Extracting prog: 31m31.426905282s Minimizing prog: 1h54m34.603949295s Simplifying prog options: 13m4.124809036s Extracting C: 3m46.736140201s Simplifying C: 22m42.695035709s extracting reproducer from 52 programs testing a last program of every proc single: executing 12 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun detailed listing: executing program 0: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100ab5a0000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4024}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd0000120000000000000060fc03000f983b00fe8000000000000000000000000000aaff0200000000000000000000000000013a"], 0xfce) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-mkdir-futex-futex-capset-syz_open_dev$sg-ioctl$SG_IO-mount-mount$overlay-openat-creat-pipe2$9p-write$P9_RVERSION-dup-write$FUSE_BMAP-openat$ocfs2_control-ioctl$BTRFS_IOC_START_SYNC-fsconfig$FSCONFIG_SET_FD-write$FUSE_DIRENTPLUS-mount$9p_fd-chown-fsync-openat$rnullb-sendfile detailed listing: executing program 0: unshare(0x22020600) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0x80) futex(&(0x7f000000cffc), 0x5, 0x300, 0x0, &(0x7f00000000c0), 0x1000000) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103001) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0xfffffffffffffffc, 0x6, 0xb0, @scatter={0x0, 0x40000000, 0x0}, &(0x7f0000000280)="35c5264913cd", 0x0, 0x3, 0x10000, 0x22, 0x0}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='cgroup2\x00', 0x4, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) r5 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000180)) fsconfig$FSCONFIG_SET_FD(r5, 0x5, 0x0, 0x0, 0xffffffffffffffff) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@access_uid}]}}) chown(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) fsync(r1) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) sendfile(r6, r6, 0x0, 0x7ffff000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_io_uring_setup-mmap-socketpair$unix-connect$unix-sendmmsg$unix-mount$9p_fd-openat$rnullb-mmap-renameat2-setns-madvise-madvise-mlock detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x140, 0x0) r1 = syz_io_uring_setup(0x2421, &(0x7f0000000380)={0x0, 0x0, 0x13090}, &(0x7f0000000100), &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r4, 0xf6486000) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000200)='.\x02\x00', 0x0) setns(r0, 0x8000000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$rnullb-syz_usb_connect-ioctl$BLKTRACESETUP-fcntl$lock-syz_usb_connect-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io-openat$nullb-dup-syz_usb_control_io$printer-socket$nl_generic-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_NEW_DAEMON-write$6lowpan_enable-mmap detailed listing: executing program 0: r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x80, 0x10001, 0x0, 0x4, 0x10000, 0x0}) fcntl$lock(r0, 0xa0c876495213352e, &(0x7f0000000040)={0x2, 0x4, 0xb3, 0xe0a, r1}) r2 = syz_usb_connect(0x2, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000d972a440b72040155ab7010203010902120001000000000904800000ff"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f0000000180)={0x1c, &(0x7f0000000680)={0x0, 0xf, 0x45, "488b99a4fcf7d4be429204ad08469ec848914366ecba648473cb3173282a1fd832ccc8d184a0295cba3c5b52c8a6a268895238ff7467ec8cf900"/69}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000240)=ANY=[@ANYBLOB="2018080000df96beb7002580c6d9"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = dup(r3) syz_usb_control_io$printer(r2, &(0x7f0000000280)={0x14, &(0x7f00000005c0)={0x0, 0x3, 0x4c, {0x4c, 0xa, "0a51a4230637eef2312c04f02da6ffc5500c1f826c8cc4f728b16bb52b86407396f7c4a2f91c987b0f466eb6a86980efa592702d2ea778f00a181b75807da522ad40754a5fa371225ee2"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x500a}}}, &(0x7f0000000580)={0x34, &(0x7f00000002c0)={0x0, 0xe, 0xd6, "18b0db1f35b7ecf55e435304c98e6880e76d3d82b03563a69d9892e2fe2264ba35ce5c679ca82ef0c7e61c7112767b6148e4c1926bcf8f144589a830e055a3803a66266bf3a0782b6f4dadd561be44446e097153afd0c21438b2ff6ff6735dd1d4bbff3a979295ddc1827419348a773e62710d2ce3c7fa10ae55a40aadd31e3188bce4bc477876401a8199ace581f25361f5db1bde616bdb46d8e73c3c4eef69fc64439ceec2560b8ad58c608bbbaa45a115ea9599e7c88541707fe6905869b6b090a5c4ff99cd63b37443f849317a6fe5b0f54eff5d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x7f}, &(0x7f0000000440)={0x20, 0x0, 0x44, {0x42, "f0ab6b0820b2ec7b971eb84ae7582a8b610767f9ab8c6c9a0313fc5325a1cfc487df53273eb21f3ece26a9b663358fd2e814433165333b3deedf21515fe0e37bd472"}}, &(0x7f00000004c0)={0x20, 0x1, 0x1, 0x7}, &(0x7f0000000500)={0x20, 0x0, 0x1, 0x40}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x50, r6, 0x1, 0x4, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg2\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}]}, 0x50}}, 0x40) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) mmap(&(0x7f0000243000/0x1000)=nil, 0x1000, 0x0, 0x100010, r0, 0xa471a000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix-socketpair$unix-setsockopt$SO_ATTACH_FILTER-recvmmsg-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_SYNC_PTR-mmap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) (async) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r5, 0x80000}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r9, @ANYRES16=r8, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r9, @ANYRES32=r4, @ANYRESOCT=r5, @ANYRESOCT=r9], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r6, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r12 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r12, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r11, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) setsockopt$SO_ATTACH_FILTER(r13, 0x1, 0x54, 0x0, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r14 