syzbot

INFO: task syz.1.28:5996 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.28        state:D stack:25264 pid:5996  ppid:5904   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 rwsem_down_write_slowpath+0xbd2/0xfa0 kernel/locking/rwsem.c:1178
 __down_write_common kernel/locking/rwsem.c:1306 [inline]
 __down_write kernel/locking/rwsem.c:1315 [inline]
 down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1574
 mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 exit_mmap+0x245/0xb50 mm/mmap.c:3310
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exit_mm+0x1da/0x2c0 kernel/exit.c:569
 do_exit+0x88e/0x23c0 kernel/exit.c:870
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 __do_sys_exit_group kernel/exit.c:1035 [inline]
 __se_sys_exit_group kernel/exit.c:1033 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1033
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f10d9d8f749
RSP: 002b:00007fff4afa2dc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f10d9d8f749
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fff4afa2e2c R08: 000000054afa2ebf R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 000000000002b281 R15: 00007fff4afa2e80
 </TASK>
INFO: task dhcpcd-run-hook:5998 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd-run-hook state:D stack:23792 pid:5998  ppid:5976   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 rwsem_down_write_slowpath+0xbd2/0xfa0 kernel/locking/rwsem.c:1178
 __down_write_common kernel/locking/rwsem.c:1306 [inline]
 __down_write kernel/locking/rwsem.c:1315 [inline]
 down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1574
 mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 exit_mmap+0x245/0xb50 mm/mmap.c:3310
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exec_mmap+0x584/0x640 fs/exec.c:1036
 begin_new_exec+0xa2e/0x1eb0 fs/exec.c:1294
 load_elf_binary+0x9a0/0x2700 fs/binfmt_elf.c:1027
 search_binary_handler fs/exec.c:1775 [inline]
 exec_binprm fs/exec.c:1817 [inline]
 bprm_execve+0xaeb/0x16f0 fs/exec.c:1892
 do_execveat_common+0x51b/0x6c0 fs/exec.c:1998
 do_execve fs/exec.c:2072 [inline]
 __do_sys_execve fs/exec.c:2148 [inline]
 __se_sys_execve fs/exec.c:2143 [inline]
 __x64_sys_execve+0x92/0xa0 fs/exec.c:2143
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f4f38399107
RSP: 002b:00007ffd642b6258 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00005586cb4f5fe0 RCX: 00007f4f38399107
RDX: 00005586cb4f6000 RSI: 00005586cb4f5fe0 RDI: 00005586cb4f6088
RBP: 00005586cb4f6088 R08: 00007ffd642b8eb6 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00005586cb4f6000
R13: 00007f4f3855ee8b R14: 00005586cb4f6000 R15: 0000000000000000
 </TASK>
INFO: task syz.3.110:6092 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.110       state:D stack:24464 pid:6092  ppid:5906   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 rwsem_down_write_slowpath+0xbd2/0xfa0 kernel/locking/rwsem.c:1178
 __down_write_common kernel/locking/rwsem.c:1306 [inline]
 __down_write kernel/locking/rwsem.c:1315 [inline]
 down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1574
 mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 exit_mmap+0x245/0xb50 mm/mmap.c:3310
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exit_mm+0x1da/0x2c0 kernel/exit.c:569
 do_exit+0x88e/0x23c0 kernel/exit.c:870
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 __do_sys_exit_group kernel/exit.c:1035 [inline]
 __se_sys_exit_group kernel/exit.c:1033 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1033
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fbdeeb8f749
RSP: 002b:00007fff08fea868 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbdeeb8f749
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fff08fea8cc R08: 0000000508fea95f R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000047
R13: 00000000000927c0 R14: 000000000002c8bc R15: 00007fff08fea920
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8cd2ffa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8cd2ffa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8cd2ffa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u5:0/51:
 #0: ffff888143762d38 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #0: ffff888143762d38 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #1: ffffc90000bc7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #1: ffffc90000bc7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #2: ffff88807cce0e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x390 net/bluetooth/hci_sync.c:326
1 lock held by klogd/5133:
2 locks held by udevd/5144:
 #0: ffffffff8cdd2210 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:657 [inline]
 #0: ffffffff8cdd2210 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1692 [inline]
 #0: ffffffff8cdd2210 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x268/0x1ca0 kernel/fork.c:1741
 #1: ffff88807d79baa0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:124 [inline]
