[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.180' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 1001.321970] INFO: task syz-executor285:7977 blocked for more than 140 seconds. [ 1001.329423] Not tainted 4.14.295-syzkaller #0 [ 1001.334702] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1001.343581] syz-executor285 D28056 7977 7975 0x00000004 [ 1001.349306] Call Trace: [ 1001.352683] __schedule+0x88b/0x1de0 [ 1001.356403] ? io_schedule_timeout+0x140/0x140 [ 1001.360975] ? lock_downgrade+0x740/0x740 [ 1001.366226] schedule+0x8d/0x1b0 [ 1001.369602] schedule_preempt_disabled+0xf/0x20 [ 1001.375135] __mutex_lock+0x669/0x1310 [ 1001.379028] ? _raw_spin_unlock_irqrestore+0xb0/0xe0 [ 1001.385014] ? pipe_wait+0x171/0x190 [ 1001.388736] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 1001.395072] ? pipe_wait+0xef/0x190 [ 1001.398713] ? _raw_spin_unlock_irqrestore+0x79/0xe0 [ 1001.405466] pipe_wait+0x171/0x190 [ 1001.409012] ? pipe_double_lock+0x1d0/0x1d0 [ 1001.414233] ? wait_woken+0x230/0x230 [ 1001.418041] ? kill_fasync+0x18/0x3c0 [ 1001.422776] pipe_write+0x510/0xe10 [ 1001.426415] __vfs_write+0x44c/0x630 [ 1001.430124] ? kernel_read+0x110/0x110 [ 1001.435235] ? rw_verify_area+0xe1/0x2a0 [ 1001.439301] vfs_write+0x17f/0x4d0 [ 1001.443729] SyS_write+0xf2/0x210 [ 1001.447200] ? SyS_read+0x210/0x210 [ 1001.450824] ? __do_page_fault+0x159/0xad0 [ 1001.456264] ? do_syscall_64+0x4c/0x640 [ 1001.460239] ? SyS_read+0x210/0x210 [ 1001.464715] do_syscall_64+0x1d5/0x640 [ 1001.468609] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1001.474655] RIP: 0033:0x7f11663f7b29 [ 1001.478366] RSP: 002b:00007f11663a92f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1001.486956] RAX: ffffffffffffffda RBX: 00007f116647f428 RCX: 00007f11663f7b29 [ 1001.494894] RDX: 00000000fffffecc RSI: 0000000020000000 RDI: 0000000000000004 [ 1001.502876] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1001.510165] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f116647f420 [ 1001.518382] R13: 00007fffa7a56e2f R14: 00007f116647f42c R15: 00007f116644d074 [ 1001.526229] [ 1001.526229] Showing all locks held in the system: [ 1001.533101] 1 lock held by khungtaskd/1533: [ 1001.537488] #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a [ 1001.546594] 1 lock held by syz-executor285/7977: [ 1001.551342] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x171/0x190 [ 1001.559628] [ 1001.561258] ============================================= [ 1001.561258] [ 1001.570499] NMI backtrace for cpu 0 [ 1001.574295] CPU: 0 PID: 1533 Comm: khungtaskd Not tainted 4.14.295-syzkaller #0 [ 1001.582599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 1001.592028] Call Trace: [ 1001.594609] dump_stack+0x1b2/0x281 [ 1001.598226] nmi_cpu_backtrace.cold+0x57/0x93 [ 1001.602715] ? irq_force_complete_move+0x350/0x350 [ 1001.607637] nmi_trigger_cpumask_backtrace+0x13a/0x180 [ 1001.613079] watchdog+0x5b9/0xb40 [ 1001.616523] ? hungtask_pm_notify+0x50/0x50 [ 1001.620832] kthread+0x30d/0x420 [ 1001.624187] ? kthread_create_on_node+0xd0/0xd0 [ 1001.628844] ret_from_fork+0x24/0x30 [ 1001.632594] Sending NMI from CPU 0 to CPUs 1: [ 1001.637854] NMI backtrace for cpu 1 [ 1001.637858] CPU: 1 PID: 7978 Comm: syz-executor285 Not tainted 4.14.295-syzkaller #0 [ 1001.637863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 1001.637866] task: ffff8880b377a0c0 task.stack: ffff8880b3348000 [ 1001.637868] RIP: 0010:__orc_find+0x5b/0xf0 [ 1001.637871] RSP: 0018:ffff8880b334ef58 EFLAGS: 00000202 [ 