syzbot

BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 264s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=15/256 refcnt=19
    in-flight: 3293:p9_poll_workfn p9_poll_workfn BAR(3578) BAR(3576) BAR(3574)
    pending: p9_read_work, p9_read_work, p9_write_work, p9_read_work, p9_write_work, p9_read_work, p9_write_work, p9_read_work, vmstat_shepherd, psi_avgs_work, ovs_dp_masks_rebalance, kfree_rcu_monitor, ima_keys_handler
workqueue events_long: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: defense_work_handler
workqueue events_unbound: flags=0x2
  pwq 4: cpus=0-1 flags=0x4 nice=0 active=5/512 refcnt=8
    in-flight: 9:toggle_allocation_gate, 38:fsnotify_connector_destroy_workfn fsnotify_connector_destroy_workfn, 1104:fsnotify_mark_destroy_workfn fsnotify_mark_destroy_workfn
workqueue events_power_efficient: flags=0x80
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=6/256 refcnt=7
    pending: neigh_managed_work, neigh_managed_work, neigh_periodic_work, neigh_periodic_work, do_cache_clean, check_lifetime
workqueue rcu_gp: flags=0x8
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: srcu_invoke_callbacks
workqueue mm_percpu_wq: flags=0x8
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: vmstat_update
workqueue ipv6_addrconf: flags=0x40008
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1 refcnt=2
    pending: addrconf_verify_work
workqueue krxrpcd: flags=0x0
  pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1 refcnt=2
    pending: rxrpc_peer_keepalive_worker
pool 0: cpus=0 node=0 flags=0x0 nice=0 hung=265s workers=3 idle: 7 934
pool 4: cpus=0-1 flags=0x4 nice=0 hung=0s workers=6 idle: 9 11 3581 51
NMI backtrace for cpu 0
CPU: 0 PID: 3293 Comm: kworker/0:3 Not tainted 6.1.81-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: events p9_poll_workfn
RIP: 0010:hlock_class kernel/locking/lockdep.c:228 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4748 [inline]
RIP: 0010:__lock_acquire+0x794/0x1f80 kernel/locking/lockdep.c:4999
Code: 8b 5d 00 81 e3 ff 1f 00 00 48 89 d8 48 c1 e8 06 48 8d 3c c5 20 52 49 90 be 08 00 00 00 e8 24 9b 77 00 48 0f a3 1d fc f6 de 0e <73> 1b 48 8d 04 5b 48 c1 e0 06 48 8d 98 20 b1 18 90 48 ba 00 00 00
RSP: 0018:ffffc900036ef8e0 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000669 RCX: ffffffff816a5b1c
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff904952e8
RBP: ffff888020bd0b28 R08: dffffc0000000000 R09: fffffbfff2092a5e
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: ffff888020bd0b28 R14: 0000000000000001 R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056234fd18030 CR3: 000000000ce8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0xcf/0x110 kernel/locking/spinlock.c:170
 spin_lock_irq include/linux/spinlock.h:376 [inline]
 dma_buf_poll+0x16d/0x6a0 drivers/dma-buf/dma-buf.c:261
 vfs_poll include/linux/poll.h:88 [inline]
 p9_fd_poll net/9p/trans_fd.c:238 [inline]
 p9_poll_mux net/9p/trans_fd.c:630 [inline]
 p9_poll_workfn+0x2cd/0x5c0 net/9p/trans_fd.c:1174
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
 </TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.439 msecs
----------------
Code disassembly (best guess):
   0:	8b 5d 00             	mov    0x0(%rbp),%ebx
   3:	81 e3 ff 1f 00 00    	and    $0x1fff,%ebx
   9:	48 89 d8             	mov    %rbx,%rax
   c:	48 c1 e8 06          	shr    $0x6,%rax
  10:	48 8d 3c c5 20 52 49 	lea    -0x6fb6ade0(,%rax,8),%rdi
  17:	90
  18:	be 08 00 00 00       	mov    $0x8,%esi
  1d:	e8 24 9b 77 00       	call   0x779b46
  22:	48 0f a3 1d fc f6 de 	bt     %rbx,0xedef6fc(%rip)        # 0xedef726
  29:	0e
* 2a:	73 1b                	jae    0x47 <-- trapping instruction
  2c:	48 8d 04 5b          	lea    (%rbx,%rbx,2),%rax
  30:	48 c1 e0 06          	shl    $0x6,%rax
  34:	48 8d 98 20 b1 18 90 	lea    -0x6fe74ee0(%rax),%rbx
  3b:	48                   	rex.W
  3c:	ba                   	.byte 0xba
  3d:	00 00                	add    %al,(%rax)