syzbot

INFO: task syz-executor227:3730 blocked for more than 143 seconds.
      Not tainted 5.18.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor227 state:D stack:25656 pid: 3730 ppid:  3644 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5073 [inline]
 __schedule+0x939/0xea0 kernel/sched/core.c:6388
 schedule+0xeb/0x1b0 kernel/sched/core.c:6460
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1860
 do_wait_for_common+0x3ea/0x560 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x46/0x60 kernel/sched/completion.c:138
 __flush_work kernel/workqueue.c:3075 [inline]
 __cancel_work_timer+0x585/0x740 kernel/workqueue.c:3162
 p9_conn_destroy net/9p/trans_fd.c:884 [inline]
 p9_fd_close+0x248/0x3c0 net/9p/trans_fd.c:919
 p9_client_destroy+0xc8/0x680 net/9p/client.c:1089
 v9fs_session_close+0x4d/0x200 fs/9p/v9fs.c:504
 v9fs_kill_super+0x58/0x90 fs/9p/vfs_super.c:226
 deactivate_locked_super+0xa7/0xf0 fs/super.c:332
 v9fs_mount+0x7f0/0x970 fs/9p/vfs_super.c:207
 legacy_get_tree+0xea/0x180 fs/fs_context.c:610
 vfs_get_tree+0x88/0x270 fs/super.c:1497
 do_new_mount+0x289/0xad0 fs/namespace.c:3040
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7efe04c5d8a9
RSP: 002b:00007efe04c0a208 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007efe04ce24c8 RCX: 00007efe04c5d8a9
RDX: 00000000200001c0 RSI: 0000000020000040 RDI: 0000000000000000
RBP: 00007efe04ce24c0 R08: 0000000020000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007efe04ce24cc
R13: 00007ffc53db457f R14: 00007efe04c0a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor227:3802 blocked for more than 143 seconds.
      Not tainted 5.18.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor227 state:D stack:24856 pid: 3802 ppid:  3645 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5073 [inline]
 __schedule+0x939/0xea0 kernel/sched/core.c:6388
 schedule+0xeb/0x1b0 kernel/sched/core.c:6460
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1860
 do_wait_for_common+0x3ea/0x560 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x46/0x60 kernel/sched/completion.c:138
 __flush_work kernel/workqueue.c:3075 [inline]
 __cancel_work_timer+0x585/0x740 kernel/workqueue.c:3162
 p9_conn_destroy net/9p/trans_fd.c:884 [inline]
 p9_fd_close+0x248/0x3c0 net/9p/trans_fd.c:919
 p9_client_destroy+0xc8/0x680 net/9p/client.c:1089
 v9fs_session_close+0x4d/0x200 fs/9p/v9fs.c:504
 v9fs_kill_super+0x58/0x90 fs/9p/vfs_super.c:226
 deactivate_locked_super+0xa7/0xf0 fs/super.c:332
 v9fs_mount+0x7f0/0x970 fs/9p/vfs_super.c:207
 legacy_get_tree+0xea/0x180 fs/fs_context.c:610
 vfs_get_tree+0x88/0x270 fs/super.c:1497
 do_new_mount+0x289/0xad0 fs/namespace.c:3040
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7efe04c5d8a9
RSP: 002b:00007efe04c0a208 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007efe04ce24c8 RCX: 00007efe04c5d8a9
RDX: 00000000200001c0 RSI: 0000000020000040 RDI: 0000000000000000
RBP: 00007efe04ce24c0 R08: 0000000020000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007efe04ce24cc
R13: 00007ffc53db457f R14: 00007efe04c0a300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor227:3831 blocked for more than 143 seconds.
