ieee802154 phy1 wpan1: encryption failed: -22
Bluetooth: hci1: command 0x0406 tx timeout
ieee802154 phy0 wpan0: encryption failed: -22
ieee802154 phy1 wpan1: encryption failed: -22
Bluetooth: hci2: command 0x0406 tx timeout
INFO: task syz-executor.4:13787 blocked for more than 140 seconds.
Not tainted 4.19.211-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D29728 13787 13481 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2828 [inline]
__schedule+0x887/0x2040 kernel/sched/core.c:3517
schedule+0x8d/0x1b0 kernel/sched/core.c:3561
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3619
__mutex_lock_common kernel/locking/mutex.c:1016 [inline]
__mutex_lock+0x5f0/0x1190 kernel/locking/mutex.c:1078
blk_trace_startstop+0x21/0x40 kernel/trace/blktrace.c:714
sg_ioctl+0x201d/0x2720 drivers/scsi/sg.c:1126
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fc89b1df0e9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc899b33168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc89b2f2030 RCX: 00007fc89b1df0e9
RDX: 0000000000000000 RSI: 0000000000001274 RDI: 0000000000000004
RBP: 00007fc89b23908d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffee69affcf R14: 00007fc899b33300 R15: 0000000000022000
INFO: task syz-executor.4:13792 blocked for more than 140 seconds.
Not tainted 4.19.211-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.4 D29704 13792 13481 0x00000004
Call Trace:
context_switch kernel/sched/core.c:2828 [inline]
__schedule+0x887/0x2040 kernel/sched/core.c:3517
schedule+0x8d/0x1b0 kernel/sched/core.c:3561
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3619
__mutex_lock_common kernel/locking/mutex.c:1016 [inline]
__mutex_lock+0x5f0/0x1190 kernel/locking/mutex.c:1078
blk_trace_setup+0x2f/0x60 kernel/trace/blktrace.c:626
sg_ioctl+0x270/0x2720 drivers/scsi/sg.c:1121
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fc89b1df0e9
Code: Bad RIP value.
RSP: 002b:00007fc899aaf168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc89b2f2370 RCX: 00007fc89b1df0e9
RDX: 00000000200000c0 RSI: 00000000c0481273 RDI: 0000000000000004
RBP: 00007fc89b23908d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffee69affcf R14: 00007fc899aaf300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/1570:
#0: 0000000035f7d19e (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441
3 locks held by kworker/u4:4/2888:
1 lock held by in:imklog/13372:
#0: 00000000a83d6427 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767
5 locks held by syz-executor.4/13767:
1 lock held by syz-executor.4/13787:
#0: 00000000cbed20cf (&q->blk_trace_mutex){+.+.}, at: blk_trace_startstop+0x21/0x40 kernel/trace/blktrace.c:714
1 lock held by syz-executor.4/13792:
#0: 00000000cbed20cf (&q->blk_trace_mutex){+.+.}, at: blk_trace_setup+0x2f/0x60 kernel/trace/blktrace.c:626
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
watchdog+0x991/0xe60 kernel/hung_task.c:287
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 13767 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__lock_release kernel/locking/lockdep.c:3665 [inline]
RIP: 0010:lock_release+0x1c6/0x8b0 kernel/locking/lockdep.c:3927
Code: 8b 34 25 c0 df 01 00 38 d0 7c 08 84 d2 0f 85 1b 06 00 00 44 8b 0d ba a5 fa 08 45 85 c9 0f 84 f3 01 00 00 49 8d 86 80 08 00 00 <48> 89 c2 48 89 44 24 08 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03
RSP: 0018:ffff8880ba106fd0 EFLAGS: 00000002
RAX: ffff88804b0bab80 RBX: ffff88804b0ba300 RCX: 1ffffffff148be2c
RDX: 0000000000000004 RSI: 0000000000000002 RDI: ffff88804b0bab84
RBP: ffffffff89f85fa0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffffffff8c66505b R12: 1ffff11017420dfd
R13: ffffffff8179861a R14: ffff88804b0ba300 R15: ffff8880ba1070a0
FS: 00007fc899b54700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fed99f94aa0 CR3: 000000003c2eb000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
rcu_lock_release include/linux/rcupdate.h:247 [inline]
rcu_read_unlock include/linux/rcupdate.h:681 [inline]
__perf_event_output kernel/events/core.c:6626 [inline]
perf_event_output_forward+0x191/0x270 kernel/events/core.c:6634
__perf_event_overflow+0x13c/0x370 kernel/events/core.c:7907
perf_swevent_hrtimer+0x272/0x3e0 kernel/events/core.c:9261
__run_hrtimer kernel/time/hrtimer.c:1465 [inline]
__hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1527
hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline]
smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:preempt_count_add+0x64/0x190 kernel/sched/core.c:3238
Code: 0b 85 c9 75 07 65 8b 05 ea 70 c0 7e 48 b8 00 00 00 00 00 fc ff df 48 89 da 83 e3 07 48 c1 ea 03 83 c3 03 65 01 2d cc 70 c0 7e <0f> b6 04 02 38 c3 7c 08 84 c0 0f 85 da 00 00 00 8b 15 c6 c8 e2 0b
RSP: 0018:ffff8880ba107718 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: 1ffffffff1a486ec RSI: ffff8880ba1076c0 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001
R10: ffff8880ba1078bf R11: 0000000000074071 R12: ffff8880ba1078a8
R13: 0000000000000000 R14: ffff8880ba107860 R15: 0000000000000200
unwind_next_frame+0x135/0x1400 arch/x86/kernel/unwind_orc.c:407
__save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44
save_stack mm/kasan/kasan.c:448 [inline]
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slab.c:3340 [inline]
kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666
__do_kmalloc_node mm/slab.c:3688 [inline]
__kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703
__kmalloc_reserve net/core/skbuff.c:137 [inline]
__alloc_skb+0xae/0x560 net/core/skbuff.c:205
skb_copy+0x139/0x2f0 net/core/skbuff.c:1358
mac80211_hwsim_tx_frame_no_nl.isra.0+0xb8a/0x1330 drivers/net/wireless/mac80211_hwsim.c:1353
mac80211_hwsim_tx_frame+0x12b/0x210 drivers/net/wireless/mac80211_hwsim.c:1556
mac80211_hwsim_beacon_tx+0x3f8/0x680 drivers/net/wireless/mac80211_hwsim.c:1595
__iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614
ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650
mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615
__tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601
tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522
__do_softirq+0x265/0x980 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x215/0x260 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline]
RIP: 0010:seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline]
RIP: 0010:read_seqcount_begin include/linux/seqlock.h:164 [inline]
RIP: 0010:read_seqbegin include/linux/seqlock.h:440 [inline]
RIP: 0010:zone_span_seqbegin include/linux/memory_hotplug.h:65 [inline]
RIP: 0010:page_outside_zone_boundaries mm/page_alloc.c:491 [inline]
RIP: 0010:bad_range+0x288/0x3c0 mm/page_alloc.c:520
Code: e9 ff 48 c7 c0 88 82 f1 89 48 c1 e8 03 80 3c 28 00 0f 85 29 01 00 00 48 83 3d 9b 0f 73 08 00 0f 84 80 00 00 00 4c 89 ff 57 9d <0f> 1f 44 00 00 e9 82 fe ff ff 0f 0b 0f 0b 4c 89 f9 4c 89 fa 48 c1
RSP: 0018:ffff8880aa28f520 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3051 RBX: ffff88823fff8d80 RCX: 1ffff1100961757a
RDX: 0000000000000000 RSI: ffff88804b0babb0 RDI: 0000000000000286
RBP: dffffc0000000000 R08: ffffffff8cd37af0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff13e3050
R13: 0000000000000000 R14: 1ffffffff13e3052 R15: 0000000000000286
rmqueue mm/page_alloc.c:3047 [inline]
get_page_from_freelist+0x1d60/0x4170 mm/page_alloc.c:3373
__alloc_pages_nodemask+0x387/0x2890 mm/page_alloc.c:4399
alloc_pages_current+0x193/0x2a0 mm/mempolicy.c:2197
alloc_pages include/linux/gfp.h:532 [inline]
relay_alloc_buf kernel/relay.c:136 [inline]
relay_create_buf kernel/relay.c:177 [inline]
relay_open_buf.part.0+0x2a8/0xb80 kernel/relay.c:453
relay_open_buf kernel/relay.c:450 [inline]
relay_open kernel/relay.c:605 [inline]
relay_open+0x537/0x9f0 kernel/relay.c:564
do_blk_trace_setup+0x4f6/0xb40 kernel/trace/blktrace.c:566
__blk_trace_setup+0xca/0x180 kernel/trace/blktrace.c:609
blk_trace_setup+0x43/0x60 kernel/trace/blktrace.c:627
sg_ioctl+0x270/0x2720 drivers/scsi/sg.c:1121
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fc89b1df0e9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc899b54168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc89b2f1f60 RCX: 00007fc89b1df0e9
RDX: 0000000020000140 RSI: 00000000c0481273 RDI: 0000000000000005
RBP: 00007fc89b23908d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffee69affcf R14: 00007fc899b54300 R15: 0000000000022000
----------------
Code disassembly (best guess):
0: 8b 34 25 c0 df 01 00 mov 0x1dfc0,%esi
7: 38 d0 cmp %dl,%al
9: 7c 08 jl 0x13
b: 84 d2 test %dl,%dl
d: 0f 85 1b 06 00 00 jne 0x62e
13: 44 8b 0d ba a5 fa 08 mov 0x8faa5ba(%rip),%r9d # 0x8faa5d4
1a: 45 85 c9 test %r9d,%r9d
1d: 0f 84 f3 01 00 00 je 0x216
23: 49 8d 86 80 08 00 00 lea 0x880(%r14),%rax
* 2a: 48 89 c2 mov %rax,%rdx <-- trapping instruction
2d: 48 89 44 24 08 mov %rax,0x8(%rsp)
32: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
39: fc ff df
3c: 48 c1 ea 03 shr $0x3,%rdx