syzbot


INFO: task hung in misc_open (4)
Status: upstream: reported C repro on 2021/02/13 12:38
Reported-by: syzbot+358c9ab4c93da7b7238c@syzkaller.appspotmail.com
First crash: 537d, last: 2d22h

Cause bisection: failed (bisect log)

Fix bisection: the fix commit could be any of (bisect log):
  2f7b98d1e55c Merge tag 'drm-fixes-2021-04-16' of git://anongit.freedesktop.org/drm/drm
  303392fd5c16 Merge tag 'leds-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in misc_open (2) 8 975d 975d 0/22 auto-closed as invalid on 2019/12/23 14:44
upstream INFO: task hung in misc_open 2 1312d 1392d 0/22 auto-closed as invalid on 2019/04/20 12:01
upstream INFO: task hung in misc_open (3) 2 681d 689d 0/22 auto-closed as invalid on 2020/10/12 03:30

Sample crash report:
INFO: task syz-executor864:6907 blocked for more than 143 seconds.
      Not tainted 5.15.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor864 state:D stack:27936 pid: 6907 ppid:  6545 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xb44/0x5960 kernel/sched/core.c:6287
 schedule+0xd3/0x270 kernel/sched/core.c:6366
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425
 __mutex_lock_common kernel/locking/mutex.c:669 [inline]
 __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4c8/0x11d0 fs/open.c:822
 do_open fs/namei.c:3428 [inline]
 path_openat+0x1c9a/0x2740 fs/namei.c:3561
 do_filp_open+0x1aa/0x400 fs/namei.c:3588
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200
 do_sys_open fs/open.c:1216 [inline]
 __do_sys_openat fs/open.c:1232 [inline]
 __se_sys_openat fs/open.c:1227 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1227
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff261e34347
RSP: 002b:00007ffe30328bb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000020000440 RCX: 00007ff261e34347
RDX: 0000000000000002 RSI: 00007ff261eba03b RDI: 00000000ffffff9c
RBP: 00007ff261eba03b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffe3032acdc R14: 0000000000000076 R15: 00007ffe3032ace0
INFO: task syz-executor864:6922 blocked for more than 143 seconds.
      Not tainted 5.15.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor864 state:D stack:28616 pid: 6922 ppid:  6546 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xb44/0x5960 kernel/sched/core.c:6287
 schedule+0xd3/0x270 kernel/sched/core.c:6366
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425
 __mutex_lock_common kernel/locking/mutex.c:669 [inline]
 __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4c8/0x11d0 fs/open.c:822
 do_open fs/namei.c:3428 [inline]
 path_openat+0x1c9a/0x2740 fs/namei.c:3561
 do_filp_open+0x1aa/0x400 fs/namei.c:3588
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200
 do_sys_open fs/open.c:1216 [inline]
 __do_sys_openat fs/open.c:1232 [inline]
 __se_sys_openat fs/open.c:1227 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1227
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff261e34347
RSP: 002b:00007ffe30328bb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000020000440 RCX: 00007ff261e34347
RDX: 0000000000000002 RSI: 00007ff261eba03b RDI: 00000000ffffff9c
RBP: 00007ff261eba03b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffe3032acdc R14: 0000000000000076 R15: 00007ffe3032ace0
INFO: task syz-executor864:6936 blocked for more than 143 seconds.
      Not tainted 5.15.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor864 state:D stack:27760 pid: 6936 ppid:  6548 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xb44/0x5960 kernel/sched/core.c:6287
 schedule+0xd3/0x270 kernel/sched/core.c:6366
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425
 __mutex_lock_common kernel/locking/mutex.c:669 [inline]
 __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4c8/0x11d0 fs/open.c:822
 do_open fs/namei.c:3428 [inline]
 path_openat+0x1c9a/0x2740 fs/namei.c:3561
 do_filp_open+0x1aa/0x400 fs/namei.c:3588
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200
 do_sys_open fs/open.c:1216 [inline]
 __do_sys_openat fs/open.c:1232 [inline]
 __se_sys_openat fs/open.c:1227 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1227
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff261e34347
RSP: 002b:00007ffe30328bb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000020000440 RCX: 00007ff261e34347
RDX: 0000000000000002 RSI: 00007ff261eba03b RDI: 00000000ffffff9c
RBP: 00007ff261eba03b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffe3032acdc R14: 0000000000000076 R15: 00007ffe3032ace0
INFO: task syz-executor864:6954 blocked for more than 144 seconds.
      Not tainted 5.15.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor864 state:D stack:28328 pid: 6954 ppid:  6549 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xb44/0x5960 kernel/sched/core.c:6287
 schedule+0xd3/0x270 kernel/sched/core.c:6366
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425
 __mutex_lock_common kernel/locking/mutex.c:669 [inline]
 __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4c8/0x11d0 fs/open.c:822
 do_open fs/namei.c:3428 [inline]
 path_openat+0x1c9a/0x2740 fs/namei.c:3561
 do_filp_open+0x1aa/0x400 fs/namei.c:3588
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200
 do_sys_open fs/open.c:1216 [inline]
 __do_sys_openat fs/open.c:1232 [inline]
 __se_sys_openat fs/open.c:1227 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1227
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff261e34347
RSP: 002b:00007ffe30328bb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000020000440 RCX: 00007ff261e34347
RDX: 0000000000000002 RSI: 00007ff261eba03b RDI: 00000000ffffff9c
RBP: 00007ff261eba03b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffe3032acdc R14: 0000000000000076 R15: 00007ffe3032ace0
INFO: task syz-executor864:6972 blocked for more than 144 seconds.
      Not tainted 5.15.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor864 state:D stack:28328 pid: 6972 ppid:  6547 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4940 [inline]
 __schedule+0xb44/0x5960 kernel/sched/core.c:6287
 schedule+0xd3/0x270 kernel/sched/core.c:6366
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425
 __mutex_lock_common kernel/locking/mutex.c:669 [inline]
 __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729
 misc_open+0x55/0x4a0 drivers/char/misc.c:107
 chrdev_open+0x266/0x770 fs/char_dev.c:414
 do_dentry_open+0x4c8/0x11d0 fs/open.c:822
 do_open fs/namei.c:3428 [inline]
 path_openat+0x1c9a/0x2740 fs/namei.c:3561
 do_filp_open+0x1aa/0x400 fs/namei.c:3588
 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200
 do_sys_open fs/open.c:1216 [inline]
 __do_sys_openat fs/open.c:1232 [inline]
 __se_sys_openat fs/open.c:1227 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1227
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff261e34347
RSP: 002b:00007ffe30328bb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000020000440 RCX: 00007ff261e34347
RDX: 0000000000000002 RSI: 00007ff261eba03b RDI: 00000000ffffff9c
RBP: 00007ff261eba03b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007ffe3032acdc R14: 0000000000000076 R15: 00007ffe3032ace0

