Extracting prog: 35m12.019933969s
Minimizing prog: 40m21.175144668s
Simplifying prog options: 26m46.110732997s
Extracting C: 5m15.993719959s
Simplifying C: 0s


extracting reproducer from 37 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socketpair$unix-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_MESH-connect$unix-sendmmsg$unix-recvmmsg-ioctl$FBIOPUT_VSCREENINFO-socket$netlink-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-getsockopt$bt_hci-sendmsg$nl_route-prctl$PR_SCHED_CORE-setsockopt$IP_VS_SO_SET_STARTDAEMON-syz_genetlink_get_family_id$l2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_fuse_handle_req-fsopen-close_range-fsconfig$FSCONFIG_CMD_CREATE-fsmount-sendmmsg$inet6-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-getsockopt$sock_buf
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r5=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="0c00990000000000000000000800a115ffff0000080026008d03000008009f"], 0x40}}, 0x0)
connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000100)={0x30, 0x300, 0x80, 0xf0, 0x40, 0x0, 0x20, 0xfffffffd, {0x0, 0x8, 0x1}, {0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x3}, 0x0, 0x0, 0x2, 0xd613, 0x0, 0xfffffffd, 0xffffffff, 0x4, 0x40000009, 0x6, 0xfffffffd, 0x0, 0x20, 0x2, 0x0, 0x1})
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f00000008c0)=@nat={'nat\x00', 0x1b, 0x5, 0x3b0, 0x1c8, 0xf0, 0xffffffff, 0x1c8, 0x270, 0x270, 0x480, 0xffffffff, 0x480, 0x480, 0x5, 0x0, {[{{@ip={@dev={0xac, 0x14, 0x14, 0xf}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0xff, 'macvtap0\x00', 'veth1_to_batadv\x00', {0xff}, {}, 0x2f, 0x0, 0x40}, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@addrtype={{0x30}, {0x80, 0x410, 0x1, 0x1}}, @common=@icmp={{0x28}, {0x10, '6n'}}]}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x7}}}, {{@uncond, 0x0, 0xa0, 0xd8, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x2, 0x2, 0x2, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x4, @private=0xa010101, @empty, @port=0x4e22, @gre_key=0x6f6}}}}, {{@ip={@multicast2, @empty, 0xffffff00, 0xff000000, 'wg2\x00', 'bridge0\x00', {0xff}, {}, 0x8b, 0x1, 0x2}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x18, @local, @private=0xa010101, @port=0x4e22, @gre_key=0x81}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x8, @dev={0xac, 0x14, 0x14, 0x43}, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x68, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x410)
getsockopt$bt_hci(r7, 0x0, 0x1, &(0x7f00000001c0)=""/81, &(0x7f00000000c0)=0x51)
sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00T\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x1a, 0x0, 0x0)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000740), 0xffffffffffffffff)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20}, 0x0})
r10 = fsopen(&(0x7f00000000c0)='sysfs\x00', 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0)
r11 = fsmount(r10, 0x0, 0x0)
sendmmsg$inet6(r11, 0x0, 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64
detailed listing:
executing program 0:
syz_usb_connect(0x6, 0xf4, &(0x7f0000000700)=ANY=[], 0x0)
ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(0xffffffffffffffff, 0xc0984124, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$nl_netfilter-socket$nl_route-madvise-socket$netlink-openat-openat$fuse-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-socket$key-prctl$PR_SCHED_CORE-syz_open_dev$sndmidi-dup-write$6lowpan_enable-socket$inet_udp-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-sendmmsg-sendmsg$NL80211_CMD_FRAME
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', <r2=>0x0})
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001840)={{0x14}, [@NFT_MSG_NEWRULE={0xb0, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x84, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xe}]}}}, {0x60, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x50, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x34, 0x3, "55b0f1230a6a7db23b6d45fcd6c231e61562388840e6520b620f0c97ff4d151ff6840ec33256fa29356e76d1711be493"}, @NFTA_MATCH_NAME={0xe, 0x1, 'multiport\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xd8}, 0x1, 0x0, 0x0, 0x20000091}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_route(0x10, 0x3, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19)
socket$netlink(0x10, 0x3, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x40, 0x0)
openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0)
socket$key(0xf, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r5 = dup(r4)
write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
r7 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10)
setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8)
sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x1c)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x34, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8d6}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xd}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): unshare-socket-connect$inet6
detailed listing:
executing program 0:
unshare(0x4020400)
r0 = socket(0x2b, 0x80801, 0x1)
connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4, 0x3ff, @empty, 0x1}, 0x1c)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-writev-socket$nl_netfilter-prctl$PR_SCHED_CORE-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-syz_io_uring_setup-syz_memcpy_off$IO_URING_METADATA_GENERIC-move_mount-eventfd2-io_uring_register$IORING_REGISTER_EVENTFD-ioctl$sock_SIOCGIFINDEX_80211-ioctl$sock_SIOCGIFINDEX_80211-syz_io_uring_submit-io_uring_enter-socket$nl_route-sendmsg$nl_route-ioctl$SNDRV_CTL_IOCTL_ELEM_ADD-syz_open_dev$video-socket$kcm-fsopen-fsmount-fchdir
detailed listing:
executing program 0:
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r1, &(0x7f00000000c0), 0x12)
writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1)
socket$nl_netfilter(0x10, 0x3, 0xc)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = syz_io_uring_setup(0x49f, &(0x7f0000000400)={0x0, 0x5cf, 0x400, 0x7ffe, 0x40024e}, &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000040)=<r6=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4)
move_mount(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x4)
r7 = eventfd2(0xff, 0x80001)
io_uring_register$IORING_REGISTER_EVENTFD(r4, 0x4, &(0x7f0000000300)=r7, 0x1)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00'})
syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r4, 0x0, 0x0, 0x0, 0x2})
io_uring_enter(r4, 0x3d0e, 0x4c1, 0x43, 0x0, 0x0)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYRES16], 0x28}}, 0x20000000)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0)
syz_open_dev$video(0x0, 0xa4, 0x0)
socket$kcm(0x15, 0x5, 0x0)
r9 = fsopen(&(0x7f0000000100)='mqueue\x00', 0x0)
r10 = fsmount(r9, 0x1, 0x0)
fchdir(r10)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078005001500010000000800124000000000050005000a000000050001000600000011000300686173683a69702c6d61726b"], 0x60}, 0x1, 0x0, 0x0, 0x40000c0}, 0x0)
r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r1, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-openat$uhid
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078005001500010000000800124000000000050005000a000000050001000600000011000300686173683a69702c6d61726b"], 0x60}, 0x1, 0x0, 0x0, 0x40000c0}, 0x0)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078005001500010000000800124000000000050005000a000000050001000600000011000300686173683a69702c6d61726b"], 0x60}, 0x1, 0x0, 0x0, 0x40000c0}, 0x0)
write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', 0x0, 0x0, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE(r0, &(0x7f0000001140)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000140)=""/4096, 0x1000, 0x40, 0x400, 0x4, 0x3, 0x8}}, 0x120)

