Extracting prog: 2m18.397533084s
Minimizing prog: 1h5m31.725557481s
Simplifying prog options: 12m12.537964068s
Extracting C: 5m7.258677387s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-connect$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x3, 0x8, @remote, 0x7}, 0x1c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-connect$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x3, 0x8, @remote, 0x7}, 0x1c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program crashed: possible deadlock in vmci_qp_broker_detach
single: successfully extracted reproducer
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-connect$inet6
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x3, 0x8, @remote, 0x7}, 0x1c)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program crashed: possible deadlock in vmci_qp_broker_detach
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r0 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, 0x0)
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, 0x0)
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953c, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program crashed: possible deadlock in vmci_qp_broker_detach
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program crashed: possible deadlock in vmci_qp_broker_detach
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program did not crash
validation run: crashed=false
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program crashed: possible deadlock in vmci_qp_broker_detach
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC-socket$inet6-sendmsg
detailed listing:
executing program 0:
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0xa0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000280)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000001340)={{@local}, @any, 0x0, 0x4})
r1 = socket$inet6(0xa, 0x3, 0x8000000003c)
sendmsg(r1, 0x0, 0x4)

program crashed: possible deadlock in vmci_qp_broker_detach
validation run: crashed=true
reproducing took 1h44m23.350591861s
repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.2.27436/30399 is trying to acquire lock:
ffffffff8f2c6578 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095

but task is already holding lock:
ffffffff8f2c6578 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(qp_broker_list.mutex);
  lock(qp_broker_list.mutex);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz.2.27436/30399:
 #0: ffffffff8f2c6578 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095

stack backtrace:
CPU: 0 UID: 0 PID: 30399 Comm: syz.2.27436 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_deadlock_bug+0x1e9/0x240 kernel/locking/lockdep.c:3041
 check_deadlock kernel/locking/lockdep.c:3093 [inline]
 validate_chain kernel/locking/lockdep.c:3895 [inline]
 __lock_acquire+0x1106/0x1c90 kernel/locking/lockdep.c:5237
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:598 [inline]
 __mutex_lock+0x193/0x1060 kernel/locking/mutex.c:760
 vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095
 ctx_free_ctx+0x51b/0xdb0 drivers/misc/vmw_vmci/vmci_context.c:424
 kref_put include/linux/kref.h:65 [inline]
 vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:477 [inline]
 vmci_ctx_enqueue_datagram+0x4c5/0x650 drivers/misc/vmw_vmci/vmci_context.c:340
 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:276 [inline]
 vmci_datagram_dispatch+0x42e/0xd30 drivers/misc/vmw_vmci/vmci_datagram.c:340
 qp_notify_peer+0x19d/0x260 drivers/misc/vmw_vmci/vmci_queue_pair.c:1481
 vmci_qp_broker_detach+0x604/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2188
 ctx_free_ctx+0x51b/0xdb0 drivers/misc/vmw_vmci/vmci_context.c:424
 kref_put include/linux/kref.h:65 [inline]
 vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:477 [inline]
 vmci_ctx_destroy+0x15b/0x1d0 drivers/misc/vmw_vmci/vmci_context.c:195
 vmci_host_close+0x115/0x1a0 drivers/misc/vmw_vmci/vmci_host.c:143
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x130 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x426/0xfa0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3ac418f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc51061168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000484b0 RCX: 00007f3ac418f6c9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f3ac43e7da0 R08: 0000000000000001 R09: 000000065106145f
R10: 0000001b32620000 R11: 0000000000000246 R12: 00007f3ac43e5fac
R13: 00007f3ac43e5fa0 R14: ffffffffffffffff R15: 00007ffc51061280
 </TASK>

final repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.2.27436/30399 is trying to acquire lock:
ffffffff8f2c6578 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095

but task is already holding lock:
ffffffff8f2c6578 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(qp_broker_list.mutex);
  lock(qp_broker_list.mutex);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

1 lock held by syz.2.27436/30399:
 #0: ffffffff8f2c6578 (qp_broker_list.mutex){+.+.}-{4:4}, at: vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095

stack backtrace:
CPU: 0 UID: 0 PID: 30399 Comm: syz.2.27436 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_deadlock_bug+0x1e9/0x240 kernel/locking/lockdep.c:3041
 check_deadlock kernel/locking/lockdep.c:3093 [inline]
 validate_chain kernel/locking/lockdep.c:3895 [inline]
 __lock_acquire+0x1106/0x1c90 kernel/locking/lockdep.c:5237
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x179/0x350 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:598 [inline]
 __mutex_lock+0x193/0x1060 kernel/locking/mutex.c:760
 vmci_qp_broker_detach+0x14c/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2095
 ctx_free_ctx+0x51b/0xdb0 drivers/misc/vmw_vmci/vmci_context.c:424
 kref_put include/linux/kref.h:65 [inline]
 vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:477 [inline]
 vmci_ctx_enqueue_datagram+0x4c5/0x650 drivers/misc/vmw_vmci/vmci_context.c:340
 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:276 [inline]
 vmci_datagram_dispatch+0x42e/0xd30 drivers/misc/vmw_vmci/vmci_datagram.c:340
 qp_notify_peer+0x19d/0x260 drivers/misc/vmw_vmci/vmci_queue_pair.c:1481
 vmci_qp_broker_detach+0x604/0x1380 drivers/misc/vmw_vmci/vmci_queue_pair.c:2188
 ctx_free_ctx+0x51b/0xdb0 drivers/misc/vmw_vmci/vmci_context.c:424
 kref_put include/linux/kref.h:65 [inline]
 vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:477 [inline]
 vmci_ctx_destroy+0x15b/0x1d0 drivers/misc/vmw_vmci/vmci_context.c:195
 vmci_host_close+0x115/0x1a0 drivers/misc/vmw_vmci/vmci_host.c:143
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x150/0x240 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x130 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x426/0xfa0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3ac418f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc51061168 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000484b0 RCX: 00007f3ac418f6c9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f3ac43e7da0 R08: 0000000000000001 R09: 000000065106145f
R10: 0000001b32620000 R11: 0000000000000246 R12: 00007f3ac43e5fac
R13: 00007f3ac43e5fa0 R14: ffffffffffffffff R15: 00007ffc51061280
 </TASK>