syzbot


INFO: task hung in filemap_fault (3)

Status: closed as invalid on 2022/02/08 09:40
Subsystems: mm
[Documentation on labels]
First crash: 870d, last: 870d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in filemap_fault (5) mm fs 12 314d 692d 0/26 auto-obsoleted due to no activity on 2023/09/13 22:48
linux-6.1 INFO: task hung in filemap_fault 2 329d 353d 0/3 auto-obsoleted due to no activity on 2023/09/09 11:34
linux-5.15 INFO: task hung in filemap_fault 1 247d 247d 0/3 auto-obsoleted due to no activity on 2023/11/29 22:47
upstream INFO: task hung in filemap_fault mm 24 2299d 2320d 0/26 closed as invalid on 2018/02/13 19:52
android-44 INFO: task hung in filemap_fault 3 2229d 2231d 0/2 auto-closed as invalid on 2019/02/22 14:09
android-49 INFO: task hung in filemap_fault 4 2122d 2169d 0/3 auto-closed as invalid on 2019/02/22 14:49
upstream INFO: task hung in filemap_fault (2) mm 5 2012d 2216d 0/26 auto-closed as invalid on 2019/04/20 06:20
upstream INFO: task hung in filemap_fault (4) mm 1 789d 789d 0/26 auto-closed as invalid on 2022/05/27 12:14

Sample crash report:
INFO: task syz-executor.1:21641 blocked for more than 143 seconds.
      Not tainted 5.16.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1  state:D stack:26880 pid:21641 ppid:  6577 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
 __down_read_common kernel/locking/rwsem.c:1223 [inline]
 __down_read kernel/locking/rwsem.c:1232 [inline]
 down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
 filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4164 [inline]
 do_fault mm/memory.c:4293 [inline]
 handle_pte_fault mm/memory.c:4551 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4686
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4784
 faultin_page mm/gup.c:939 [inline]
 __get_user_pages+0x522/0xfb0 mm/gup.c:1160
 populate_vma_page_range+0x24d/0x330 mm/gup.c:1492
 __mm_populate+0x1ea/0x3e0 mm/gup.c:1601
 mm_populate include/linux/mm.h:2734 [inline]
 vm_mmap_pgoff+0x20e/0x290 mm/util.c:524
 ksys_mmap_pgoff+0x40d/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3db5cc1ae9
RSP: 002b:00007f3db4c37188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f3db5dd4f60 RCX: 00007f3db5cc1ae9
RDX: 0000000001000002 RSI: 0000000000b36024 RDI: 0000000020000000
RBP: 00007f3db5d1bff7 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdb51dd4bf R14: 00007f3db4c37300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.1:21646 blocked for more than 144 seconds.
      Not tainted 5.16.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1  state:D stack:28632 pid:21646 ppid:  6577 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
 __down_read_common kernel/locking/rwsem.c:1223 [inline]
 __down_read kernel/locking/rwsem.c:1232 [inline]
 down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
 filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4164 [inline]
 do_fault mm/memory.c:4293 [inline]
 handle_pte_fault mm/memory.c:4551 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4686
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4784
 faultin_page mm/gup.c:939 [inline]
 __get_user_pages+0x522/0xfb0 mm/gup.c:1160
 populate_vma_page_range+0x24d/0x330 mm/gup.c:1492
 __mm_populate+0x1ea/0x3e0 mm/gup.c:1601
 mm_populate include/linux/mm.h:2734 [inline]
 vm_mmap_pgoff+0x20e/0x290 mm/util.c:524
 ksys_mmap_pgoff+0x40d/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3db5cc1ae9
RSP: 002b:00007f3db4c16188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f3db5dd5028 RCX: 00007f3db5cc1ae9
RDX: 0000000001000002 RSI: 0000000000b36024 RDI: 0000000020000000
RBP: 00007f3db5d1bff7 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdb51dd4bf R14: 00007f3db4c16300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.0:21645 blocked for more than 144 seconds.