1001.637876] RAX: 000000000000000d RBX: 1ffff11016669dfb RCX: ffffffff817ec6d7 [ 1001.637880] RDX: 000000000000000d RSI: ffffffff8a725fd2 RDI: ffffffff8a1947e8 [ 1001.637883] RBP: ffffffff8a1947e8 R08: ffffffff8a725fd2 R09: ffffffff8a726026 [ 1001.637887] R10: 000000000001e6a7 R11: 0000000000066071 R12: ffffffff8a19481c [ 1001.637890] R13: ffffffff8a1947e8 R14: ffffffff8a1947e8 R15: dffffc0000000000 [ 1001.637894] FS: 00007f1166388700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 [ 1001.637897] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1001.637900] CR2: 00007fefefd9b000 CR3: 00000000b0a68000 CR4: 00000000003406e0 [ 1001.637904] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1001.637907] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1001.637909] Call Trace: [ 1001.637911] unwind_next_frame+0x59a/0x17d0 [ 1001.637914] ? kmem_cache_alloc_node_trace+0x153/0x400 [ 1001.637922] ? deref_stack_reg+0x1a0/0x1a0 [ 1001.637925] ? is_bpf_text_address+0xb8/0x150 [ 1001.637927] ? kernel_text_address+0xbd/0xf0 [ 1001.637930] ? __kmalloc_node_track_caller+0x38/0x70 [ 1001.637932] __save_stack_trace+0x90/0x160 [ 1001.637935] ? __kmalloc_node_track_caller+0x38/0x70 [ 1001.637937] kasan_kmalloc+0xeb/0x160 [ 1001.637940] ? kasan_kmalloc+0xeb/0x160 [ 1001.637942] ? kmem_cache_alloc_node_trace+0x153/0x400 [ 1001.637945] ? __kmalloc_node_track_caller+0x38/0x70 [ 1001.637947] ? pskb_expand_head+0x128/0xd30 [ 1001.637950] ? netlink_trim+0x1ae/0x220 [ 1001.637952] ? netlink_unicast+0x94/0x610 [ 1001.637954] ? ip_set_protocol+0x386/0x500 [ 1001.637957] ? nfnetlink_rcv_msg+0x9bb/0xc00 [ 1001.637959] ? netlink_rcv_skb+0x125/0x390 [ 1001.637961] ? nfnetlink_rcv+0x1ab/0x1da0 [ 1001.637964] ? netlink_unicast+0x437/0x610 [ 1001.637966] ? netlink_sendmsg+0x648/0xbc0 [ 1001.637968] ? sock_sendmsg+0xb5/0x100 [ 1001.637971] ? sock_no_sendpage+0xe2/0x110 [ 1001.637973] ? sock_sendpage+0xdf/0x140 [ 1001.637975] ? pipe_to_sendpage+0x226/0x2d0 [ 1001.637978] ? __splice_from_pipe+0x326/0x7a0 [ 1001.637980] ? generic_splice_sendpage+0xc1/0x110 [ 1001.637983] ? SyS_splice+0xd59/0x1380 [ 1001.637985] ? do_syscall_64+0x1d5/0x640 [ 1001.637988] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1001.637990] ? depot_save_stack+0x10d/0x3f0 [ 1001.637992] ? kasan_kmalloc+0x139/0x160 [ 1001.637995] ? kasan_kmalloc+0xeb/0x160 [ 1001.637997] ? __kmalloc_node_track_caller+0x4c/0x70 [ 1001.637999] ? __alloc_skb+0x96/0x510 [ 1001.638002] ? ip_set_protocol+0x9a/0x500 [ 1001.638004] ? nfnetlink_rcv_msg+0x9bb/0xc00 [ 1001.638007] ? netlink_rcv_skb+0x125/0x390 [ 1001.638009] ? nfnetlink_rcv+0x1ab/0x1da0 [ 1001.638011] ? netlink_unicast+0x437/0x610 [ 1001.638014] ? netlink_sendmsg+0x648/0xbc0 [ 1001.638016] ? mark_held_locks+0xa6/0xf0 [ 1001.638018] ? do_syscall_64+0x1d5/0x640 [ 1001.638021] ? kmem_cache_alloc_node_trace+0x2f0/0x400 [ 1001.638024] kmem_cache_alloc_node_trace+0x153/0x400 [ 1001.638026] __kmalloc_node_track_caller+0x38/0x70 [ 1001.638029] pskb_expand_head+0x128/0xd30 [ 1001.638031] netlink_trim+0x1ae/0x220 [ 1001.638033] netlink_unicast+0x94/0x610 [ 1001.638035] ? __nla_reserve+0x9a/0xc0 [ 1001.638038] ? netlink_sendskb+0xd0/0xd0 [ 1001.638040] ? memcpy+0x35/0x50 [ 1001.638042] ip_set_protocol+0x386/0x500 [ 1001.638044] ? ip_set_dump_done+0x220/0x220 [ 1001.638047] ? ip_set_dump_done+0x220/0x220 [ 1001.638049] nfnetlink_rcv_msg+0x9bb/0xc00 [ 1001.638051] ? lock_downgrade+0x740/0x740 [ 1001.638054] netlink_rcv_skb+0x125/0x390 [ 1001.638056] ? nfnetlink_net_exit_batch+0x150/0x150 [ 