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8b97f0e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446
5 locks held by kworker/1:2/1053:
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268
 #1: ffffc900049ffdb0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272
 #2: ffff88801fed4220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #2: ffff88801fed4220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662
 #3: ffff888022e64220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #3: ffff888022e64220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
 #4: ffff8880781991a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #4: ffff8880781991a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
5 locks held by kworker/0:2/1266:
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268
 #1: ffffc900053efdb0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272
 #2: ffff888146d2f220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #2: ffff888146d2f220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662
 #3: ffff88806fe79220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #3: ffff88806fe79220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
 #4: ffff88801fe231a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #4: ffff88801fe231a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
5 locks held by kworker/1:3/2969:
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268
 #1: ffffc90001177db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272
 #2: ffff888146d3d220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #2: ffff888146d3d220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662
 #3: ffff8880750ec220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #3: ffff8880750ec220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
 #4: ffff888078ab61a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #4: ffff888078ab61a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
1 lock held by in:imklog/6253:
 #0: ffff88801b806db0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
5 locks held by kworker/1:0/6557:
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268
 #1: ffffc90002c37db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272
 #2: ffff888146d23220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #2: ffff888146d23220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662
 #3: ffff888079db5220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #3: ffff888079db5220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
 #4: ffff88801a88f1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #4: ffff88801a88f1a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
5 locks held by kworker/0:1/6563:
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
 #0: ffff88801643cd38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268
 #1: ffffc90002cb7db0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272
 #2: ffff8880200b6220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #2: ffff8880200b6220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662
 #3: ffff88806e962220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #3: ffff88806e962220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
 #4: ffff88806eba91a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
 #4: ffff88806eba91a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944
1 lock held by syz-executor864/6907:
 #0: ffffffff8c3c4488 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
1 lock held by syz-executor864/6922:
 #0: ffffffff8c3c4488 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
1 lock held by syz-executor864/6936:
 #0: ffffffff8c3c4488 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
1 lock held by syz-executor864/6954:
 #0: ffffffff8c3c4488 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
1 lock held by syz-executor864/6972:
 #0: ffffffff8c3c4488 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
2 locks held by syz-executor864/6975:
 #0: ffffffff8c3c4488 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x55/0x4a0 drivers/char/misc.c:107
 #1: ffffffff8b84d408 (system_transition_mutex){+.+.}-{3:3}, at: snapshot_open+0x3b/0x2a0 kernel/power/user.c:54

