Extracting prog: 5m10.234652712s Minimizing prog: 54m49.34034814s Simplifying prog options: 14m32.928775645s Extracting C: 5m11.280251785s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program crashed: INFO: task hung in bdev_release single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, 0xffffffffffffffff) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(0xffffffffffffffff, 0xab00, r1) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x3) r0 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_DO_IT(r0, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, 0xffffffffffffffff) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program crashed: INFO: task hung in bdev_release extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program crashed: INFO: task hung in bdev_release validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program crashed: INFO: task hung in bdev_release validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ndb-ioctl$NBD_SET_SIZE_BLOCKS-syz_open_dev$ndb-socketpair$nbd-ioctl$NBD_SET_SOCK-ioctl$NBD_DO_IT detailed listing: executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x3) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) program crashed: INFO: task hung in bdev_release validation run: crashed=true reproducing took 1h29m14.815744172s repro crashed as (corrupted=false): INFO: task syz.0.17:5991 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27832 pid:5991 tgid:5991 ppid:5943 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x1139/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776 bdev_release+0x15a/0x6d0 block/bdev.c:1145 blkdev_release+0x15/0x20 block/fops.c:706 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb4bb78f749 RSP: 002b:00007ffcb518dba8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fb4bb9e7da0 RCX: 00007fb4bb78f749 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fb4bb9e7da0 R08: 0000000000000000 R09: 00000006b518de9f R10: 00007fb4bb9e7cb0 R11: 0000000000000246 R12: 0000000000022c12 R13: 00007ffcb518dca0 R14: ffffffffffffffff R15: 00007ffcb518dcc0 INFO: task syz.0.17:5992 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27576 pid:5992 tgid:5991 ppid:5943 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x1139/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776 bdev_release+0x15a/0x6d0 block/bdev.c:1145 blkdev_release+0x15/0x20 block/fops.c:706 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb4bb78f749 RSP: 002b:00007fb4bc611038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007fb4bb9e5fa0 RCX: 00007fb4bb78f749 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 RBP: 00007fb4bb813f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb4bb9e6038 R14: 00007fb4bb9e5fa0 R15: 00007ffcb518da48 Showing all locks held in the system: 3 locks held by kworker/u8:0/12: #0: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:639 #1: ffff8880b8424608 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline] #1: ffff8880b8424608 (psi_seq){-.-.}-{0:0}, at: __schedule+0x19b1/0x6150 kernel/sched/core.c:6857 #2: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: nsim_dev_trap_report_work+0x56/0xcf0 drivers/net/netdevsim/dev.c:908 1 lock held by khungtaskd/31: #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775 2 locks held by getty/5576: #0: ffff88814d7650a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x1510 drivers/tty/n_tty.c:2211 1 lock held by udevd/5844: #0: ffff8880266cb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by udevd/5845: #0: ffff8880266cd358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.0.17/5991: #0: ffff8880266cb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.0.17/5992: #0: ffff8880266cb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.1.18/6013: #0: ffff8880266cd358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.1.18/6014: #0: ffff8880266cd358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6024: #0: ffff8880266cf358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.2.19/6041: #0: ffff8880266cf358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.2.19/6042: #0: ffff8880266cf358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6046: #0: ffff888026c19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.3.20/6063: #0: ffff888026c19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.3.20/6064: #0: ffff888026c19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6068: #0: ffff888141b29358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.4.21/6092: #0: ffff888141b29358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.4.21/6094: #0: ffff888141b29358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6099: #0: ffff888026c1d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.5.22/6122: #0: ffff888026c1d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.5.22/6123: #0: ffff888026c1d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6133: #0: ffff888026d83358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.6.23/6156: #0: ffff888026d83358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.6.23/6158: #0: ffff888026d83358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6162: #0: ffff888026d87358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by udevd/6163: #0: ffff888026de9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.7.24/6187: #0: ffff888026de9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.7.24/6188: #0: ffff888026de9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.8.25/6215: #0: ffff888026d87358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.8.25/6216: #0: ffff888026d87358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6217: #0: ffff888141b31358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.9.26/6244: #0: ffff888141b31358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.9.26/6245: #0: ffff888141b31358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x133/0x180 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xe66/0x1180 kernel/hung_task.c:515 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6204 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:417 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 4b 6d b0 f5 cc RSP: 0018:ffffc900040ef280 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc900040ef368 RCX: ffffc900040f0000 RDX: ffffc900040ef2d8 RSI: ffff88802c6a8000 RDI: ffffc900040ef288 RBP: ffff88802c6a8000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc900040ef2d8 R11: ffff88802c6a8b30 R12: ffffc900040ef288 R13: ffffc900040ef2f8 R14: ffffc900040ef2d8 R15: ffffc900040ef300 FS: 0000000000000000(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558f83a5d168 CR3: 000000001f72c000 CR4: 00000000003526f0 Call Trace: __unwind_start+0x3f6/0x7f0 arch/x86/kernel/unwind_orc.c:742 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0x73/0x100 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof+0x33d/0x910 