      Not tainted 5.16.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:26880 pid:21645 ppid:  6576 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
 __down_read_common kernel/locking/rwsem.c:1223 [inline]
 __down_read kernel/locking/rwsem.c:1232 [inline]
 down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
 filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4164 [inline]
 do_fault mm/memory.c:4293 [inline]
 handle_pte_fault mm/memory.c:4551 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4686
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4784
 faultin_page mm/gup.c:939 [inline]
 __get_user_pages+0x522/0xfb0 mm/gup.c:1160
 populate_vma_page_range+0x24d/0x330 mm/gup.c:1492
 __mm_populate+0x1ea/0x3e0 mm/gup.c:1601
 mm_populate include/linux/mm.h:2734 [inline]
 vm_mmap_pgoff+0x20e/0x290 mm/util.c:524
 ksys_mmap_pgoff+0x40d/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbfd44c3ae9
RSP: 002b:00007fbfd3439188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fbfd45d6f60 RCX: 00007fbfd44c3ae9
RDX: 0000000001000002 RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 00007fbfd451dff7 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc5bae56ff R14: 00007fbfd3439300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.0:21652 blocked for more than 145 seconds.
      Not tainted 5.16.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:29712 pid:21652 ppid:  6576 flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1151
 __down_write_common kernel/locking/rwsem.c:1268 [inline]
 __down_write_common kernel/locking/rwsem.c:1265 [inline]
 __down_write kernel/locking/rwsem.c:1277 [inline]
 down_write+0x135/0x150 kernel/locking/rwsem.c:1524
 filemap_invalidate_lock include/linux/fs.h:828 [inline]
 blkdev_fallocate+0x1e2/0x420 block/fops.c:625
 vfs_fallocate+0x48d/0xe10 fs/open.c:307
 madvise_remove mm/madvise.c:925 [inline]
 madvise_vma mm/madvise.c:987 [inline]
 do_madvise.part.0+0xb60/0x2250 mm/madvise.c:1202
 do_madvise mm/madvise.c:1228 [inline]
 __do_sys_madvise mm/madvise.c:1228 [inline]
 __se_sys_madvise mm/madvise.c:1226 [inline]
 __x64_sys_madvise+0x113/0x150 mm/madvise.c:1226
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbfd44c3ae9
RSP: 002b:00007fbfd3418188 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007fbfd45d7028 RCX: 00007fbfd44c3ae9
RDX: 0000000000000009 RSI: 0000000000600003 RDI: 0000000020000000
RBP: 00007fbfd451dff7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc5bae56ff R14: 00007fbfd3418300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.3:21647 blocked for more than 145 seconds.
      Not tainted 5.16.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3  state:D stack:26880 pid:21647 ppid:  6575 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
 __down_read_common kernel/locking/rwsem.c:1223 [inline]
 __down_read kernel/locking/rwsem.c:1232 [inline]
 down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
 filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4164 [inline]
 do_fault mm/memory.c:4293 [inline]
 handle_pte_fault mm/memory.c:4551 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4686
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4784
 faultin_page mm/gup.c:939 [inline]
 __get_user_pages+0x522/0xfb0 mm/gup.c:1160
 populate_vma_page_range+0x24d/0x330 mm/gup.c:1492
 __mm_populate+0x1ea/0x3e0 mm/gup.c:1601
 mm_populate include/linux/mm.h:2734 [inline]
 vm_mmap_pgoff+0x20e/0x290 mm/util.c:524
 ksys_mmap_pgoff+0x40d/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f8c4a4a8ae9
RSP: 002b:00007f8c4941e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f8c4a5bbf60 RCX: 00007f8c4a4a8ae9
RDX: 0000000001000002 RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 00007f8c4a502ff7 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc3860f2cf R14: 00007f8c4941e300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.5:21660 blocked for more than 146 seconds.
