syzbot

INFO: task syz.4.2629:24454 blocked for more than 143 seconds.
      Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.2629      state:D stack:24272 pid:24454 tgid:24454 ppid:24242  flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5328 [inline]
 __schedule+0xe55/0x5740 kernel/sched/core.c:6693
 __schedule_loop kernel/sched/core.c:6770 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6785
 io_schedule+0xbf/0x130 kernel/sched/core.c:7577
 folio_wait_bit_common+0x3d8/0x9b0 mm/filemap.c:1309
 __folio_lock mm/filemap.c:1647 [inline]
 lock_folio_maybe_drop_mmap mm/filemap.c:3132 [inline]
 filemap_fault+0xd7a/0x2820 mm/filemap.c:3366
 __do_fault+0x10a/0x490 mm/memory.c:4882
 do_read_fault mm/memory.c:5297 [inline]
 do_fault mm/memory.c:5431 [inline]
 do_pte_missing+0xec5/0x3e70 mm/memory.c:3965
 handle_pte_fault mm/memory.c:5766 [inline]
 __handle_mm_fault+0x100a/0x2a10 mm/memory.c:5909
 handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6077
 faultin_page mm/gup.c:1187 [inline]
 __get_user_pages+0x8d9/0x3b50 mm/gup.c:1485
 __get_user_pages_locked mm/gup.c:1751 [inline]
 get_dump_page+0xfb/0x220 mm/gup.c:2269
 dump_user_range+0x135/0x8c0 fs/coredump.c:943
 elf_core_dump+0x2766/0x3840 fs/binfmt_elf.c:2127
 do_coredump+0x2c42/0x4160 fs/coredump.c:758
 get_signal+0x237c/0x26d0 kernel/signal.c:2903
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 irqentry_exit_to_user_mode+0x13f/0x280 kernel/entry/common.c:231
 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:617
RIP: 0033:0x7f97fc37e761
RSP: 002b:0000000020000090 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f97fc535f80 RCX: 00007f97fc37e759
RDX: 00000000200000c0 RSI: 0000000020000090 RDI: 0000000000902080
RBP: 00007f97fc3f175e R08: 0000000020000140 R09: 0000000020000140
R10: 0000000020000100 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f97fc535f80 R15: 00007ffd804c0038
 </TASK>
INFO: task syz.1.2651:24604 blocked for more than 143 seconds.
      Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.2651      state:D stack:24672 pid:24604 tgid:24604 ppid:24241  flags:0x00404002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5328 [inline]
 __schedule+0xe55/0x5740 kernel/sched/core.c:6693
 __schedule_loop kernel/sched/core.c:6770 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6785
 io_schedule+0xbf/0x130 kernel/sched/core.c:7577
 folio_wait_bit_common+0x3d8/0x9b0 mm/filemap.c:1309
 __folio_lock mm/filemap.c:1647 [inline]
 lock_folio_maybe_drop_mmap mm/filemap.c:3132 [inline]
 filemap_fault+0xd7a/0x2820 mm/filemap.c:3366
 __do_fault+0x10a/0x490 mm/memory.c:4882
 do_read_fault mm/memory.c:5297 [inline]
 do_fault mm/memory.c:5431 [inline]
 do_pte_missing+0xec5/0x3e70 mm/memory.c:3965
 handle_pte_fault mm/memory.c:5766 [inline]
 __handle_mm_fault+0x100a/0x2a10 mm/memory.c:5909
 handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6077
 faultin_page mm/gup.c:1187 [inline]
 __get_user_pages+0x8d9/0x3b50 mm/gup.c:1485
 __get_user_pages_locked mm/gup.c:1751 [inline]
 get_dump_page+0xfb/0x220 mm/gup.c:2269
 dump_user_range+0x135/0x8c0 fs/coredump.c:943
 elf_core_dump+0x2766/0x3840 fs/binfmt_elf.c:2127
 do_coredump+0x2c42/0x4160 fs/coredump.c:758
 get_signal+0x237c/0x26d0 kernel/signal.c:2903
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 irqentry_exit_to_user_mode+0x13f/0x280 kernel/entry/common.c:231
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f266617e761
RSP: 002b:0000000000000003 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f2666336058 RCX: 00007f266617e759
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 00000000000001ff
RBP: 00007f26661f175e R08: ffffffff00000000 R09: 0000000000000000
R10: ffffffff81000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2666336058 R15: 00007fff2fd1ae78
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8ddb7980 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8ddb7980 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ddb7980 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6720
2 locks held by getty/5598:
 #0: ffff88803512a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5832:
 #0: ffff8880331fc148 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:716 [inline]
 #0: ffff8880331fc148 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6243
 #1: ffff88803525c518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x177/0x380 mm/memory.c:3162
1 lock held by syz.3.1265/12643:
6 locks held by kworker/u8:21/15151:
 #0: ffff8881416dc148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x1212/0x1b30 kernel/workqueue.c:3204