1001.638059] ? netlink_ack+0x9a0/0x9a0 [ 1001.638061] ? ns_capable_common+0x127/0x150 [ 1001.638063] nfnetlink_rcv+0x1ab/0x1da0 [ 1001.638066] ? pipe_to_sendpage+0x226/0x2d0 [ 1001.638068] ? __splice_from_pipe+0x326/0x7a0 [ 1001.638071] ? trace_hardirqs_on+0x10/0x10 [ 1001.638073] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1001.638076] ? __netlink_lookup+0x345/0x5d0 [ 1001.638078] ? lock_downgrade+0x740/0x740 [ 1001.638080] ? nfnetlink_bind+0x240/0x240 [ 1001.638082] ? lock_acquire+0x170/0x3f0 [ 1001.638084] ? netlink_table_grab.part.0+0x1f0/0x1f0 [ 1001.638086] ? netlink_deliver_tap+0x90/0x860 [ 1001.638087] ? rcu_is_watching+0x11/0xb0 [ 1001.638089] ? lock_downgrade+0x740/0x740 [ 1001.638091] netlink_unicast+0x437/0x610 [ 1001.638093] ? netlink_sendskb+0xd0/0xd0 [ 1001.638095] ? __check_object_size+0x179/0x230 [ 1001.638096] netlink_sendmsg+0x648/0xbc0 [ 1001.638098] ? nlmsg_notify+0x1b0/0x1b0 [ 1001.638100] ? security_socket_sendmsg+0x83/0xb0 [ 1001.638102] ? nlmsg_notify+0x1b0/0x1b0 [ 1001.638104] sock_sendmsg+0xb5/0x100 [ 1001.638105] sock_no_sendpage+0xe2/0x110 [ 1001.638107] ? __sk_mem_schedule+0xd0/0xd0 [ 1001.638109] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 1001.638111] ? debug_check_no_obj_freed+0x2c0/0x680 [ 1001.638113] ? mark_held_locks+0xa6/0xf0 [ 1001.638115] ? __sk_mem_schedule+0xd0/0xd0 [ 1001.638116] sock_sendpage+0xdf/0x140 [ 1001.638118] pipe_to_sendpage+0x226/0x2d0 [ 1001.638120] ? sockfs_setattr+0x140/0x140 [ 1001.638122] ? direct_splice_actor+0x160/0x160 [ 1001.638124] ? __put_page+0xa5/0x2f0 [ 1001.638125] __splice_from_pipe+0x326/0x7a0 [ 1001.638127] ? direct_splice_actor+0x160/0x160 [ 1001.638129] generic_splice_sendpage+0xc1/0x110 [ 1001.638131] ? vmsplice_to_user+0x1b0/0x1b0 [ 1001.638133] ? rw_verify_area+0xe1/0x2a0 [ 1001.638135] ? vmsplice_to_user+0x1b0/0x1b0 [ 1001.638136] SyS_splice+0xd59/0x1380 [ 1001.638138] ? do_futex+0x1570/0x1570 [ 1001.638140] ? compat_SyS_vmsplice+0x150/0x150 [ 1001.638142] ? do_syscall_64+0x4c/0x640 [ 1001.638144] ? compat_SyS_vmsplice+0x150/0x150 [ 1001.638145] do_syscall_64+0x1d5/0x640 [ 1001.638147] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 1001.638149] RIP: 0033:0x7f11663f7b29 [ 1001.638151] RSP: 002b:00007f11663882e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 1001.638155] RAX: ffffffffffffffda RBX: 00007f116647f438 RCX: 00007f11663f7b29 [ 1001.638158] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 1001.638161] RBP: 000000000000001e R08: 000000000004ffe6 R09: 0000000000000000 [ 1001.638163] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f116647f430 [ 1001.638166] R13: 00007f116647d140 R14: 00007f116647f43c R15: 00007f116644d074 [ 1001.638167] Code: fc ff df 49 89 fe 48 89 fd eb 0c 48 8d 6b 04 49 89 de 49 39 ec 72 4d 4c 89 e0 48 29 e8 48 89 c2 48 c1 e8 3f 48 c1 fa 02 48 01 d0 <48> d1 f8 48 8d 5c 85 00 48 89 d8 48 c1 e8 03 42 0f b6 14 38 48 [ 1001.684624] Kernel panic - not syncing: hung_task: blocked tasks [ 1002.277644] CPU: 0 PID: 1533 Comm: khungtaskd Not tainted 4.14.295-syzkaller #0 [ 1002.285076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 1002.294420] Call Trace: [ 1002.296999] dump_stack+0x1b2/0x281 [ 1002.300614] panic+0x1f9/0x42d [ 1002.303796] ? add_taint.cold+0x16/0x16 [ 1002.307774] watchdog+0x5ca/0xb40 [ 1002.311226] ? hungtask_pm_notify+0x50/0x50 [ 1002.315544] kthread+0x30d/0x420 [ 1002.318902] ? kthread_create_on_node+0xd0/0xd0 [ 1002.323564] ret_from_fork+0x24/0x30 [ 1002.327625] Kernel Offset: disabled [ 1002.331274] Rebooting in 86400 seconds..