      Not tainted 5.16.0-rc4-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.5  state:D stack:26056 pid:21660 ppid:  6574 flags:0x00000006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:4972 [inline]
 __schedule+0xa9a/0x4940 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
 __down_read_common kernel/locking/rwsem.c:1223 [inline]
 __down_read kernel/locking/rwsem.c:1232 [inline]
 down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
 filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 page_cache_ra_unbounded+0x1b3/0x940 mm/readahead.c:194
 do_page_cache_ra+0xf9/0x140 mm/readahead.c:268
 do_sync_mmap_readahead mm/filemap.c:2996 [inline]
 filemap_fault+0x1562/0x26d0 mm/filemap.c:3089
 __do_fault+0x10d/0x4d0 mm/memory.c:3849
 do_read_fault mm/memory.c:4164 [inline]
 do_fault mm/memory.c:4293 [inline]
 handle_pte_fault mm/memory.c:4551 [inline]
 __handle_mm_fault+0x28e8/0x5120 mm/memory.c:4686
 handle_mm_fault+0x1c8/0x790 mm/memory.c:4784
 faultin_page mm/gup.c:939 [inline]
 __get_user_pages+0x522/0xfb0 mm/gup.c:1160
 populate_vma_page_range+0x24d/0x330 mm/gup.c:1492
 __mm_populate+0x1ea/0x3e0 mm/gup.c:1601
 mm_populate include/linux/mm.h:2734 [inline]
 vm_mmap_pgoff+0x20e/0x290 mm/util.c:524
 ksys_mmap_pgoff+0x40d/0x5a0 mm/mmap.c:1623
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f1d4617eae9
RSP: 002b:00007f1d450d3188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f1d46292028 RCX: 00007f1d4617eae9
RDX: 0000000001000002 RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 00007f1d461d8ff7 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000028011 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc6087664f R14: 00007f1d450d3300 R15: 0000000000022000
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8bb811a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
3 locks held by kworker/u4:2/44:
 #0: ffff8880b9d39b18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
 #1: ffffc90001157db0 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
 #2: ffff8880b9d28298 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x5a/0x1f0 kernel/time/timer.c:946
1 lock held by kswapd0/98:
1 lock held by in:imklog/6292:
 #0: ffff8880246fa1b0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:994
2 locks held by syz-executor.1/21641:
 #0: ffff888078911228 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 #0: ffff888078911228 (&mm->mmap_lock#2){++++}-{3:3}, at: __mm_populate+0x264/0x3e0 mm/gup.c:1581
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
2 locks held by syz-executor.1/21646:
 #0: ffff888078911228 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 #0: ffff888078911228 (&mm->mmap_lock#2){++++}-{3:3}, at: __mm_populate+0x264/0x3e0 mm/gup.c:1581
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
1 lock held by syz-executor.4/21639:
1 lock held by syz-executor.4/21654:
2 locks held by syz-executor.0/21645:
 #0: ffff888018f53268 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 #0: ffff888018f53268 (&mm->mmap_lock#2){++++}-{3:3}, at: __mm_populate+0x264/0x3e0 mm/gup.c:1581
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
1 lock held by syz-executor.0/21652:
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:828 [inline]
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x1e2/0x420 block/fops.c:625
2 locks held by syz-executor.3/21647:
 #0: ffff88807b2b58e8 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 #0: ffff88807b2b58e8 (&mm->mmap_lock#2){++++}-{3:3}, at: __mm_populate+0x264/0x3e0 mm/gup.c:1581
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #1: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xc7e/0x26d0 mm/filemap.c:3081
1 lock held by syz-executor.5/21660:
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b3/0x940 mm/readahead.c:194
