d52ba764400 RDX: 0000000000000001 RSI: ffffffff81000130 RDI: ffffc900041c7360 RBP: ffffc900041c7330 R08: ffffc900041c7f48 R09: 0000000000000000 R10: ffffc900041c72f8 R11: ffffffff81ac9660 R12: ffff888026dd9e00 R13: ffff88805f5b3ec0 R14: ffffffff81ac9660 R15: ffffc900041c72a8 arch_stack_walk+0x10d/0x150 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396 kmalloc_noprof include/linux/slab.h:905 [inline] slab_free_hook mm/slub.c:2369 [inline] slab_free mm/slub.c:4680 [inline] kmem_cache_free+0x166/0x400 mm/slub.c:4782 remove_vma mm/vma.c:468 [inline] vms_complete_munmap_vmas+0x626/0x8a0 mm/vma.c:1293 do_vmi_align_munmap+0x358/0x420 mm/vma.c:1536 do_vmi_munmap+0x253/0x2e0 mm/vma.c:1584 do_munmap+0xe1/0x140 mm/mmap.c:1068 mremap_to+0x2df/0x7a0 mm/mremap.c:1368 remap_move mm/mremap.c:1863 [inline] do_mremap mm/mremap.c:1906 [inline] __do_sys_mremap mm/mremap.c:1970 [inline] __se_sys_mremap+0xa0b/0xef0 mm/mremap.c:1938 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f261058e9a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2611473038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007f26107b6080 RCX: 00007f261058e9a9 RDX: 0000000000600002 RSI: 0000000000600002 RDI: 0000200000000000 RBP: 00007f2610610d69 R08: 0000200000a00000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f26107b6080 R15: 00007ffd72147b38 final repro crashed as (corrupted=false): INFO: task syz.0.16:6003 blocked for more than 143 seconds. Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.16 state:D stack:25096 pid:6003 tgid:6003 ppid:5956 task_flags:0x40004c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5351 [inline] __schedule+0x1737/0x4d30 kernel/sched/core.c:6954 __schedule_loop kernel/sched/core.c:7036 [inline] schedule+0x165/0x360 kernel/sched/core.c:7051 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7108 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1088 __down_read_common kernel/locking/rwsem.c:1263 [inline] __down_read kernel/locking/rwsem.c:1276 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1541 mmap_read_lock include/linux/mmap_lock.h:412 [inline] exit_mm+0xcc/0x2c0 kernel/exit.c:557 do_exit+0x648/0x2300 kernel/exit.c:947 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100 __do_sys_exit_group kernel/exit.c:1111 [inline] __se_sys_exit_group kernel/exit.c:1109 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1109 x64_sys_call+0x21f7/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0f78e9a9 RSP: 002b:00007fff016dbba8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b0f78e9a9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 00000002016dbc9f R09: 00007f3b0f980260 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3b0f980260 R14: 0000000000000003 R15: 00007fff016dbc60 INFO: task syz.0.16:6004 blocked for more than 144 seconds. Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.16 state:D stack:25864 pid:6004 tgid:6003 ppid:5956 task_flags:0x40044c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5351 [inline] __schedule+0x1737/0x4d30 kernel/sched/core.c:6954 __schedule_loop kernel/sched/core.c:7036 [inline] schedule+0x165/0x360 kernel/sched/core.c:7051 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7108 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1088 __down_read_common kernel/locking/rwsem.c:1263 [inline] __down_read kernel/locking/rwsem.c:1276 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1541 mmap_read_lock include/linux/mmap_lock.h:412 [inline] exit_mm+0xcc/0x2c0 kernel/exit.c:557 do_exit+0x648/0x2300 kernel/exit.c:947 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100 get_signal+0x1286/0x1340 kernel/signal.c:3034 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:208 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3b0f78e9a9 RSP: 002b:00007f3b1067d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f3b0f9b5fa8 RCX: 00007f3b0f78e9a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3b0f9b5fa8 RBP: 00007f3b0f9b5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3b0f9b5fac R13: 0000000000000000 R14: 00007fff016db760 R15: 00007fff016db848 Showing all locks held in the system: 3 locks held by kworker/u8:1/13: 1 lock held by khungtaskd/31: #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 3 locks held by kworker/u8:7/1154: #0: ffff88802f83a948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88802f83a948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319 #1: ffffc90003e07bc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc90003e07bc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319 #2: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 net/ipv6/addrconf.c:4189 2 locks held by getty/5610: #0: ffff88814d88d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 1 lock held by syz.0.16/6003: #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.0.16/6004: #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ca220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 