INFO: task syz-executor.3:20509 blocked for more than 143 seconds.
Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:26736 pid:20509 ppid: 3629 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0x926/0x1080 kernel/sched/core.c:6295
schedule+0x12b/0x1f0 kernel/sched/core.c:6368
schedule_timeout+0xac/0x300 kernel/time/timer.c:1857
do_wait_for_common+0x2da/0x480 kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x46/0x60 kernel/sched/completion.c:138
__synchronize_srcu+0x2aa/0x350 kernel/rcu/srcutree.c:930
kvm_swap_active_memslots+0x4da/0x700 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1473
kvm_activate_memslot arch/x86/kvm/../../../virt/kvm/kvm_main.c:1595 [inline]
kvm_create_memslot arch/x86/kvm/../../../virt/kvm/kvm_main.c:1660 [inline]
kvm_set_memslot+0x748/0x10f0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1772
__kvm_set_memory_region+0xe6c/0x1080 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1914
kvm_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1927 [inline]
kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1939 [inline]
kvm_vm_ioctl+0xebf/0x2720 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4492
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f34f6a52e17
RSP: 002b:00007f34f53c65d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 00007f34f6a52e17
RDX: 00007f34f53c6a10 RSI: 000000004020ae46 RDI: 0000000000000004
RBP: 0000000000000004 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 00000000fec00000
R13: 00007f34f53c6d10 R14: 0000000000000018 R15: 0000000020017000
Showing all locks held in the system:
1 lock held by khungtaskd/26:
#0: ffffffff8cb1db20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/1:3/3259:
2 locks held by getty/3272:
#0: ffff88807efe3098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
#1: ffffc90002b662e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6c5/0x1c60 drivers/tty/n_tty.c:2077
1 lock held by syz-executor.3/20509:
#0: ffffc90003ba10a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1926 [inline]
#0: ffffc90003ba10a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1939 [inline]
#0: ffffc90003ba10a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl+0xeb4/0x2720 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4492
3 locks held by syz-executor.3/20527:
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 26 Comm: khungtaskd Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xc82/0xcd0 kernel/hung_task.c:369
kthread+0x2a3/0x2d0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 20527 Comm: syz-executor.3 Not tainted 5.17.0-rc3-syzkaller-00316-gb81b1829e7e3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_next_frame+0x174/0x1fc0 arch/x86/kernel/unwind_orc.c:443
Code: 03 23 49 ff cc 4c 89 6c 24 30 48 89 6c 24 78 4c 89 7c 24 70 0f 84 1a 01 00 00 48 c7 c0 00 00 00 81 49 39 c4 0f 82 16 01 00 00 <48> c7 c0 98 74 40 8a 49 39 c4 0f 83 06 01 00 00 48 c7 c0 00 00 00
RSP: 0018:ffffc90003fae200 EFLAGS: 00000202
RAX: ffffffff81000000 RBX: ffffc90003fae308 RCX: ffffffff8a15c400
RDX: ffffc90003faea40 RSI: ffffffff81207111 RDI: ffffffff813b92a9
RBP: ffffc90003fae2f5 R08: 0000000000000009 R09: ffffc90003fae3b0
R10: fffff520007f5c64 R11: 0000000000000000 R12: ffffffff81207110
R13: ffffc90003fae2c0 R14: dffffc0000000000 R15: 1ffff920007f5c5e
FS: 00007f34f53a7700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c016c2d370 CR3: 000000002437b000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
arch_stack_walk+0x112/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0x126/0x180 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:236 [inline]
slab_free_hook mm/slub.c:1728 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1754
slab_free mm/slub.c:3509 [inline]
kfree+0xb8/0x2e0 mm/slub.c:4562
memtype_free+0x2fc/0x430 arch/x86/mm/pat/memtype.c:694
iounmap+0x115/0x170 arch/x86/mm/ioremap.c:477
paging64_cmpxchg_gpte+0x3ee/0x540 arch/x86/kvm/mmu/paging_tmpl.h:182
paging64_update_accessed_dirty_bits arch/x86/kvm/mmu/paging_tmpl.h:287 [inline]
paging64_walk_addr_generic+0xd28/0x1420 arch/x86/kvm/mmu/paging_tmpl.h:487
paging64_gva_to_gpa+0xc1/0x1a0 arch/x86/kvm/mmu/paging_tmpl.h:1005
kvm_mmu_gva_to_gpa_write arch/x86/kvm/x86.c:6710 [inline]
emulator_cmpxchg_emulated+0x1a8/0x890 arch/x86/kvm/x86.c:7188
__load_segment_descriptor+0xe18/0x1560 arch/x86/kvm/emulate.c:1657
x86_emulate_insn+0xa32/0x6220 arch/x86/kvm/emulate.c:5544
x86_emulate_instruction+0x8ba/0x27c0 arch/x86/kvm/x86.c:8362
kvm_mmu_page_fault+0x606/0x17c0 arch/x86/kvm/mmu/mmu.c:5347
vmx_handle_exit+0x26/0x160 arch/x86/kvm/vmx/vmx.c:6196
vcpu_enter_guest+0x5f36/0xa010 arch/x86/kvm/x86.c:10161
vcpu_run+0x572/0xdf0 arch/x86/kvm/x86.c:10243
kvm_arch_vcpu_ioctl_run+0x4b0/0xb70 arch/x86/kvm/x86.c:10449
kvm_vcpu_ioctl+0x894/0xe20 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3908
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f34f6a53059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f34f53a7168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f34f6b66030 RCX: 00007f34f6a53059
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000013
RBP: 00007f34f6aad08d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcec3b26ef R14: 00007f34f53a7300 R15: 0000000000022000
----------------
Code disassembly (best guess):
0: 03 23 add (%rbx),%esp
2: 49 ff cc dec %r12
5: 4c 89 6c 24 30 mov %r13,0x30(%rsp)
a: 48 89 6c 24 78 mov %rbp,0x78(%rsp)
f: 4c 89 7c 24 70 mov %r15,0x70(%rsp)
14: 0f 84 1a 01 00 00 je 0x134
1a: 48 c7 c0 00 00 00 81 mov $0xffffffff81000000,%rax
21: 49 39 c4 cmp %rax,%r12
24: 0f 82 16 01 00 00 jb 0x140
* 2a: 48 c7 c0 98 74 40 8a mov $0xffffffff8a407498,%rax <-- trapping instruction
31: 49 39 c4 cmp %rax,%r12
34: 0f 83 06 01 00 00 jae 0x140
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: c0 00 00 rolb $0x0,(%rax)