./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor325954267 <...> Warning: Permanently added '10.128.1.189' (ED25519) to the list of known hosts. execve("./syz-executor325954267", ["./syz-executor325954267"], 0x7ffccdf022c0 /* 10 vars */) = 0 brk(NULL) = 0x555556d53000 brk(0x555556d53d00) = 0x555556d53d00 arch_prctl(ARCH_SET_FS, 0x555556d53380) = 0 set_tid_address(0x555556d53650) = 5019 set_robust_list(0x555556d53660, 24) = 0 rseq(0x555556d53ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor325954267", 4096) = 27 getrandom("\xb7\x65\x73\xb1\xa2\x7e\xd1\x25", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556d53d00 brk(0x555556d74d00) = 0x555556d74d00 brk(0x555556d75000) = 0x555556d75000 mprotect(0x7f901e5f5000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d53650) = 5020 ./strace-static-x86_64: Process 5020 attached [pid 5020] set_robust_list(0x555556d53660, 24) = 0 [pid 5020] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5020] setpgid(0, 0) = 0 [pid 5020] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5020] write(3, "1000", 4) = 4 [pid 5020] close(3) = 0 [pid 5020] memfd_create("syzkaller", 0) = 3 [pid 5020] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9016123000 [ 44.338940][ T5020] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5020 'syz-executor325' [pid 5020] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5020] munmap(0x7f9016123000, 16777216) = 0 [pid 5020] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5020] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5020] close(3) = 0 [pid 5020] mkdir("./file0", 0777) = 0 [ 44.483454][ T5020] loop0: detected capacity change from 0 to 32768 [ 44.496208][ T5020] gfs2: fsid=gfs2: Trying to join cluster "lock_nolock", "gfs2" [ 44.504248][ T5020] gfs2: fsid=gfs2: Now mounting FS (format 1801)... [ 44.517222][ T5020] gfs2: fsid=gfs2.s: journal 0 mapped with 3 extents in 0ms [pid 5020] mount("/dev/loop0", "./file0", "gfs2", MS_NOATIME|0x200, "\x6c\x6f\x63\x6b\x74\x61\x62\x6c\x65\x3d\xe2\x2c\x6c\x6f\x63\x6b\x74\x61\x62\x6c\x65\x3d\x26\x28\x2c\x6e\x6f\x72\x65\x63\x6f\x76\x65\x72\x79\x2c\x6e\x6f\x72\x67\x72\x70\x6c\x76\x62\x2c\x73\x74\x61\x74\x66\x73\x5f\x71\x75\x61\x6e\x74\x75\x6d\x3d\x30\x78\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x39\x2c\x6e\x6f\x61\x63\x6c\x2c\x64\x61\x74\x61\x3d\x6f\x72\x64\x65\x72\x65\x64\x2c\x6c"... [pid 5019] kill(-5020, SIGKILL) = 0 [pid 5019] kill(5020, SIGKILL) = 0 [pid 5019] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5019] newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0 [pid 5019] getdents64(3, 0x555556d546f0 /* 2 entries */, 32768) = 48 [pid 5019] getdents64(3, 0x555556d546f0 /* 0 entries */, 32768) = 0 [pid 5019] close(3) = 0 [ 70.699133][ T1127] cfg80211: failed to load regulatory.db [ 285.737389][ T28] INFO: task syz-executor325:5020 blocked for more than 143 seconds. [ 285.745534][ T28] Not tainted 6.5.0-rc1-syzkaller-00152-g4b810bf037e5 #0 [ 285.753201][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 285.762070][ T28] task:syz-executor325 state:D stack:25456 pid:5020 ppid:5019 flags:0x00004006 [ 285.771382][ T28] Call Trace: [ 285.774662][ T28] [ 285.777624][ T28] __schedule+0xee1/0x59f0 [ 285.782073][ T28] ? mark_lock+0x105/0x1950 [ 285.786565][ T28] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 285.792574][ T28] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 285.798582][ T28] ? io_schedule_timeout+0x150/0x150 [ 285.803849][ T28] ? find_held_lock+0x2d/0x110 [ 285.808634][ T28] ? reacquire_held_locks+0x4b0/0x4b0 [ 285.814013][ T28] schedule+0xe7/0x1b0 [ 285.818209][ T28] io_schedule+0xbe/0x130 [ 285.822654][ T28] folio_wait_bit_common+0x3d0/0x9a0 [ 285.827972][ T28] ? filemap_cachestat+0x970/0x970 [ 285.833101][ T28] ? filemap_write_and_wait_range+0x120/0x120 [ 285.839189][ T28] ? folio_unlock+0xd0/0xd0 [ 285.843727][ T28] ? __filemap_get_folio+0x1e7/0x990 [ 285.849035][ T28] gfs2_jhead_process_page+0x4bc/0x590 [ 285.854522][ T28] ? __bio_try_merge_page+0xac/0x4a0 [ 285.859918][ T28] ? revoke_lo_scan_elements+0x6f0/0x6f0 [ 285.865575][ T28] ? bio_add_page+0x178/0x1e0 [ 285.870410][ T28] ? __bio_try_merge_page+0x4a0/0x4a0 [ 285.875785][ T28] ? __filemap_get_folio+0x1e7/0x990 [ 285.881085][ T28] ? folio_flags.constprop.0+0x56/0x150 [ 285.886668][ T28] gfs2_find_jhead+0x6a8/0xd00 [ 285.891497][ T28] ? databuf_lo_before_commit+0x100/0x100 [ 285.897274][ T28] check_journal_clean+0x1da/0x350 [ 285.902417][ T28] ? gfs2_assert_i+0x30/0x30 [ 285.907016][ T28] ? do_raw_spin_lock+0x12e/0x2b0 [ 285.912070][ T28] ? init_inodes+0x1113/0x2e30 [ 285.916862][ T28] ? do_raw_spin_unlock+0x173/0x230 [ 285.922086][ T28] ? _raw_spin_unlock+0x28/0x40 [ 285.926955][ T28] ? gfs2_jdesc_find+0xbf/0xf0 [ 285.931832][ T28] init_inodes+0x1113/0x2e30 [ 285.936459][ T28] ? end_bio_io_page+0xd0/0xd0 [ 285.941358][ T28] ? gfs2_fill_super+0x1a9e/0x2b10 [ 285.946486][ T28] ? init_sb+0x9d8/0x10e0 [ 285.950848][ T28] ? vsprintf+0x30/0x30 [ 285.955018][ T28] ? gfs2_fill_super+0x1a9e/0x2b10 [ 285.960160][ T28] gfs2_fill_super+0x1a9e/0x2b10 [ 285.965156][ T28] ? gfs2_reconfigure+0xee0/0xee0 [ 285.970207][ T28] ? gfs2_fill_super+0x1736/0x2b10 [ 285.975354][ T28] ? set_blocksize+0x2bd/0x360 [ 285.980147][ T28] get_tree_bdev+0x43e/0x7d0 [ 285.984760][ T28] ? gfs2_reconfigure+0xee0/0xee0 [ 285.989826][ T28] gfs2_get_tree+0x4e/0x280 [ 285.994391][ T28] vfs_get_tree+0x88/0x350 [ 285.998892][ T28] path_mount+0x1492/0x1ed0 [ 286.003402][ T28] ? kmem_cache_free+0xf0/0x490 [ 286.008308][ T28] ? finish_automount+0xa50/0xa50 [ 286.013340][ T28] ? putname+0x101/0x140 [ 286.017613][ T28] __x64_sys_mount+0x293/0x310 [ 286.022402][ T28] ? copy_mnt_ns+0xb60/0xb60 [ 286.026977][ T28] ? lockdep_hardirqs_on+0x7d/0x100 [ 286.032214][ T28] ? _raw_spin_unlock_irq+0x2e/0x50 [ 286.037438][ T28] ? ptrace_notify+0xf4/0x130 [ 286.042142][ T28] do_syscall_64+0x38/0xb0 [ 286.046536][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.052451][ T28] RIP: 0033:0x7f901e56316a [ 286.056864][ T28] RSP: 002b:00007ffc5c5db0d8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 [ 286.065294][ T28] RAX: ffffffffffffffda RBX: 00007ffc5c5db0f0 RCX: 00007f901e56316a [ 286.073310][ T28] RDX: 000000002001f680 RSI: 000000002001f6c0 RDI: 00007ffc5c5db0f0 [ 286.081298][ T28] RBP: 0000000000000004 R08: 00007ffc5c5db130 R09: 000000000001f672 [ 286.089282][ T28] R10: 0000000000000600 R11: 0000000000000282 R12: 0000000000000600 [ 286.097268][ T28] R13: 00007ffc5c5db130 R14: 0000000000000003 R15: 0000000001000000 [ 286.105248][ T28] [ 286.108319][ T28] [ 286.108319][ T28] Showing all locks held in the system: [ 286.116040][ T28] 4 locks held by kworker/u4:0/10: [ 286.121458][ T28] 1 lock held by rcu_tasks_kthre/13: [ 286.126747][ T28] #0: ffffffff8c9a5830 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x2c/0xe20 [ 286.137245][ T28] 1 lock held by rcu_tasks_trace/14: [ 286.143655][ T28] #0: ffffffff8c9a5530 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x2c/0xe20 [ 286.154642][ T28] 1 lock held by khungtaskd/28: [ 286.159515][ T28] #0: ffffffff8c9a6440 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x340 [ 286.169460][ T28] 2 locks held by getty/4772: [ 286.174135][ T28] #0: ffff88814a602098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 286.183898][ T28] #1: ffffc900015a02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfcb/0x1480 [ 286.195078][ T28] 1 lock held by syz-executor325/5020: [ 286.200682][ T28] #0: ffff888078e180e0 (&type->s_umount_key#41/1){+.