Extracting prog: 5m0.614923296s Minimizing prog: 30m35.86703128s Simplifying prog options: 15m11.874165176s Extracting C: 5m12.357680825s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program crashed: INFO: task hung in uhid_char_release single: successfully extracted reproducer found reproducer with 2 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid detailed listing: executing program 0: openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write$UHID_CREATE detailed listing: executing program 0: write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', 0x0, 0x0, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program crashed: INFO: task hung in uhid_char_release extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program crashed: INFO: task hung in uhid_char_release validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program crashed: INFO: task hung in uhid_char_release validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001280)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000280)=""/4096, 0x1000, 0x2, 0x8, 0x0, 0x18c, 0x4}}, 0x120) program crashed: INFO: task hung in uhid_char_release validation run: crashed=true reproducing took 1h7m36.493265708s repro crashed as (corrupted=false): INFO: task syz.1.18:6035 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:26664 pid:6035 ppid:5924 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5380 [inline] __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699 schedule+0xbd/0x170 kernel/sched/core.c:6773 schedule_timeout+0x9b/0x280 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bd/0x590 kernel/sched/completion.c:148 __flush_work+0x895/0x9f0 kernel/workqueue.c:3430 __cancel_work_timer+0x3b0/0x520 kernel/workqueue.c:3517 uhid_dev_destroy drivers/hid/uhid.c:585 [inline] uhid_char_release+0xaf/0x600 drivers/hid/uhid.c:663 __fput+0x234/0x970 fs/file_table.c:384 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f3168b8eba9 RSP: 002b:00007ffface5ff28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 000000000002eb0f RCX: 00007f3168b8eba9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002ace6021f R10: 0000001b2e020000 R11: 0000000000000246 R12: 00007f3168dd5fac R13: 00007f3168dd5fa0 R14: ffffffffffffffff R15: 0000000000000003 INFO: task syz.2.19:6037 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:26664 pid:6037 ppid:5927 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5380 [inline] __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699 schedule+0xbd/0x170 kernel/sched/core.c:6773 schedule_timeout+0x9b/0x280 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bd/0x590 kernel/sched/completion.c:148 __flush_work+0x895/0x9f0 kernel/workqueue.c:3430 __cancel_work_timer+0x3b0/0x520 kernel/workqueue.c:3517 uhid_dev_destroy drivers/hid/uhid.c:585 [inline] uhid_char_release+0xaf/0x600 drivers/hid/uhid.c:663 __fput+0x234/0x970 fs/file_table.c:384 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7a5418eba9 RSP: 002b:00007fff59b5bd98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 000000000002f361 RCX: 00007f7a5418eba9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000259b5c08f R10: 0000001b2e220000 R11: 0000000000000246 R12: 00007f7a543d5fac R13: 00007f7a543d5fa0 R14: ffffffffffffffff R15: 0000000000000003 INFO: task syz.4.25:6084 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.25 state:D stack:27592 pid:6084 ppid:6039 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5380 [inline] __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699 schedule+0xbd/0x170 kernel/sched/core.c:6773 schedule_timeout+0x9b/0x280 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bd/0x590 kernel/sched/completion.c:148 __flush_work+0x895/0x9f0 kernel/workqueue.c:3430 __cancel_work_timer+0x3b0/0x520 kernel/workqueue.c:3517 final repro crashed as (corrupted=false): INFO: task syz.1.18:6035 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:26664 pid:6035 ppid:5924 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5380 [inline] __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699 schedule+0xbd/0x170 kernel/sched/core.c:6773 schedule_timeout+0x9b/0x280 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bd/0x590 kernel/sched/completion.c:148 __flush_work+0x895/0x9f0 kernel/workqueue.c:3430 __cancel_work_timer+0x3b0/0x520 kernel/workqueue.c:3517 uhid_dev_destroy drivers/hid/uhid.c:585 [inline] uhid_char_release+0xaf/0x600 drivers/hid/uhid.c:663 __fput+0x234/0x970 fs/file_table.c:384 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f3168b8eba9 RSP: 002b:00007ffface5ff28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 000000000002eb0f RCX: 00007f3168b8eba9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002ace6021f R10: 0000001b2e020000 R11: 0000000000000246 R12: 00007f3168dd5fac R13: 00007f3168dd5fa0 R14: ffffffffffffffff R15: 0000000000000003 INFO: task syz.2.19:6037 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:26664 pid:6037 ppid:5927 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5380 [inline] __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699 schedule+0xbd/0x170 kernel/sched/core.c:6773 schedule_timeout+0x9b/0x280 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bd/0x590 kernel/sched/completion.c:148 __flush_work+0x895/0x9f0 kernel/workqueue.c:3430 __cancel_work_timer+0x3b0/0x520 kernel/workqueue.c:3517 uhid_dev_destroy drivers/hid/uhid.c:585 [inline] uhid_char_release+0xaf/0x600 drivers/hid/uhid.c:663 __fput+0x234/0x970 fs/file_table.c:384 task_work_run+0x1ce/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7a5418eba9 RSP: 002b:00007fff59b5bd98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 000000000002f361 RCX: 00007f7a5418eba9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000259b5c08f R10: 0000001b2e220000 R11: 0000000000000246 R12: 00007f7a543d5fac R13: 00007f7a543d5fa0 R14: ffffffffffffffff R15: 0000000000000003 INFO: task syz.4.25:6084 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.25 state:D stack:27592 pid:6084 ppid:6039 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5380 [inline] __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699 schedule+0xbd/0x170 kernel/sched/core.c:6773 schedule_timeout+0x9b/0x280 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bd/0x590 kernel/sched/completion.c:148 __flush_work+0x895/0x9f0 kernel/workqueue.c:3430 __cancel_work_timer+0x3b0/0x520 kernel/workqueue.c:3517