 #1: ffff88807d79baa0 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:658 [inline]
 #1: ffff88807d79baa0 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1692 [inline]
 #1: ffff88807d79baa0 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x283/0x1ca0 kernel/fork.c:1741
2 locks held by getty/5531:
 #0: ffff88802d1630a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
1 lock held by syz-execprog/5792:
 #0: ffff888022053aa0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:124 [inline]
 #0: ffff888022053aa0 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x168/0x400 mm/util.c:554
1 lock held by syz-executor/5900:
 #0: ffff88806cb573a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88806cb573a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/5904:
 #0: ffff88806cb560a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88806cb560a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/5906:
 #0: ffff88806cb56a20 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88806cb56a20 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by udevd/5970:
 #0: ffff888020c660a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:124 [inline]
 #0: ffff888020c660a0 (&mm->mmap_lock){++++}-{3:3}, at: __vm_munmap+0x14a/0x3c0 mm/mmap.c:2958
1 lock held by syz.1.28/5996:
 #0: ffff88802f0473a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88802f0473a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
3 locks held by dhcpcd-run-hook/5998:
 #0: ffff888026918c08 (&sig->cred_guard_mutex){+.+.}-{3:3}, at: prepare_bprm_creds fs/exec.c:1499 [inline]
 #0: ffff888026918c08 (&sig->cred_guard_mutex){+.+.}-{3:3}, at: bprm_execve+0xca/0x16f0 fs/exec.c:1854
 #1: ffff888026918ca0 (&sig->exec_update_lock){++++}-{3:3}, at: exec_mmap+0xe9/0x640 fs/exec.c:991
 #2: ffff88802db8d720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #2: ffff88802db8d720 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz.3.110/6092:
 #0: ffff888022051e20 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff888022051e20 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/6374:
 #0: ffff88802db8f3a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88802db8f3a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/6383:
 #0: ffff88806c6c27a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88806c6c27a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz.4.458/6490:
 #0: ffff8880307f5720 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff8880307f5720 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz.6.548/6605:
 #0: ffff888020c63aa0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff888020c63aa0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/6771:
 #0: ffff88802fca27a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88802fca27a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/6820:
 #0: ffff88805fb04420 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88805fb04420 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz-executor/6824:
 #0: ffff888020c63120 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff888020c63120 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz.7.743/6953:
 #0: ffff88802db881a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88802db881a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310
1 lock held by syz.2.826/6954:
 #0: ffff88802c5a94a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:108 [inline]
 #0: ffff88802c5a94a0 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x245/0xb50 mm/mmap.c:3310

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf41/0xf80 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 59 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:kasan_check_range+0x1c2/0x290 mm/kasan/generic.c:-1
Code: 5c 24 07 4d 85 e4 49 0f 49 dc 48 83 e3 f8 49 29 dc 74 12 41 80 3b 00 0f 85 a6 00 00 00 49 ff c3 49 ff cc 75 ee 5b 41 5c 41 5d <41> 5e 41 5f 5d c3 45 84 ff 75 61 41 f7 c7 00 ff 00 00 75 5d 41 f7
RSP: 0018:ffffc900015a7538 EFLAGS: 00000256
RAX: ffffc900015a7901 RBX: 0000000000000010 RCX: ffffffff813ab988
RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc900015a7698
RBP: 0000000000000000 R08: ffffc900015a76a7 R09: 1ffff920002b4ed4
R10: dffffc0000000000 R11: fffff520002b4ed5 R12: ffffc900015a7648
R13: dffffc0000000000 R14: fffff520002b4ed5 R15: 1ffff920002b4ed3
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb7791e7da0 CR3: 0000000026901000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 __asan_memset+0x22/0x40 mm/kasan/shadow.c:84
 unwind_next_frame+0x1648/0x2970 arch/x86/kernel/unwind_orc.c:592
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc_node_track_caller+0xb2/0x230 mm/slab_common.c:1027
 kmalloc_reserve+0x116/0x240 net/core/skbuff.c:584
 __alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
 alloc_skb include/linux/skbuff.h:1284 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
 nsim_dev_trap_report_work+0x293/0xb00 drivers/net/netdevsim/dev.c:851
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>