 #1: ffffc9000df7fd80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205
 #2: ffff88803525c0e0 (&type->s_umount_key#33){++++}-{3:3}, at: super_trylock_shared+0x1e/0xf0 fs/super.c:562
 #3: ffff88803525eb98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: do_writepages+0x1b3/0x820 mm/page-writeback.c:2683
 #4: ffff888032200958 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xf6c/0x1430 fs/jbd2/transaction.c:448
 #5: ffff888070f7e598 (&ei->i_data_sem){++++}-{3:3}, at: ext4_map_blocks+0x352/0x1370 fs/ext4/inode.c:701
3 locks held by syz.4.2629/24454:
 #0: ffff88807e684420 (sb_writers#5){.+.+}-{0:0}, at: get_signal+0x237c/0x26d0 kernel/signal.c:2903
 #1: ffff88807e323118 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline]
 #1: ffff88807e323118 (&mm->mmap_lock){++++}-{3:3}, at: __get_user_pages_locked mm/gup.c:1726 [inline]
 #1: ffff88807e323118 (&mm->mmap_lock){++++}-{3:3}, at: get_dump_page+0xb6/0x220 mm/gup.c:2269
 #2: ffff888070f7dec0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
 #2: ffff888070f7dec0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x62e/0x2820 mm/filemap.c:3352
2 locks held by syz-executor/24516:
 #0: ffff88803525c420 (sb_writers#4){.+.+}-{0:0}, at: filename_create+0x10d/0x530 fs/namei.c:4073
 #1: ffff88803fcb97c8 (&type->i_mutex_dir_key#3/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:853 [inline]
 #1: ffff88803fcb97c8 (&type->i_mutex_dir_key#3/1){+.+.}-{3:3}, at: filename_create+0x1c2/0x530 fs/namei.c:4080
3 locks held by syz.1.2651/24604:
 #0: ffff8880308d6420 (sb_writers#5){.+.+}-{0:0}, at: get_signal+0x237c/0x26d0 kernel/signal.c:2903
 #1: ffff8880642b8b18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline]
 #1: ffff8880642b8b18 (&mm->mmap_lock){++++}-{3:3}, at: __get_user_pages_locked mm/gup.c:1726 [inline]
 #1: ffff8880642b8b18 (&mm->mmap_lock){++++}-{3:3}, at: get_dump_page+0xb6/0x220 mm/gup.c:2269
 #2: ffff888070f7dec0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:873 [inline]
 #2: ffff888070f7dec0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x2e2/0x2820 mm/filemap.c:3333

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
 watchdog+0xf0c/0x1240 kernel/hung_task.c:379
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 12643 Comm: syz.3.1265 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:sha256_transform_rorx+0xf21/0x1120 arch/x86/crypto/sha256-avx2-asm.S:655
Code: 45 21 d4 45 01 ef 45 01 c3 44 09 e6 45 01 f0 45 01 fb 45 01 f8 41 89 c7 c4 43 7b f0 eb 19 c4 43 7b f0 f3 0b 41 31 df 45 31 f5 <c4> 43 7b f0 f3 06 45 21 df 41 01 f0 45 31 f5 c4 43 7b f0 e0 0d 41
RSP: 0018:ffffc900047c7200 EFLAGS: 00000202
RAX: 0000000048b82930 RBX: 00000000f2664ade RCX: 000000000756817e
RDX: 00000000bb25b06b RSI: 000000002f27b56e RDI: 0000000000000040
RBP: ffffc900047c7420 R08: 00000000c8137308 R09: 000000002623ad2c
R10: 000000002df7d7fe R11: 0000000088034a2d R12: 000000002925906a
R13: 00000000441416ad R14: 0000000045b10069 R15: 00000000bade63ee
FS:  00007f9fefb496c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562a9d09e600 CR3: 000000006afec000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 lib_sha256_base_do_update include/crypto/sha256_base.h:63 [inline]
 sha256_base_do_update include/crypto/sha256_base.h:81 [inline]
 _sha256_update arch/x86/crypto/sha256_ssse3_glue.c:74 [inline]
 _sha256_update+0x17e/0x220 arch/x86/crypto/sha256_ssse3_glue.c:58
 ima_calc_file_hash_tfm+0x302/0x3e0 security/integrity/ima/ima_crypto.c:491
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
 ima_calc_file_hash+0x1ba/0x490 security/integrity/ima/ima_crypto.c:568
 ima_collect_measurement+0x8a7/0xa10 security/integrity/ima/ima_api.c:293
 process_measurement+0x1271/0x2370 security/integrity/ima/ima_main.c:372
 ima_file_mmap+0x1b3/0x1e0 security/integrity/ima/ima_main.c:462
 security_mmap_file+0x8bd/0x990 security/security.c:2978
 vm_mmap_pgoff+0xdb/0x360 mm/util.c:584
 ksys_mmap_pgoff+0x1c8/0x5c0 mm/mmap.c:542
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:79 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:79
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9feed7e759
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9fefb49038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f9feef35f80 RCX: 00007f9feed7e759
RDX: 00004000000000df RSI: 0000400000000004 RDI: 0000000000000000
RBP: 00007f9feedf175e R08: 0000000000000402 R09: 0000300000000000
R10: 0000000000040eb2 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9feef35f80 R15: 00007fff764dd968
 </TASK>