      Not tainted 5.18.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor227 state:D stack:26496 pid: 3831 ppid:  3647 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5073 [inline]
 __schedule+0x939/0xea0 kernel/sched/core.c:6388
 schedule+0xeb/0x1b0 kernel/sched/core.c:6460
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1860
 do_wait_for_common+0x3ea/0x560 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x46/0x60 kernel/sched/completion.c:138
 __flush_work kernel/workqueue.c:3075 [inline]
 __cancel_work_timer+0x585/0x740 kernel/workqueue.c:3162
 p9_conn_destroy net/9p/trans_fd.c:884 [inline]
 p9_fd_close+0x248/0x3c0 net/9p/trans_fd.c:919
 p9_client_destroy+0xc8/0x680 net/9p/client.c:1089
 v9fs_session_close+0x4d/0x200 fs/9p/v9fs.c:504
 v9fs_kill_super+0x58/0x90 fs/9p/vfs_super.c:226
 deactivate_locked_super+0xa7/0xf0 fs/super.c:332
 v9fs_mount+0x7f0/0x970 fs/9p/vfs_super.c:207
 legacy_get_tree+0xea/0x180 fs/fs_context.c:610
 vfs_get_tree+0x88/0x270 fs/super.c:1497
 do_new_mount+0x289/0xad0 fs/namespace.c:3040
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7efe04c5d8a9
RSP: 002b:00007efe04c0a208 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007efe04ce24c8 RCX: 00007efe04c5d8a9
RDX: 00000000200001c0 RSI: 0000000020000040 RDI: 0000000000000000
RBP: 00007efe04ce24c0 R08: 0000000020000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007efe04ce24cc
R13: 00007ffc53db457f R14: 00007efe04c0a300 R15: 0000000000022000
 </TASK>

Showing all locks held in the system:
2 locks held by kworker/0:1/14:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262
 #1: ffffc90000137d00 ((work_completion)(&m->rq)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264
2 locks held by kworker/1:0/22:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262
 #1: ffffc900001c7d00 ((work_completion)(&m->rq)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264
1 lock held by khungtaskd/27:
 #0: ffffffff8c91ae60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by kworker/0:2/141:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262
 #1: ffffc90002067d00 ((work_completion)(&m->rq)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264
2 locks held by getty/3274:
 #0: ffff88807f6b8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc90002e632e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ad/0x1c90 drivers/tty/n_tty.c:2075
2 locks held by kworker/1:3/3681:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262
 #1: ffffc90000107d00 ((work_completion)(&m->rq)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264
2 locks held by kworker/0:3/3707:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262
 #1: ffffc90003cefd00 ((work_completion)(&m->rq)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264
2 locks held by kworker/1:4/4728:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262
 #1: ffffc900051c7d00 ((work_completion)(&m->rq)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.18.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 nmi_cpu_backtrace+0x473/0x4a0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x168/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xcf9/0xd40 kernel/hung_task.c:369
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 1238 Comm: kworker/u4:5 Not tainted 5.18.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:cr4_update_irqsoff+0x5f/0xa0 arch/x86/kernel/cpu/common.c:499
Code: 00 74 16 65 8b 05 21 b8 cf 7e 85 c0 75 0b 65 8b 05 06 b5 cf 7e 85 c0 75 29 48 f7 d3 4c 21 fb 4c 09 f3 4c 39 fb 75 06 5b 41 5e <41> 5f c3 65 48 89 1d ce d1 d0 7e 48 89 df 5b 41 5e 41 5f e9 29 ff
RSP: 0018:ffffc900055175d0 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff888020967570 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffc900055176f0 R08: dffffc0000000000 R09: ffffed100412ceaf
R10: ffffed100412ceaf R11: 1ffff1100412ceae R12: ffff888020967000
R13: dffffc0000000000 R14: ffff888020967000 R15: 00000000003506e0
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020001000 CR3: 0000000075d95000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 switch_mm_irqs_off+0x644/0x910 arch/x86/mm/tlb.c:645
 context_switch kernel/sched/core.c:5059 [inline]
 __schedule+0x778/0xea0 kernel/sched/core.c:6388
 preempt_schedule_common+0x93/0xe0 kernel/sched/core.c:6553
 preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6577
 preempt_schedule_thunk+0x16/0x18
 on_each_cpu_cond_mask+0x71/0x80 kernel/smp.c:1136
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1184 [inline]
 text_poke_bp_batch+0x653/0x960 arch/x86/kernel/alternative.c:1425
 text_poke_flush arch/x86/kernel/alternative.c:1542 [inline]
 text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1549
 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x129/0x250 kernel/jump_label.c:177
 static_key_enable+0x16/0x20 kernel/jump_label.c:190
 toggle_allocation_gate+0xbf/0x470 mm/kfence/core.c:764
 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 74 16 65          	add    %dh,0x65(%rsi,%rdx,1)
   4:	8b 05 21 b8 cf 7e    	mov    0x7ecfb821(%rip),%eax        # 0x7ecfb82b
   a:	85 c0                	test   %eax,%eax
   c:	75 0b                	jne    0x19
   e:	65 8b 05 06 b5 cf 7e 	mov    %gs:0x7ecfb506(%rip),%eax        # 0x7ecfb51b
  15:	85 c0                	test   %eax,%eax
  17:	75 29                	jne    0x42
  19:	48 f7 d3             	not    %rbx
  1c:	4c 21 fb             	and    %r15,%rbx
  1f:	4c 09 f3             	or     %r14,%rbx
  22:	4c 39 fb             	cmp    %r15,%rbx
  25:	75 06                	jne    0x2d
  27:	5b                   	pop    %rbx
  28:	41 5e                	pop    %r14
* 2a:	41 5f                	pop    %r15 <-- trapping instruction
  2c:	c3                   	retq
  2d:	65 48 89 1d ce d1 d0 	mov    %rbx,%gs:0x7ed0d1ce(%rip)        # 0x7ed0d203
  34:	7e
  35:	48 89 df             	mov    %rbx,%rdi
  38:	5b                   	pop    %rbx
  39:	41 5e                	pop    %r14
  3b:	41 5f                	pop    %r15
  3d:	e9                   	.byte 0xe9
  3e:	29 ff                	sub    %edi,%edi