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
 watchdog+0xc1d/0xf50 kernel/hung_task.c:295
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 2956 Comm: systemd-journal Not tainted 5.15.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_next_frame+0x86/0x1ce0 arch/x86/kernel/unwind_orc.c:418
Code: 00 00 00 48 89 b4 24 98 00 00 00 31 f6 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e eb 0b 00 00 41 8b 2e 31 c0 85 ed 75 3b <48> ba 00 00 00 00 00 fc ff df 48 c7 04 13 00 00 00 00 48 8b 8c 24
RSP: 0018:ffffc9000c127770 EFLAGS: 00000086
RAX: 0000000000000001 RBX: 1ffff92001824ef6 RCX: 0000000000000000
RDX: 0000000080000000 RSI: ffffc9000c127868 RDI: 0000000000000001
RBP: ffffc9000c127898 R08: ffffffff8de85f32 R09: 0000000000000001
R10: fffff52001824f1e R11: 0000000000086089 R12: ffffc9000c120000
R13: ffffc9000c1278cd R14: ffffc9000c127898 R15: ffffc9000c1278cc
FS:  00007ff826cc68c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff8240ec000 CR3: 0000000078aa4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __unwind_start+0x51b/0x800 arch/x86/kernel/unwind_orc.c:699
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0x5c/0xe0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 save_stack+0x151/0x1e0 mm/page_owner.c:119
 __set_page_owner+0x50/0x290 mm/page_owner.c:181
 prep_new_page mm/page_alloc.c:2424 [inline]
 get_page_from_freelist+0xa72/0x2f80 mm/page_alloc.c:4153
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5375
 __alloc_pages_node include/linux/gfp.h:570 [inline]
 kmem_getpages mm/slab.c:1377 [inline]
 cache_grow_begin+0x75/0x460 mm/slab.c:2593
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2965
 ____cache_alloc mm/slab.c:3048 [inline]
 ____cache_alloc mm/slab.c:3031 [inline]
 __do_cache_alloc mm/slab.c:3275 [inline]
 slab_alloc mm/slab.c:3316 [inline]
 kmem_cache_alloc+0x454/0x540 mm/slab.c:3507
 getname_flags.part.0+0x50/0x4f0 fs/namei.c:138
 getname_flags include/linux/audit.h:319 [inline]
 getname fs/namei.c:217 [inline]
 __do_sys_mkdir fs/namei.c:3931 [inline]
 __se_sys_mkdir fs/namei.c:3929 [inline]
 __x64_sys_mkdir+0xda/0x140 fs/namei.c:3929
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff825f81687
Code: 00 b8 ff ff ff ff c3 0f 1f 40 00 48 8b 05 09 d8 2b 00 64 c7 00 5f 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 d7 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffc98f58238 EFLAGS: 00000293 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007ffc98f5b150 RCX: 00007ff825f81687
RDX: 00007ff8269f2a00 RSI: 00000000000001ed RDI: 0000560d9730b8c0
RBP: 00007ffc98f58270 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000069 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ffc98f5b150 R15: 00007ffc98f58760
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.308 msecs
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 48 89             	add    %cl,-0x77(%rax)
   5:	b4 24                	mov    $0x24,%ah
   7:	98                   	cwtl
   8:	00 00                	add    %al,(%rax)
   a:	00 31                	add    %dh,(%rcx)
   c:	f6 48 c1 ea          	testb  $0xea,-0x3f(%rax)
  10:	03 0f                	add    (%rdi),%ecx
  12:	b6 04                	mov    $0x4,%dh
  14:	02 84 c0 74 08 3c 03 	add    0x33c0874(%rax,%rax,8),%al
  1b:	0f 8e eb 0b 00 00    	jle    0xc0c
  21:	41 8b 2e             	mov    (%r14),%ebp
  24:	31 c0                	xor    %eax,%eax
  26:	85 ed                	test   %ebp,%ebp
  28:	75 3b                	jne    0x65
* 2a:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx <-- trapping instruction
  31:	fc ff df
  34:	48 c7 04 13 00 00 00 	movq   $0x0,(%rbx,%rdx,1)
  3b:	00
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	8c                   	.byte 0x8c
  3f:	24                   	.byte 0x24