2 locks held by syz.0.16/6005: 1 lock held by syz.1.17/6030: #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.1.17/6031: #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e48ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 2 locks held by syz.1.17/6032: 1 lock held by syz.2.18/6060: #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.2.18/6061: #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880294781e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.2.18/6062: 1 lock held by syz.3.19/6084: #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.3.19/6085: #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88807f6401e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.3.19/6086: 1 lock held by syz.4.20/6117: #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.4.20/6118: #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888026e4ed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.4.20/6119: 1 lock held by syz.5.21/6155: #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.5.21/6156: #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296c9760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 2 locks held by syz.5.21/6157: 1 lock held by syz.6.22/6187: #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.6.22/6188: #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880296ced60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.6.22/6189: 3 locks held by syz-executor/6192: #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f938688 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4056 #1: ffff88805de80d28 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2757 [inline] #1: ffff88805de80d28 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline] #1: ffff88805de80d28 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: do_setlink+0x388/0x41c0 net/core/rtnetlink.c:3053 #2: ffffffff8e543338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #2: ffffffff8e543338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:967 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline] watchdog+0xf93/0xfe0 kernel/hung_task.c:491 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6189 Comm: syz.6.22 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:stack_trace_consume_entry+0x129/0x280 kernel/stacktrace.c:95 Code: 89 c5 e8 aa ba 76 00 49 89 e8 4c 89 e2 48 89 de 49 89 37 41 8b 18 41 0f b6 44 15 00 84 c0 0f 85 34 01 00 00 41 3b 1e 0f 92 c0 <48> 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d e9 44 c2 d5 09 cc 44 89 RSP: 0018:ffffc90000007758 EFLAGS: 00000287 RAX: 0000000000000001 RBX: 000000000000000f RCX: 1a987d52ba764400 RDX: dffffc0000000000 RSI: ffffffff8223185e RDI: ffffc90000007860 RBP: 1ffff92000000f0e R08: ffffc90000007870 R09: 000000000000000e R10: ffffc900000077f8 R11: ffffffff81ac9660 R12: 0000000000000000 R13: 1ffff92000000f0d R14: ffffc90000007868 R15: ffffc90000007960 FS: 00007f26114736c0(0000) GS:ffff8881257ab000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005631ca798a58 CR3: 0000000030714000 CR4: 00000000003526f0 Call Trace: arch_stack_walk+0x10d/0x150 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kfree+0x18e/0x440 mm/slub.c:4879 slab_free_after_rcu_debug+0x60/0x2a0 mm/slub.c:4717 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca5/0x1710 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:stack_trace_consume_entry+0x4/0x280 kernel/stacktrace.c:83 Code: 65 f0 5b 41 5e 5d e9 9b c3 d5 09 cc e8 e5 dd d2 09 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc900041c72a0 EFLAGS: 00000286 RAX: ffffffff81000130 RBX: ffffc900041c7360 RCX: 1a987d52ba764400 RDX: 0000000000000001 RSI: ffffffff81000130 RDI: ffffc900041c7360 RBP: ffffc900041c7330 R08: ffffc900041c7f48 R09: 0000000000000000 R10: ffffc900041c72f8 R11: ffffffff81ac9660 R12: ffff888026dd9e00 R13: ffff88805f5b3ec0 R14: ffffffff81ac9660 R15: ffffc900041c72a8 arch_stack_walk+0x10d/0x150 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4396 kmalloc_noprof include/linux/slab.h:905 [inline] slab_free_hook mm/slub.c:2369 [inline] slab_free mm/slub.c:4680 [inline] kmem_cache_free+0x166/0x400 mm/slub.c:4782 remove_vma mm/vma.c:468 [inline] vms_complete_munmap_vmas+0x626/0x8a0 mm/vma.c:1293 do_vmi_align_munmap+0x358/0x420 mm/vma.c:1536 do_vmi_munmap+0x253/0x2e0 mm/vma.c:1584 do_munmap+0xe1/0x140 mm/mmap.c:1068 mremap_to+0x2df/0x7a0 mm/mremap.c:1368 remap_move mm/mremap.c:1863 [inline] do_mremap mm/mremap.c:1906 [inline] __do_sys_mremap mm/mremap.c:1970 [inline] __se_sys_mremap+0xa0b/0xef0 mm/mremap.c:1938 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f261058e9a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2611473038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007f26107b6080 RCX: 00007f261058e9a9 RDX: 0000000000600002 RSI: 0000000000600002 RDI: 0000200000000000 RBP: 00007f2610610d69 R08: 0000200000a00000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f26107b6080 R15: 00007ffd72147b38