Extracting prog: 2m13.304928533s
Minimizing prog: 4m36.915797877s
Simplifying prog options: 6m17.800071034s
Extracting C: 1m40.071497247s
Simplifying C: 0s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE
detailed listing:
executing program 0:
r0 = openat$sequencer2(0xffffff9c, &(0x7f0000004200), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
program crashed: WARNING in call_timer_fn
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=1m5.357443189s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2
detailed listing:
executing program 0:
openat$sequencer2(0xffffff9c, &(0x7f0000004200), 0x0, 0x0)
program did not crash
testing program (duration=1m5.357443189s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDCTL_TMR_CONTINUE
detailed listing:
executing program 0:
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)
program did not crash
testing program (duration=1m5.357443189s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE
detailed listing:
executing program 0:
r0 = openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
program did not crash
extracting C reproducer
testing compiled C program (duration=1m5.357443189s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE
program did not crash
simplifying guilty program options
testing program (duration=1m5.357443189s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE
detailed listing:
executing program 0:
r0 = openat$sequencer2(0xffffff9c, &(0x7f0000004200), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
program did not crash
testing program (duration=1m5.357443189s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sequencer2-ioctl$SNDCTL_TMR_CONTINUE
detailed listing:
executing program 0:
r0 = openat$sequencer2(0xffffff9c, &(0x7f0000004200), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)
program did not crash
reproducing took 14m48.092322498s
repro crashed as (corrupted=false):
------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci0
WARNING: CPU: 0 PID: 5136 at kernel/workqueue.c:2258 __queue_work+0xdf6/0x1090 kernel/workqueue.c:2256
Modules linked in:
CPU: 0 UID: 0 PID: 5136 Comm: kworker/u9:1 Not tainted 6.14.0-rc7-syzkaller-00179-gb3ee1e460951 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci1 hci_rx_work
RIP: 0010:__queue_work+0xdf6/0x1090 kernel/workqueue.c:2256
Code: e8 03 80 3c 28 00 74 08 4c 89 ff e8 b4 6c 9d 00 49 8b 37 49 81 c5 78 01 00 00 48 c7 c7 60 e7 29 8c 4c 89 ea e8 cb 6e f8 ff 90 <0f> 0b 90 90 e9 66 f4 ff ff e8 0c b4 38 00 90 0f 0b 90 e9 ad fc ff
RSP: 0018:ffffc90000007b08 EFLAGS: 00010046
RAX: 1871e5727f622200 RBX: 0000000000000100 RCX: ffff888035f40000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff81819d62 R09: 1ffffffff2077a2e
R10: dffffc0000000000 R11: fffffbfff2077a2f R12: 1ffff1100e221438
R13: ffff88807110a178 R14: 0000000000000008 R15: ffff8880227f0948
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f771c7a2008 CR3: 0000000024b76000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
call_timer_fn+0x187/0x650 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1835 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x695/0x8e0 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x996/0xeb0
Code: 48 21 c3 0f 85 16 02 00 00 e8 d6 ed 20 00 4c 8b 7c 24 10 4d 85 f6 75 07 e8 c7 ed 20 00 eb 06 e8 c0 ed 20 00 fb 48 8b 5c 24 18 <48> 8b 44 24 30 42 80 3c 28 00 74 08 48 89 df e8 26 a6 85 00 4c 8b
RSP: 0018:ffffc9001030f2c0 EFLAGS: 00000293
RAX: ffffffff81a0f260 RBX: ffffffff8f37a878 RCX: ffff888035f40000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9001030f470 R08: ffffffff81a0f237 R09: 1ffffffff28a2f26
R10: dffffc0000000000 R11: fffffbfff28a2f27 R12: ffffffff8f37a820
R13: dffffc0000000000 R14: 0000000000000200 R15: ffffc9001030f4c0
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
bt_warn+0x127/0x180 net/bluetooth/lib.c:276