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ieee802_11_parse_elems_full+0x1db/0x3780 net/mac80211/parse.c:1031 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2469 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1571 [inline] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 net/mac80211/ibss.c:1602 ieee80211_iface_process_skb net/mac80211/iface.c:1736 [inline] ieee80211_iface_work+0xe28/0x1350 net/mac80211/iface.c:1790 cfg80211_wiphy_work+0x3fb/0x560 net/wireless/core.c:438 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 final repro crashed as (corrupted=false): INFO: task syz.0.17:5991 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27832 pid:5991 tgid:5991 ppid:5943 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x1139/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776 bdev_release+0x15a/0x6d0 block/bdev.c:1145 blkdev_release+0x15/0x20 block/fops.c:706 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb4bb78f749 RSP: 002b:00007ffcb518dba8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fb4bb9e7da0 RCX: 00007fb4bb78f749 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fb4bb9e7da0 R08: 0000000000000000 R09: 00000006b518de9f R10: 00007fb4bb9e7cb0 R11: 0000000000000246 R12: 0000000000022c12 R13: 00007ffcb518dca0 R14: ffffffffffffffff R15: 00007ffcb518dcc0 INFO: task syz.0.17:5992 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.17 state:D stack:27576 pid:5992 tgid:5991 ppid:5943 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x1139/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc69/0x1ca0 kernel/locking/mutex.c:776 bdev_release+0x15a/0x6d0 block/bdev.c:1145 blkdev_release+0x15/0x20 block/fops.c:706 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb4bb78f749 RSP: 002b:00007fb4bc611038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007fb4bb9e5fa0 RCX: 00007fb4bb78f749 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 RBP: 00007fb4bb813f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb4bb9e6038 R14: 00007fb4bb9e5fa0 R15: 00007ffcb518da48 Showing all locks held in the system: 3 locks held by kworker/u8:0/12: #0: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:639 #1: ffff8880b8424608 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline] #1: ffff8880b8424608 (psi_seq){-.-.}-{0:0}, at: __schedule+0x19b1/0x6150 kernel/sched/core.c:6857 #2: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: nsim_dev_trap_report_work+0x56/0xcf0 drivers/net/netdevsim/dev.c:908 1 lock held by khungtaskd/31: #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775 2 locks held by getty/5576: #0: ffff88814d7650a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x1510 drivers/tty/n_tty.c:2211 1 lock held by udevd/5844: #0: ffff8880266cb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by udevd/5845: #0: ffff8880266cd358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.0.17/5991: #0: ffff8880266cb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.0.17/5992: #0: ffff8880266cb358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.1.18/6013: #0: ffff8880266cd358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.1.18/6014: #0: ffff8880266cd358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6024: #0: ffff8880266cf358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.2.19/6041: #0: ffff8880266cf358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.2.19/6042: #0: ffff8880266cf358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6046: #0: ffff888026c19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.3.20/6063: #0: ffff888026c19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.3.20/6064: #0: ffff888026c19358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6068: #0: ffff888141b29358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.4.21/6092: #0: ffff888141b29358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.4.21/6094: #0: ffff888141b29358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6099: #0: ffff888026c1d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.5.22/6122: #0: ffff888026c1d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.5.22/6123: #0: ffff888026c1d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6133: #0: ffff888026d83358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.6.23/6156: #0: ffff888026d83358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.6.23/6158: #0: ffff888026d83358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6162: #0: ffff888026d87358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by udevd/6163: #0: ffff888026de9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.7.24/6187: #0: ffff888026de9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.7.24/6188: #0: ffff888026de9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.8.25/6215: #0: ffff888026d87358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.8.25/6216: #0: ffff888026d87358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by udevd/6217: #0: ffff888141b31358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:962 1 lock held by syz.9.26/6244: #0: ffff888141b31358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 1 lock held by syz.9.26/6245: #0: ffff888141b31358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1145 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x133/0x180 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xe66/0x1180 kernel/hung_task.c:515 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6204 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:417 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 4b 6d b0 f5 cc RSP: 0018:ffffc900040ef280 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc900040ef368 RCX: ffffc900040f0000 RDX: ffffc900040ef2d8 RSI: ffff88802c6a8000 RDI: ffffc900040ef288 RBP: ffff88802c6a8000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc900040ef2d8 R11: ffff88802c6a8b30 R12: ffffc900040ef288 R13: ffffc900040ef2f8 R14: ffffc900040ef2d8 R15: ffffc900040ef300 FS: 0000000000000000(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558f83a5d168 CR3: 000000001f72c000 CR4: 00000000003526f0 Call Trace: __unwind_start+0x3f6/0x7f0 arch/x86/kernel/unwind_orc.c:742 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0x73/0x100 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof+0x33d/0x910 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ieee802_11_parse_elems_full+0x1db/0x3780 net/mac80211/parse.c:1031 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2469 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1571 [inline] ieee80211_ibss_rx_queued_mgmt+0xc85/0x2fc0 net/mac80211/ibss.c:1602 ieee80211_iface_process_skb net/mac80211/iface.c:1736 [inline] ieee80211_iface_work+0xe28/0x1350 net/mac80211/iface.c:1790 cfg80211_wiphy_work+0x3fb/0x560 net/wireless/core.c:438 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246