./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1083352102 <...> Warning: Permanently added '10.128.0.3' (ECDSA) to the list of known hosts. execve("./syz-executor1083352102", ["./syz-executor1083352102"], 0x7ffc88da3900 /* 10 vars */) = 0 brk(NULL) = 0x555557234000 brk(0x555557234c40) = 0x555557234c40 arch_prctl(ARCH_SET_FS, 0x555557234300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1083352102", 4096) = 28 brk(0x555557255c40) = 0x555557255c40 brk(0x555557256000) = 0x555557256000 mprotect(0x7f3d51b86000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572345d0) = 5081 ./strace-static-x86_64: Process 5081 attached [pid 5081] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5081] setpgid(0, 0) = 0 [pid 5081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5081] write(3, "1000", 4) = 4 [pid 5081] close(3) = 0 [pid 5081] memfd_create("syzkaller", 0) = 3 [pid 5081] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3d496c0000 syzkaller login: [ 82.471286][ T5081] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5081 'syz-executor108' [pid 5081] write(3, "\x58\x46\x53\x42\x00\x00\x02\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5e\x62\x73\xb8\x21\x67\x42\xbb\x91\x1b\x41\x8a\xa1\x4a\x12\x61\x00\x00\x00\x00\x00\x00\x80\x40\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x21\x00\x00\x00\x00\x00\x00\x00\x22\x00\x00\x00\x08\x00\x00\x80\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x80"..., 33554432) = 33554432 [pid 5081] munmap(0x7f3d496c0000, 33554432) = 0 [pid 5081] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5081] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5081] close(3) = 0 [pid 5081] mkdir("./file0", 0777) = 0 [ 82.963944][ T5081] loop0: detected capacity change from 0 to 65536 [ 82.984052][ T5081] XFS (loop0): Deprecated V4 format (crc=0) will not be supported after September 2030. [ 82.996790][ T5081] XFS (loop0): Mounting V4 Filesystem 5e6273b8-2167-42bb-911b-418aa14a1261 [ 83.006990][ T5081] XFS (loop0): Log size 128 blocks too small, minimum size is 2880 blocks [ 83.016005][ T5081] XFS (loop0): Log size out of supported range. [ 83.022655][ T5081] XFS (loop0): Continuing onwards, but if log hangs are experienced then please report this message in the bug report. [ 83.066556][ T5081] XFS (loop0): Starting recovery (logdev: internal) [ 83.088416][ T5081] XFS (loop0): Ending recovery (logdev: internal) [pid 5081] mount("/dev/loop0", "./file0", "xfs", MS_SILENT, "inode32,usrquota,,nouuid" [pid 5080] kill(-5081, SIGKILL) = 0 [pid 5080] kill(5081, SIGKILL) = 0 [pid 5080] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5080] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 5080] getdents64(3, 0x555557235620 /* 2 entries */, 32768) = 48 [pid 5080] getdents64(3, 0x555557235620 /* 0 entries */, 32768) = 0 [pid 5080] close(3) = 0 [ 91.721381][ T897] cfg80211: failed to load regulatory.db [ 286.279193][ T28] INFO: task syz-executor108:5081 blocked for more than 143 seconds. [ 286.287425][ T28] Not tainted 6.2.0-next-20230225-syzkaller #0 [ 286.294242][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.303079][ T28] task:syz-executor108 state:D stack:25448 pid:5081 ppid:5080 flags:0x00004004 [ 286.312620][ T28] Call Trace: [ 286.315938][ T28] [ 286.318884][ T28] __schedule+0x24b4/0x5ac0 [ 286.323670][ T28] ? io_schedule_timeout+0x150/0x150 [ 286.329056][ T28] ? xlog_grant_head_wait+0x332/0xe30 [ 286.334568][ T28] schedule+0xde/0x1a0 [ 286.338674][ T28] xlog_grant_head_wait+0x159/0xe30 [ 286.343967][ T28] xlog_grant_head_check+0x3d9/0x420 [ 286.349345][ T28] ? xlog_grant_head_wait+0xe30/0xe30 [ 286.354757][ T28] xfs_log_reserve+0x39d/0xb80 [ 286.359601][ T28] ? percpu_counter_add_batch+0x170/0x1e0 [ 286.365434][ T28] ? xlog_ticket_alloc+0x2b0/0x2b0 [ 286.370628][ T28] ? __percpu_counter_compare+0xbc/0x130 [ 286.376310][ T28] ? xfs_mod_freecounter+0x92/0x540 [ 286.381635][ T28] xfs_trans_reserve+0x479/0x670 [ 286.386629][ T28] xfs_trans_alloc+0x33c/0x9f0 [ 286.391487][ T28] xfs_qm_qino_alloc+0x397/0xb70 [ 286.396553][ T28] ? xfs_qm_shrink_scan+0x370/0x370 [ 286.401905][ T28] xfs_qm_init_quotainos+0x546/0x710 [ 286.407254][ T28] ? xfs_qm_qino_alloc+0xb70/0xb70 [ 286.412668][ T28] ? __list_lru_init+0xcb/0x640 [ 286.417626][ T28] ? __raw_spin_lock_init+0x3a/0x110 [ 286.423018][ T28] ? __list_lru_init+0x364/0x640 [ 286.428135][ T28] xfs_qm_init_quotainfo+0xce/0xc00 [ 286.433448][ T28] ? xfs_perag_rele+0xd5/0x3a0 [ 286.438358][ T28] xfs_qm_mount_quotas+0x59/0x690 [ 286.443495][ T28] xfs_mountfs+0x1e07/0x1f60 [ 286.448204][ T28] ? xfs_mount_reset_sbqflags+0x140/0x140 [ 286.454019][ T28] ? init_timer_key+0xe4/0x120 [ 286.458987][ T28] xfs_fs_fill_super+0x13c0/0x2020 [ 286.464185][ T28] get_tree_bdev+0x444/0x760 [ 286.468874][ T28] ? xfs_finish_flags+0x390/0x390 [ 286.474010][ T28] vfs_get_tree+0x8d/0x350 [ 286.478469][ T28] path_mount+0x1342/0x1e40 [ 286.483288][ T28] ? kmem_cache_free+0xec/0x4e0 [ 286.488346][ T28] ? finish_automount+0x9b0/0x9b0 [ 286.493476][ T28] ? putname+0x102/0x140 [ 286.497842][ T28] __x64_sys_mount+0x283/0x300 [ 286.502735][ T28] ? copy_mnt_ns+0xb30/0xb30 [ 286.507377][ T28] ? lockdep_hardirqs_on+0x7d/0x100 [ 286.512741][ T28] ? _raw_spin_unlock_irq+0x2e/0x50 [ 286.518044][ T28] ? ptrace_notify+0xfe/0x140 [ 286.522885][ T28] do_syscall_64+0x39/0xb0 [ 286.527360][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.533402][ T28] RIP: 0033:0x7f3d51b0e61a [ 286.537865][ T28] RSP: 002b:00007ffd32b75c18 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 286.546405][ T28] RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f3d51b0e61a [ 286.554441][ T28] RDX: 000000002000bb00 RSI: 0000000020000000 RDI: 00007ffd32b75c30 [ 286.562493][ T28] RBP: 00007ffd32b75c30 R08: 00007ffd32b75c70 R09: 0000000000000002 [ 286.570528][ T28] R10: 0000000000008000 R11: 0000000000000206 R12: 0000000000000004 [ 286.578513][ T28] R13: 00005555572342c0 R14: 0000000000008000 R15: 00007ffd32b75c70 [ 286.586577][ T28] [ 286.589679][ T28] [ 286.589679][ T28] Showing all locks held in the system: [ 286.597417][ T28] 1 lock held by rcu_tasks_kthre/12: [ 286.602774][ T28] #0: ffffffff8c796bb0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0xd80 [ 286.613449][ T28] 1 lock held by rcu_tasks_trace/13: [ 286.618768][ T28] #0: ffffffff8c7968b0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0xd80 [ 286.629884][ T28] 1 lock held by khungtaskd/28: [ 286.634769][ T28] #0: ffffffff8c797700 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x390 [ 286.644758][ T28] 2 locks held by getty/4757: [ 286.649523][ T28] #0: ffff88802c074098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 [ 286.659482][ T28] #1: ffffc900015802f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xef4/0x13e0 [ 286.669747][ T28] 2 locks held by syz-executor108/5081: [ 286.675334][ T28] #0: ffff88801d9ce0e0 (&type->s_umount_key#41/1){+.+.}-{3:3}, at: alloc_super+0x22e/0xb60 [ 286.685590][ T28] #1: ffff88801d9ce650 (sb_internal#2){.+.+}-{0:0}, at: xfs_qm_qino_alloc+0x397/0xb70 [ 286.695426][ T28] [ 286.697758][ T28] ============================================= [ 286.697758][ T28] [ 286.706228][ T28] NMI backtrace for cpu 0 [ 286.710579][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.2.0-next-20230225-syzkaller #0 [ 286.719529][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 [ 286.729594][ T28] Call Trace: [ 286.732881][ T28] [ 286.735819][ T28] dump_stack_lvl+0xd9/0x150 [ 286.740458][ T28] nmi_cpu_backtrace+0x316/0x3e0 [ 286.745448][ T28] nmi_trigger_cpumask_backtrace+0x3a7/0x460 [ 286.751454][ T28] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 286.756719][ T28] watchdog+0xe94/0x11e0 [ 286.761014][ T28] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.767021][ T28] kthread+0x2e8/0x3a0 [ 286.771159][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 286.776811][ T28] ret_from_fork+0x1f/0x30 [ 286.781275][ T28] [ 286.784417][ T28] Sending NMI from CPU 0 to CPUs 1: [ 286.789729][ C1] NMI backtrace for cpu 1 [ 286.789740][ C1] CPU: 1 