Crashes (106):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/10/27 22:43 upstream 1fc596a56b33 373bf66b .config log report syz C INFO: task hung in misc_open
ci-upstream-kasan-gce-smack-root 2021/08/24 10:10 upstream d5ae8d7f85b7 b599f2fc .config log report syz C INFO: task hung in misc_open
ci-upstream-kasan-gce-root 2021/08/16 20:34 upstream 7c60610d4767 33c26cb7 .config log report syz C INFO: task hung in misc_open
ci-upstream-kasan-gce 2021/04/17 02:54 upstream 2f7b98d1e55c 7e2b734b .config log report syz C INFO: task hung in misc_open
ci-upstream-kasan-gce 2021/02/09 12:30 upstream e0756cfc7d7c 2bd9619f .config log report syz C INFO: task hung in misc_open
ci-upstream-linux-next-kasan-gce-root 2021/10/01 07:33 linux-next c7b4d0e56a1d 1d849ab4 .config log report syz C INFO: task can't die in misc_open
ci-upstream-kasan-gce 2022/05/23 19:00 upstream 4b0986a3613c 4c7657cb .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/05/21 01:22 upstream 3d7285a335ed bd37ad7e .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/05/18 21:21 upstream ef1302160bfb 50c53f39 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/05/12 10:10 upstream feb9c5e19e91 beb0b407 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/05/12 03:08 upstream feb9c5e19e91 beb0b407 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/05/12 00:45 upstream feb9c5e19e91 beb0b407 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/05/10 16:35 upstream 9be9ed2612b5 8b277b8e .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/29 03:34 upstream 259b897e5a79 e9076525 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/27 16:47 upstream 46cf2c613f4b 1fa34c1b .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/25 11:25 upstream af2d861d4cd2 c889aef9 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/24 15:48 upstream 22da5264abf4 131df97d .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/23 22:02 upstream 13bc32bad705 131df97d .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/23 02:15 upstream d569e86915b7 131df97d .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/16 18:33 upstream 59250f8a7f3a 8bcc32a6 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/14 01:49 upstream a19944809fe9 b17b2923 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/10 11:06 upstream e1f700ebd6be e22c3da3 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-smack-root 2022/04/09 12:31 upstream 6c7376da2358 e22c3da3 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/06 06:23 upstream ce4c854ee868 0127c10f .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/05 14:16 upstream 312310928417 5915c2cb .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/04/03 11:32 upstream be2d3ecedd99 79a2a8fc .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/26 07:53 upstream 52d543b5497c 89bc8608 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/22 12:35 upstream eaa54b1458ca e2d91b1d .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/21 11:48 upstream f443e374ae13 e2d91b1d .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-root 2022/03/13 15:16 upstream aad611a868d1 9e8eaa75 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/12 12:52 upstream 68453767131a 9e8eaa75 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/07 17:29 upstream ffb217a13a2e 7bdd8b2c .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/06 18:37 upstream dcde98da9970 7bdd8b2c .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/03/05 13:25 upstream ac84e82f78cb 45a13a73 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-root 2022/03/04 04:57 upstream 38f80f42147f 45a13a73 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/28 18:10 upstream 7e57714cd0ad 45a13a73 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/27 19:44 upstream 2293be58d6a1 45a13a73 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/24 16:52 upstream 23d04328444a b28851a4 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/22 13:56 upstream 038101e6b2cd 6e821dbf .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-root 2022/02/20 16:16 upstream 4f12b742eb2b 3cd800e4 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/14 21:45 upstream 754e0b0e3560 8b9ca619 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/13 22:09 upstream b81b1829e7e3 8b9ca619 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/02/03 11:19 upstream 27bb0b18c208 4ebb2798 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/01/28 23:05 upstream df0001545b27 495e00c5 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2022/01/17 03:00 upstream 79e06c4c4950 723cfaf0 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-root 2022/01/13 07:49 upstream f079ab01b560 44d1319a .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2021/12/25 12:44 upstream b927dfc67d05 6caa12e4 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-386 2022/04/14 10:43 upstream a19944809fe9 b17b2923 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-386 2022/03/02 02:31 upstream 575115360652 45a13a73 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce-386 2022/01/18 16:59 upstream e3a8b6a1e70c 731a2d23 .config log report info INFO: task hung in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/01/27 03:46 linux-next 74e5dee6a5b9 2cbffd88 .config log report info INFO: task hung in misc_open
ci-upstream-kasan-gce 2020/12/11 15:18 upstream 33dc9614dc20 ba24ffcd .config log report info
ci-upstream-kasan-gce 2020/12/05 09:39 upstream e87297fa080a 20366b87 .config log report info
ci-upstream-linux-next-kasan-gce-root 2022/04/24 22:51 linux-next f1244c81da13 131df97d .config log report info INFO: task can't die in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/04/19 02:19 linux-next 40354149f4d7 8bcc32a6 .config log report info INFO: task can't die in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/04/10 05:56 linux-next ff511c1c68a5 e22c3da3 .config log report info INFO: task can't die in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/03/14 00:55 linux-next 91265a6da44d 9e8eaa75 .config log report info INFO: task can't die in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/03/04 07:58 linux-next 91265a6da44d 45a13a73 .config log report info INFO: task can't die in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/03/01 13:52 linux-next e6ada6df471f 45a13a73 .config log report info INFO: task can't die in misc_open
ci-upstream-linux-next-kasan-gce-root 2022/02/14 08:12 linux-next ef6b35306dd8 8b9ca619 .config log report info INFO: task can't die in misc_open