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r14, 0xc1004110, &(0x7f0000000040)={0x0, "8dd2356a9ebb85c49090d8e7251a8f47261a8f4797bf8ba7ff669b27d2af3ae0d402a46e4e967621c2c9fd4f42a31536849f6717859f6717c7862a799260eda3"}) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r3, 0x2000) (rerun: 32) program crashed: INFO: task hung in exit_mm single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix-socketpair$unix-setsockopt$SO_ATTACH_FILTER-recvmmsg-syz_open_dev$sndpcmc-ioctl$SNDRV_PCM_IOCTL_SYNC_PTR detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r11 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r11, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) setsockopt$SO_ATTACH_FILTER(r12, 0x1, 0x54, 0x0, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r13 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r13, 0xc1004110, &(0x7f0000000040)={0x0, "8dd2356a9ebb85c49090d8e7251a8f47261a8f4797bf8ba7ff669b27d2af3ae0d402a46e4e967621c2c9fd4f42a31536849f6717859f6717c7862a799260eda3"}) (async, rerun: 32) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix-socketpair$unix-setsockopt$SO_ATTACH_FILTER-recvmmsg-syz_open_dev$sndpcmc detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r11 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r11, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) setsockopt$SO_ATTACH_FILTER(r12, 0x1, 0x54, 0x0, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) program crashed: INFO: task hung in userfaultfd_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix-socketpair$unix-setsockopt$SO_ATTACH_FILTER-recvmmsg detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r11 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r11, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) setsockopt$SO_ATTACH_FILTER(r12, 0x1, 0x54, 0x0, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix-socketpair$unix-setsockopt$SO_ATTACH_FILTER detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r10, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) setsockopt$SO_ATTACH_FILTER(r11, 0x1, 0x54, 0x0, 0x0) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix-socketpair$unix detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r10, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) (rerun: 64) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT-sendmmsg$unix detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r10, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom-ioctl$sock_netrom_SIOCADDRT detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r9, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={'nr', 0x0}, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x8000000, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) program crashed: INFO: task hung in userfaultfd_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix-syz_init_net_socket$netrom detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) syz_init_net_socket$netrom(0x6, 0x5, 0x0) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER-socketpair$unix detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) program crashed: INFO: task hung in userfaultfd_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree-ioctl$TUNSETCARRIER detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000080)=0x1) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE-write$cgroup_subtree detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE-ioctl$UDMABUF_CREATE detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x8000}) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE-ioctl$UFFDIO_ZEROPAGE detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000bf1000/0x4000)=nil, 0x4000}}) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP-sendmsg$NL80211_CMD_GET_COALESCE detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r8, @ANYRES16=r7, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r8, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r8], 0x88}}, 0x0) (async) sendmsg$NL80211_CMD_GET_COALESCE(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="000428bd7000fddbdf2564000000080001006e00000008000300", @ANYRES32=0x0, @ANYBLOB="154219cdabf91861f2b187eacf62e1bdb61ee07070f8f5659f0e3b9369ccd711e51832332474bbce2ff3e046eaeb0d6946dd2328ab373233483523b4af51eaa0c24b6e17464e710f8d761ba034667330ae2fd85bf7c99352d4cbed62605809f121e1d6054f9c3b469e7c6ad62baaa62d3e30db2d61ca808c6ab7ad4aad4ce54a6dc295823dda3bdc92dd2046de6dd47f23a9d6599eb79b929caff7eb5fc1d66058bb3b23751d32bb171f984ba1402c96e1f710526e18c598ce1815fe59b478b621930266c20da767a9bc"], 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) program crashed: INFO: task hung in userfaultfd_ioctl testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_START_AP detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) (async) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r4, 0x80000}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES8=r7, @ANYRES16=r6, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r7, @ANYRES32=r3, @ANYRESOCT=r4, @ANYRESOCT=r7], 0x88}}, 0x0) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r3, 0x80000}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic-syz_genetlink_get_family_id$nl80211 detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r3, 0x80000}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC-socket$nl_generic detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r3, 0x80000}) socket$nl_generic(0x10, 0x3, 0x10) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap-ioctl$DMA_HEAP_IOCTL_ALLOC detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x5, r3, 0x80000}) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_API-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x48c}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-userfaultfd-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) r3 = userfaultfd(0x801) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in userfaultfd_release_all testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-socket$kcm-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socket$kcm(0x10, 0x2, 0x0) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-openat$rnullb-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MP_STATE-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async, rerun: 32) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) (async) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program crashed: INFO: task hung in exit_mm extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program did not crash simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program crashed: INFO: task hung in exit_mm extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: INFO: task hung in exit_mm simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: INFO: task hung in exit_mm testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap program crashed: INFO: task hung in exit_mm testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program crashed: INFO: task hung in exit_mm validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program crashed: INFO: task hung in exit_mm validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$UFFDIO_REGISTER-mremap detailed listing: executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) mremap(&(0x7f00002c0000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f00003b8000/0x3000)=nil) program crashed: INFO: task hung in exit_mm validation run: crashed=true reproducing took 3h14m46.214411855s repro crashed as (corrupted=false): INFO: task syz.0.16:6041 blocked for more than 143 seconds. Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.16 state:D stack:26920 pid:6041 tgid:6041 ppid:5971 task_flags:0x40004c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5351 [inline] __schedule+0x1737/0x4d30 kernel/sched/core.c:6954 __schedule_loop kernel/sched/core.c:7036 [inline] schedule+0x165/0x360 kernel/sched/core.c:7051 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7108 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1088 __down_read_common kernel/locking/rwsem.c:1263 [inline] __down_read kernel/locking/rwsem.c:1276 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1541 mmap_read_lock include/linux/mmap_lock.h:412 [inline] exit_mm+0xcc/0x2c0 kernel/exit.c:557 do_exit+0x648/0x2300 kernel/exit.c:947 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100 __do_sys_exit_group kernel/exit.c:1111 [inline] __se_sys_exit_group kernel/exit.c:1109 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1109 x64_sys_call+0x21f7/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc58db8e9a9 RSP: 002b:00007ffe21fd2758 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc58db8e9a9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000221fd284f R09: 00007fc58dd80260 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc58dd80260 R14: 0000000000000003 R15: 00007ffe21fd2810 Showing all locks held in the system: 3 locks held by kworker/u8:1/13: 1 lock held by khungtaskd/31: #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 2 locks held by kworker/u8:6/1147: #0: ffff88801a889148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801a889148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319 #1: ffff8880b8624008 (per_cpu_ptr(&psi_seq, cpu)){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:937 2 locks held by getty/5608: #0: ffff88814e2e80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 1 lock held by syz.0.16/6041: #0: ffff88803137d7e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137d7e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.0.16/6042: 1 lock held by syz.1.17/6081: #0: ffff8880323d62a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880323d62a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.1.17/6082: 1 lock held by syz.2.18/6105: #0: ffff888033721760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888033721760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.2.18/6106: 1 lock held by syz.3.19/6134: #0: ffff88803137c260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137c260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.3.19/6135: 1 lock held by syz.4.20/6162: #0: ffff88802fdeb7a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88802fdeb7a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 4 locks held by syz.4.20/6163: 1 lock held by syz.5.21/6191: #0: ffff88803137e2a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137e2a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.5.21/6192: 1 lock held by syz.6.22/6228: #0: ffff88803137b7a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137b7a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.6.22/6229: 1 lock held by syz.7.23/6258: #0: ffff8880313781e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880313781e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.7.23/6259: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline] watchdog+0xf93/0xfe0 kernel/hung_task.c:491 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: bat_events batadv_nc_worker RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:89 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0xa5/0x2c0 mm/kasan/generic.c:189 Code: 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 41 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 0f 85 de 01 00 00 <49> ff c3 48 ff c3 75 ee e9 21 01 00 00 44 89 dd 83 e5 07 0f 84 b5 RSP: 0018:ffffc90000127888 EFLAGS: 00000046 RAX: 0000000000000001 RBX: ffffffffffffffff RCX: ffffffff81c7a438 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8fe3cf30 RBP: ffffc90000127978 R08: ffffffff8fe3cf37 R09: 1ffffffff1fc79e6 R10: dffffc0000000000 R11: fffffbfff1fc79e6 R12: 0000000000000001 R13: dffffc0000000000 R14: fffffbfff1fc79e7 R15: 1ffffffff1fc79e6 FS: 0000000000000000(0000) GS:ffff8881258ab000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055555de075c8 CR3: 0000000078f8e000 CR4: 00000000003526f0 Call Trace: instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:646 [inline] cpu_online include/linux/cpumask.h:1205 [inline] trace_irq_enable+0x28/0x110 include/trace/events/preemptirq.h:40 trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:73 __local_bh_enable_ip+0x12d/0x1c0 kernel/softirq.c:412 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_nc_purge_paths+0x318/0x3b0 net/batman-adv/network-coding.c:471 batadv_nc_worker+0x369/0x610 net/batman-adv/network-coding.c:722 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task syz.0.16:6041 blocked for more than 143 seconds. Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.16 state:D stack:26920 pid:6041 tgid:6041 ppid:5971 task_flags:0x40004c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5351 [inline] __schedule+0x1737/0x4d30 kernel/sched/core.c:6954 __schedule_loop kernel/sched/core.c:7036 [inline] schedule+0x165/0x360 kernel/sched/core.c:7051 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7108 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1088 __down_read_common kernel/locking/rwsem.c:1263 [inline] __down_read kernel/locking/rwsem.c:1276 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1541 mmap_read_lock include/linux/mmap_lock.h:412 [inline] exit_mm+0xcc/0x2c0 kernel/exit.c:557 do_exit+0x648/0x2300 kernel/exit.c:947 do_group_exit+0x21c/0x2d0 kernel/exit.c:1100 __do_sys_exit_group kernel/exit.c:1111 [inline] __se_sys_exit_group kernel/exit.c:1109 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1109 x64_sys_call+0x21f7/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc58db8e9a9 RSP: 002b:00007ffe21fd2758 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc58db8e9a9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000221fd284f R09: 00007fc58dd80260 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc58dd80260 R14: 0000000000000003 R15: 00007ffe21fd2810 Showing all locks held in the system: 3 locks held by kworker/u8:1/13: 1 lock held by khungtaskd/31: #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 2 locks held by kworker/u8:6/1147: #0: ffff88801a889148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88801a889148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319 #1: ffff8880b8624008 (per_cpu_ptr(&psi_seq, cpu)){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:937 2 locks held by getty/5608: #0: ffff88814e2e80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 1 lock held by syz.0.16/6041: #0: ffff88803137d7e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137d7e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.0.16/6042: 1 lock held by syz.1.17/6081: #0: ffff8880323d62a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880323d62a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.1.17/6082: 1 lock held by syz.2.18/6105: #0: ffff888033721760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff888033721760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.2.18/6106: 1 lock held by syz.3.19/6134: #0: ffff88803137c260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137c260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.3.19/6135: 1 lock held by syz.4.20/6162: #0: ffff88802fdeb7a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88802fdeb7a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 4 locks held by syz.4.20/6163: 1 lock held by syz.5.21/6191: #0: ffff88803137e2a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137e2a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.5.21/6192: 1 lock held by syz.6.22/6228: #0: ffff88803137b7a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff88803137b7a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.6.22/6229: 1 lock held by syz.7.23/6258: #0: ffff8880313781e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:412 [inline] #0: ffff8880313781e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0 kernel/exit.c:557 1 lock held by syz.7.23/6259: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline] watchdog+0xf93/0xfe0 kernel/hung_task.c:491 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: bat_events batadv_nc_worker RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:89 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0xa5/0x2c0 mm/kasan/generic.c:189 Code: 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 41 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 0f 85 de 01 00 00 <49> ff c3 48 ff c3 75 ee e9 21 01 00 00 44 89 dd 83 e5 07 0f 84 b5 RSP: 0018:ffffc90000127888 EFLAGS: 00000046 RAX: 0000000000000001 RBX: ffffffffffffffff RCX: ffffffff81c7a438 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8fe3cf30 RBP: ffffc90000127978 R08: ffffffff8fe3cf37 R09: 1ffffffff1fc79e6 R10: dffffc0000000000 R11: fffffbfff1fc79e6 R12: 0000000000000001 R13: dffffc0000000000 R14: fffffbfff1fc79e7 R15: 1ffffffff1fc79e6 FS: 0000000000000000(0000) GS:ffff8881258ab000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055555de075c8 CR3: 0000000078f8e000 CR4: 00000000003526f0 Call Trace: instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:646 [inline] cpu_online include/linux/cpumask.h:1205 [inline] trace_irq_enable+0x28/0x110 include/trace/events/preemptirq.h:40 trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:73 __local_bh_enable_ip+0x12d/0x1c0 kernel/softirq.c:412 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_nc_purge_paths+0x318/0x3b0 net/batman-adv/network-coding.c:471 batadv_nc_worker+0x369/0x610 net/batman-adv/network-coding.c:722 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245