syzbot

INFO: task kworker/u4:3:1200 blocked for more than 120 seconds.
      Not tainted 4.13.0-rc6+ #28
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:3    D14000  1200      2 0x00000000
Workqueue: kkcmd kcm_tx_work
Call Trace:
 context_switch kernel/sched/core.c:2771 [inline]
 __schedule+0x8e8/0x2070 kernel/sched/core.c:3332
 schedule+0x108/0x440 kernel/sched/core.c:3391
 __lock_sock+0x1dc/0x2f0 net/core/sock.c:2245
 lock_sock_nested+0xf3/0x110 net/core/sock.c:2766
 lock_sock include/net/sock.h:1459 [inline]
 kcm_sendpage+0x16e/0x1880 net/kcm/kcmsock.c:774
 kernel_sendpage+0x8d/0xe0 net/socket.c:3387
 kcm_write_msgs+0x404/0x1b80 net/kcm/kcmsock.c:646
 kcm_tx_work+0x2e/0x190 net/kcm/kcmsock.c:731
 process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2097
 worker_thread+0x223/0x1860 kernel/workqueue.c:2231
 kthread+0x35e/0x430 kernel/kthread.c:231
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425

Showing all locks held in the system:
2 locks held by khungtaskd/635:
 #0:  (rcu_read_lock){......}, at: [<ffffffff816eed85>] check_hung_uninterruptible_tasks kernel/hung_task.c:175 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff816eed85>] watchdog+0x1c5/0xd60 kernel/hung_task.c:249
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff81550bc2>] debug_show_all_locks+0xd2/0x410 kernel/locking/lockdep.c:4417
3 locks held by kworker/u4:3/1200:
 #0:  ("%s""kkcmd"){.+.+..}, at: [<ffffffff81474e7f>] __write_once_size include/linux/compiler.h:279 [inline]
 #0:  ("%s""kkcmd"){.+.+..}, at: [<ffffffff81474e7f>] atomic64_set arch/x86/include/asm/atomic64_64.h:33 [inline]
 #0:  ("%s""kkcmd"){.+.+..}, at: [<ffffffff81474e7f>] atomic_long_set include/asm-generic/atomic-long.h:56 [inline]
 #0:  ("%s""kkcmd"){.+.+..}, at: [<ffffffff81474e7f>] set_work_data kernel/workqueue.c:617 [inline]
 #0:  ("%s""kkcmd"){.+.+..}, at: [<ffffffff81474e7f>] set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0:  ("%s""kkcmd"){.+.+..}, at: [<ffffffff81474e7f>] process_one_work+0xadf/0x1bc0 kernel/workqueue.c:2090
 #1:  ((&kcm->tx_work)){+.+...}, at: [<ffffffff81474ed2>] process_one_work+0xb32/0x1bc0 kernel/workqueue.c:2094
 #2:  (sk_lock-AF_KCM){+.+.+.}, at: [<ffffffff8467b376>] lock_sock include/net/sock.h:1459 [inline]
 #2:  (sk_lock-AF_KCM){+.+.+.}, at: [<ffffffff8467b376>] kcm_tx_work+0x26/0x190 net/kcm/kcmsock.c:726
1 lock held by rsyslogd/2841:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff81b1353b>] __fdget_pos+0x12b/0x190 fs/file.c:767
2 locks held by getty/2924:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133
2 locks held by getty/2925:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133
2 locks held by getty/2926:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133
2 locks held by getty/2927:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133
2 locks held by getty/2928:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133
2 locks held by getty/2929:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133
2 locks held by getty/2930:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff84d06b77>] ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:367
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff826e35cf>] n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2133

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 635 Comm: khungtaskd Not tainted 4.13.0-rc6+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 nmi_cpu_backtrace+0x20e/0x240 lib/nmi_backtrace.c:102
 nmi_trigger_cpumask_backtrace+0x122/0x180 lib/nmi_backtrace.c:61
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 trigger_all_cpu_backtrace include/linux/nmi.h:105 [inline]
 check_hung_task kernel/hung_task.c:132 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:190 [inline]
 watchdog+0x90c/0xd60 kernel/hung_task.c:249
 kthread+0x35e/0x430 kernel/kthread.c:231
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2952 Comm: syzkaller817404 Not tainted 4.13.0-rc6+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d1e8c140 task.stack: ffff8801d2050000
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/paravirt.h:819 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/paravirt.h:832 [inline]
RIP: 0010:lock_is_held_type+0xc3/0x210 kernel/locking/lockdep.c:3889
RSP: 0000:ffff8801d20577a8 EFLAGS: 00000082
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000
RDX: 1ffffffff0b59432 RSI: 00000000ffffffff RDI: ffffffff85aca190
RBP: ffff8801d20577c8 R08: 0000000000028c40 R09: 0000000000000000
R10: ffffffffffffffe8 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff85b38240 R14: 0000000000001102 R15: 0000000006fbd5c0
FS:  00000000007ec880(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000206d4fed CR3: 00000001d9abf000 CR4: 00000000001406f0
Call Trace:
 lock_is_held include/linux/lockdep.h:348 [inline]
 ___might_sleep+0x3d8/0x470 kernel/sched/core.c:5959
 clear_huge_page+0xb5/0x3a0 mm/memory.c:4354
 __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline]
 do_huge_pmd_anonymous_page+0x584/0x1b90 mm/huge_memory.c:728
 create_huge_pmd mm/memory.c:3643 [inline]
 __handle_mm_fault+0x172f/0x3860 mm/memory.c:3846
 handle_mm_fault+0x3bb/0x860 mm/memory.c:3906
 __do_page_fault+0x4f6/0xb60 arch/x86/mm/fault.c:1445
 do_page_fault+0x54/0x70 arch/x86/mm/fault.c:1508
 page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1007
RIP: 0033:0x400bb6
RSP: 002b:00007ffcd7094530 EFLAGS: 00010246
RAX: ffffffffffffffff RBX: 00000000006ccd60 RCX: 000000000043fe49