hci_cc_func net/bluetooth/hci_event.c:4191 [inline]
hci_cmd_complete_evt+0x3ef/0x8b0 net/bluetooth/hci_event.c:4215
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0xa54/0x1540 net/bluetooth/hci_event.c:7532
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4019
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd30 kernel/workqueue.c:3400
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: 48 21 c3 and %rax,%rbx
3: 0f 85 16 02 00 00 jne 0x21f
9: e8 d6 ed 20 00 call 0x20ede4
e: 4c 8b 7c 24 10 mov 0x10(%rsp),%r15
13: 4d 85 f6 test %r14,%r14
16: 75 07 jne 0x1f
18: e8 c7 ed 20 00 call 0x20ede4
1d: eb 06 jmp 0x25
1f: e8 c0 ed 20 00 call 0x20ede4
24: fb sti
25: 48 8b 5c 24 18 mov 0x18(%rsp),%rbx
* 2a: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction
2f: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
34: 74 08 je 0x3e
36: 48 89 df mov %rbx,%rdi
39: e8 26 a6 85 00 call 0x85a664
3e: 4c rex.WR
3f: 8b .byte 0x8b
final repro crashed as (corrupted=false):
------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci0
WARNING: CPU: 0 PID: 5136 at kernel/workqueue.c:2258 __queue_work+0xdf6/0x1090 kernel/workqueue.c:2256
Modules linked in:
CPU: 0 UID: 0 PID: 5136 Comm: kworker/u9:1 Not tainted 6.14.0-rc7-syzkaller-00179-gb3ee1e460951 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci1 hci_rx_work
RIP: 0010:__queue_work+0xdf6/0x1090 kernel/workqueue.c:2256
Code: e8 03 80 3c 28 00 74 08 4c 89 ff e8 b4 6c 9d 00 49 8b 37 49 81 c5 78 01 00 00 48 c7 c7 60 e7 29 8c 4c 89 ea e8 cb 6e f8 ff 90 <0f> 0b 90 90 e9 66 f4 ff ff e8 0c b4 38 00 90 0f 0b 90 e9 ad fc ff
RSP: 0018:ffffc90000007b08 EFLAGS: 00010046
RAX: 1871e5727f622200 RBX: 0000000000000100 RCX: ffff888035f40000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff81819d62 R09: 1ffffffff2077a2e
R10: dffffc0000000000 R11: fffffbfff2077a2f R12: 1ffff1100e221438
R13: ffff88807110a178 R14: 0000000000000008 R15: ffff8880227f0948
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f771c7a2008 CR3: 0000000024b76000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
call_timer_fn+0x187/0x650 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1835 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x695/0x8e0 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x996/0xeb0
Code: 48 21 c3 0f 85 16 02 00 00 e8 d6 ed 20 00 4c 8b 7c 24 10 4d 85 f6 75 07 e8 c7 ed 20 00 eb 06 e8 c0 ed 20 00 fb 48 8b 5c 24 18 <48> 8b 44 24 30 42 80 3c 28 00 74 08 48 89 df e8 26 a6 85 00 4c 8b
RSP: 0018:ffffc9001030f2c0 EFLAGS: 00000293
RAX: ffffffff81a0f260 RBX: ffffffff8f37a878 RCX: ffff888035f40000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9001030f470 R08: ffffffff81a0f237 R09: 1ffffffff28a2f26
R10: dffffc0000000000 R11: fffffbfff28a2f27 R12: ffffffff8f37a820
R13: dffffc0000000000 R14: 0000000000000200 R15: ffffc9001030f4c0
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
bt_warn+0x127/0x180 net/bluetooth/lib.c:276
hci_cc_func net/bluetooth/hci_event.c:4191 [inline]
hci_cmd_complete_evt+0x3ef/0x8b0 net/bluetooth/hci_event.c:4215
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0xa54/0x1540 net/bluetooth/hci_event.c:7532
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4019
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd30 kernel/workqueue.c:3400
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: 48 21 c3 and %rax,%rbx
3: 0f 85 16 02 00 00 jne 0x21f
9: e8 d6 ed 20 00 call 0x20ede4
e: 4c 8b 7c 24 10 mov 0x10(%rsp),%r15
13: 4d 85 f6 test %r14,%r14
16: 75 07 jne 0x1f
18: e8 c7 ed 20 00 call 0x20ede4
1d: eb 06 jmp 0x25
1f: e8 c0 ed 20 00 call 0x20ede4
24: fb sti
25: 48 8b 5c 24 18 mov 0x18(%rsp),%rbx
* 2a: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction
2f: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
34: 74 08 je 0x3e
36: 48 89 df mov %rbx,%rdi
39: e8 26 a6 85 00 call 0x85a664
3e: 4c rex.WR
3f: 8b .byte 0x8b