program crashed: INFO: task hung in uhid_char_release
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
reproducing took 1h47m33.601281191s
repro crashed as (corrupted=false):
INFO: task syz.3.19:6014 blocked for more than 143 seconds.
      Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.19        state:D
 stack:27240 pid:6014  tgid:6014  ppid:5940   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5392 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781
 __schedule_loop kernel/sched/core.c:6859 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6874
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4246
 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4366
 uhid_dev_destroy drivers/hid/uhid.c:584 [inline]
 uhid_char_release+0xac/0x600 drivers/hid/uhid.c:662
 __fput+0x449/0xa70 fs/file_table.c:465
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd42338e969
RSP: 002b:00007ffdf3d757f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000001ae66 RCX: 00007fd42338e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002f3d75aef
R10: 00007fd423200000 R11: 0000000000000246 R12: 00007fd4235b5fac
R13: 00007fd4235b5fa0 R14: ffffffffffffffff R15: 0000000000000003
 </TASK>
INFO: task syz.1.21:6017 blocked for more than 145 seconds.
      Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.21        state:D stack:27944 pid:6017  tgid:6017  ppid:5934   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5392 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781
 __schedule_loop kernel/sched/core.c:6859 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6874
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4246
 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4366
 uhid_dev_destroy drivers/hid/uhid.c:584 [inline]
 uhid_char_release+0xac/0x600 drivers/hid/uhid.c:662
 __fput+0x449/0xa70 fs/file_table.c:465
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3146d8e969
RSP: 002b:00007fffbbec0b98 EFLAGS: 00000246
 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000001b158 RCX: 00007f3146d8e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002bbec0e8f
R10: 00007f3146c00000 R11: 0000000000000246 R12: 00007f3146fb5fac
R13: 00007f3146fb5fa0 R14: ffffffffffffffff R15: 0000000000000003
 </TASK>
INFO: task syz.2.18:6018 blocked for more than 147 seconds.
      Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.18        state:D
 stack:27240 pid:6018  tgid:6018  ppid:5939   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5392 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781
 __schedule_loop kernel/sched/core.c:6859 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6874
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4246

final repro crashed as (corrupted=false):
INFO: task syz.3.19:6014 blocked for more than 143 seconds.
      Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.19        state:D
 stack:27240 pid:6014  tgid:6014  ppid:5940   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5392 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781
 __schedule_loop kernel/sched/core.c:6859 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6874
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4246
 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4366
 uhid_dev_destroy drivers/hid/uhid.c:584 [inline]
 uhid_char_release+0xac/0x600 drivers/hid/uhid.c:662
 __fput+0x449/0xa70 fs/file_table.c:465
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd42338e969
RSP: 002b:00007ffdf3d757f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000001ae66 RCX: 00007fd42338e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002f3d75aef
R10: 00007fd423200000 R11: 0000000000000246 R12: 00007fd4235b5fac
R13: 00007fd4235b5fa0 R14: ffffffffffffffff R15: 0000000000000003
 </TASK>
INFO: task syz.1.21:6017 blocked for more than 145 seconds.
      Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.21        state:D stack:27944 pid:6017  tgid:6017  ppid:5934   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5392 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781
 __schedule_loop kernel/sched/core.c:6859 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6874
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4246
 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4366
 uhid_dev_destroy drivers/hid/uhid.c:584 [inline]
 uhid_char_release+0xac/0x600 drivers/hid/uhid.c:662
 __fput+0x449/0xa70 fs/file_table.c:465
 task_work_run+0x1d4/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3146d8e969
RSP: 002b:00007fffbbec0b98 EFLAGS: 00000246
 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000001b158 RCX: 00007f3146d8e969
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002bbec0e8f
R10: 00007f3146c00000 R11: 0000000000000246 R12: 00007f3146fb5fac
R13: 00007f3146fb5fa0 R14: ffffffffffffffff R15: 0000000000000003
 </TASK>
INFO: task syz.2.18:6018 blocked for more than 147 seconds.
      Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.18        state:D
 stack:27240 pid:6018  tgid:6018  ppid:5939   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5392 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6781
 __schedule_loop kernel/sched/core.c:6859 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6874
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148
 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4246