1 lock held by syz-executor.2/21665:
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b3/0x940 mm/readahead.c:194
1 lock held by syz-executor.2/21666:
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:838 [inline]
 #0: ffff8880171daa08 (mapping.invalidate_lock#2){++++}-{3:3}, at: page_cache_ra_unbounded+0x1b3/0x940 mm/readahead.c:194

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
 watchdog+0xc1d/0xf50 kernel/hung_task.c:295
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6292 Comm: in:imklog Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__sanitizer_cov_trace_switch+0x59/0xf0 kernel/kcov.c:323
Code: 85 83 00 00 00 bb 03 00 00 00 4d 8b 10 31 c9 65 4c 8b 24 25 40 70 02 00 4d 85 d2 74 6b 4c 89 e6 bf 03 00 00 00 4c 8b 4c 24 20 <49> 8b 6c c8 10 e8 2d ff ff ff 84 c0 74 47 49 8b 84 24 88 15 00 00
RSP: 0018:ffffc9000c2df6a0 EFLAGS: 00000206
RAX: 0000000000000008 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffff88801abd81c0 RDI: 0000000000000003
RBP: ffffc9000c2df7e0 R08: ffffffff8a0834a0 R09: ffffffff84000a2a
R10: 0000000000000005 R11: 0000000000000075 R12: ffff88801abd81c0
R13: ffffffff89acb3c2 R14: 1ffff9200185bedc R15: 0000000000000075
FS:  00007fa44d0f9700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f031cca7000 CR3: 000000006e544000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 format_decode+0x20a/0xad0 lib/vsprintf.c:2556
 vsnprintf+0x157/0x14f0 lib/vsprintf.c:2757
 snprintf+0xbb/0xf0 lib/vsprintf.c:2938
 print_caller kernel/printk/printk.c:1270 [inline]
 info_print_prefix+0x11c/0x340 kernel/printk/printk.c:1289
 record_print_text+0x14d/0x3e0 kernel/printk/printk.c:1336
 syslog_print+0x48a/0x580 kernel/printk/printk.c:1536
 do_syslog.part.0+0x202/0x640 kernel/printk/printk.c:1655
 do_syslog+0x49/0x60 kernel/printk/printk.c:1640
 kmsg_read+0x90/0xb0 fs/proc/kmsg.c:40
 pde_read fs/proc/inode.c:311 [inline]
 proc_reg_read+0x119/0x300 fs/proc/inode.c:321
 vfs_read+0x1b5/0x600 fs/read_write.c:479
 ksys_read+0x12d/0x250 fs/read_write.c:619
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fa44f73c22d
Code: c1 20 00 00 75 10 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 4e fc ff ff 48 89 04 24 b8 00 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 97 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fa44d0d8580 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa44f73c22d
RDX: 0000000000001fa0 RSI: 00007fa44d0d8da0 RDI: 0000000000000004
RBP: 000055fd5d77f9d0 R08: 0000000000000000 R09: 0000000000000000
R10: 2ce33e6c02ce33e7 R11: 0000000000000293 R12: 00007fa44d0d8da0
R13: 0000000000001fa0 R14: 0000000000001f9f R15: 00007fa44d0d8e1e
 </TASK>
----------------
Code disassembly (best guess):
   0:	85 83 00 00 00 bb    	test   %eax,-0x45000000(%rbx)
   6:	03 00                	add    (%rax),%eax
   8:	00 00                	add    %al,(%rax)
   a:	4d 8b 10             	mov    (%r8),%r10
   d:	31 c9                	xor    %ecx,%ecx
   f:	65 4c 8b 24 25 40 70 	mov    %gs:0x27040,%r12
  16:	02 00
  18:	4d 85 d2             	test   %r10,%r10
  1b:	74 6b                	je     0x88
  1d:	4c 89 e6             	mov    %r12,%rsi
  20:	bf 03 00 00 00       	mov    $0x3,%edi
  25:	4c 8b 4c 24 20       	mov    0x20(%rsp),%r9
* 2a:	49 8b 6c c8 10       	mov    0x10(%r8,%rcx,8),%rbp <-- trapping instruction
  2f:	e8 2d ff ff ff       	callq  0xffffff61
  34:	84 c0                	test   %al,%al
  36:	74 47                	je     0x7f
  38:	49 8b 84 24 88 15 00 	mov    0x1588(%r12),%rax
  3f:	00

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/12/06 17:30 upstream 0fcfb00b28c0 579a8754 .config console log report info ci-upstream-kasan-gce-selinux-root INFO: task hung in filemap_fault
* Struck through repros no longer work on HEAD.