PID: 931 Comm: kworker/u4:5 Not tainted 6.2.0-next-20230225-syzkaller #0 [ 286.789766][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 [ 286.789782][ C1] Workqueue: events_unbound toggle_allocation_gate [ 286.789820][ C1] RIP: 0010:walk_to_pmd+0x11c/0x2a0 [ 286.789856][ C1] Code: 4c 89 f6 e8 16 12 c2 ff 4d 85 f6 0f 84 01 01 00 00 e8 98 15 c2 ff 49 89 dc 31 ff 41 81 e4 80 00 00 00 4c 89 e6 e8 f4 11 c2 ff <4d> 85 e4 48 b8 00 f0 ff ff ff ff 0f 00 49 bc 00 00 00 c0 ff ff 0f [ 286.789879][ C1] RSP: 0018:ffffc90004d5f970 EFLAGS: 00000293 [ 286.789896][ C1] RAX: 0000000000000000 RBX: 0000000012465067 RCX: ffffffff81c2902c [ 286.789912][ C1] RDX: ffff88801ed29d40 RSI: 0000000000000000 RDI: 0000000000000007 [ 286.789927][ C1] RBP: 00002aaaaaaab000 R08: 0000000000000007 R09: 0000000000000000 [ 286.789942][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 286.789956][ C1] R13: ffff888012468000 R14: 0000000012465007 R15: ffff888012468000 [ 286.789973][ C1] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 286.789996][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.790013][ C1] CR2: 0000559fe348e680 CR3: 000000000c571000 CR4: 00000000003506e0 [ 286.790028][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.790043][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.790058][ C1] Call Trace: [ 286.790063][ C1] [ 286.790071][ C1] ? kmem_cache_alloc_bulk+0x1b9/0x860 [ 286.790095][ C1] __get_locked_pte+0x27/0x270 [ 286.790127][ C1] ? kmem_cache_alloc_bulk+0x1b9/0x860 [ 286.790150][ C1] ? kmem_cache_alloc_bulk+0x1b9/0x860 [ 286.790173][ C1] __text_poke+0x1b3/0x8e0 [ 286.790275][ C1] ? setup_data_read+0x230/0x230 [ 286.790310][ C1] ? text_poke_memset+0x60/0x60 [ 286.790345][ C1] ? kmem_cache_alloc_bulk+0x1b9/0x860 [ 286.790369][ C1] text_poke_bp_batch+0x3af/0x770 [ 286.790405][ C1] ? do_sync_core+0x30/0x30 [ 286.790439][ C1] ? arch_jump_label_transform_queue+0xa4/0x100 [ 286.790470][ C1] ? __jump_label_update+0x296/0x410 [ 286.790529][ C1] text_poke_finish+0x1a/0x30 [ 286.790562][ C1] arch_jump_label_transform_apply+0x17/0x30 [ 286.790590][ C1] jump_label_update+0x32f/0x410 [ 286.790625][ C1] static_key_disable_cpuslocked+0x156/0x1b0 [ 286.790660][ C1] static_key_disable+0x1a/0x20 [ 286.790692][ C1] toggle_allocation_gate+0x143/0x230 [ 286.790727][ C1] ? wake_up_kfence_timer+0x30/0x30 [ 286.790761][ C1] ? trace_lock_acquire+0x1f1/0x2b0 [ 286.790795][ C1] process_one_work+0x9bf/0x1820 [ 286.790834][ C1] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 286.790866][ C1] ? rcu_read_lock_sched_held+0x3e/0x70 [ 286.790898][ C1] ? spin_bug+0x1c0/0x1c0 [ 286.790927][ C1] ? lock_acquire+0x32/0xc0 [ 286.790953][ C1] ? worker_thread+0x16d/0x1090 [ 286.790988][ C1] worker_thread+0x669/0x1090 [ 286.791026][ C1] ? __kthread_parkme+0x163/0x220 [ 286.791052][ C1] ? process_one_work+0x1820/0x1820 [ 286.791085][ C1] kthread+0x2e8/0x3a0 [ 286.791111][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 286.791141][ C1] ret_from_fork+0x1f/0x30 [ 286.791184][ C1] [ 286.791192][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.463 msecs [ 286.791727][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 287.119827][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.2.0-next-20230225-syzkaller #0 [ 287.128793][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 [ 287.138869][ T28] Call Trace: [ 287.142166][ T28] [ 287.145117][ T28] dump_stack_lvl+0xd9/0x150 [ 287.149756][ T28] panic+0x61b/0x6c0 [ 287.153747][ T28] ? panic_smp_self_stop+0x90/0x90 [ 287.158899][ T28] ? irq_work_claim+0x76/0x90 [ 287.163768][ T28] ? irq_work_queue+0x2d/0x80 [ 287.168498][ T28] ? watchdog+0xc20/0x11e0 [ 287.172969][ T28] watchdog+0xc31/0x11e0 [ 287.177271][ T28] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 287.183289][ T28] kthread+0x2e8/0x3a0 [ 287.187389][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 287.193056][ T28] ret_from_fork+0x1f/0x30 [ 287.197527][ T28] [ 287.200787][ T28] Kernel Offset: disabled [ 287.205129][ T28] Rebooting in 86400 seconds..