+.}-{3:3}, at: alloc_super+0x22e/0xb40 [ 286.210828][ T28] [ 286.213135][ T28] ============================================= [ 286.213135][ T28] [ 286.221638][ T28] NMI backtrace for cpu 0 [ 286.225963][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.5.0-rc1-syzkaller-00152-g4b810bf037e5 #0 [ 286.237046][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 [ 286.247084][ T28] Call Trace: [ 286.250347][ T28] [ 286.253280][ T28] dump_stack_lvl+0xd9/0x1b0 [ 286.257855][ T28] nmi_cpu_backtrace+0x277/0x380 [ 286.262790][ T28] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 286.268064][ T28] nmi_trigger_cpumask_backtrace+0x2ac/0x310 [ 286.274032][ T28] watchdog+0xf29/0x11b0 [ 286.278270][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 286.284251][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 286.290230][ T28] kthread+0x33a/0x430 [ 286.294293][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 286.299916][ T28] ret_from_fork+0x1f/0x30 [ 286.304339][ T28] [ 286.307437][ T28] Sending NMI from CPU 0 to CPUs 1: [ 286.312652][ C1] NMI backtrace for cpu 1 [ 286.312659][ C1] CPU: 1 PID: 10 Comm: kworker/u4:0 Not tainted 6.5.0-rc1-syzkaller-00152-g4b810bf037e5 #0 [ 286.312672][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 [ 286.312680][ C1] Workqueue: events_unbound toggle_allocation_gate [ 286.312694][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x11/0x70 [ 286.312713][ C1] Code: b0 01 00 00 e8 b0 ff ff ff 31 c0 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 65 8b 05 dd 4a 7d 7e 89 c1 48 8b 34 24 <81> e1 00 01 00 00 65 48 8b 14 25 80 b9 03 00 a9 00 01 ff 00 74 0e [ 286.312724][ C1] RSP: 0018:ffffc900000f79d8 EFLAGS: 00000246 [ 286.312733][ C1] RAX: 0000000080000000 RBX: ffffc900000f7a90 RCX: 0000000080000000 [ 286.312740][ C1] RDX: ffff888016649dc0 RSI: ffffffff8a273aa9 RDI: 0000000000000005 [ 286.312748][ C1] RBP: 0000000000004000 R08: 0000000000000005 R09: 0000000000000000 [ 286.312755][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 286.312762][ C1] R13: 000000000000000f R14: 1ffff9200001ef4c R15: ffffffff8a66766a [ 286.312772][ C1] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 286.312783][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.312791][ C1] CR2: 0000561efeddf680 CR3: 000000000c776000 CR4: 0000000000350ee0 [ 286.312799][ C1] Call Trace: [ 286.312802][ C1] [ 286.312805][ C1] ? nmi_cpu_backtrace+0x1d4/0x380 [ 286.312824][ C1] ? __sanitizer_cov_trace_pc+0x11/0x70 [ 286.312841][ C1] ? nmi_cpu_backtrace_handler+0xc/0x10 [ 286.312858][ C1] ? nmi_handle+0x145/0x400 [ 286.312873][ C1] ? irqentry_nmi_enter+0x7f/0x90 [ 286.312887][ C1] ? __sanitizer_cov_trace_pc+0x11/0x70 [ 286.312904][ C1] ? default_do_nmi+0x69/0x160 [ 286.312916][ C1] ? exc_nmi+0x171/0x1e0 [ 286.312928][ C1] ? end_repeat_nmi+0x16/0x31 [ 286.312942][ C1] ? insn_get_immediate+0xf9/0x1c50 [ 286.312954][ C1] ? __sanitizer_cov_trace_pc+0x11/0x70 [ 286.312971][ C1] ? __sanitizer_cov_trace_pc+0x11/0x70 [ 286.312988][ C1] ? __sanitizer_cov_trace_pc+0x11/0x70 [ 286.313005][ C1] [ 286.313008][ C1] [ 286.313011][ C1] insn_get_immediate+0xf9/0x1c50 [ 286.313022][ C1] ? __kmem_cache_alloc_node+0xc9/0x350 [ 286.313038][ C1] insn_decode+0x2ae/0x340 [ 286.313053][ C1] text_poke_loc_init+0xc2/0x4d0 [ 286.313064][ C1] ? __kmem_cache_alloc_node+0xc9/0x350 [ 286.313078][ C1] ? text_poke_memset+0x60/0x60 [ 286.313092][ C1] ? __kmem_cache_alloc_node+0xc9/0x350 [ 286.313106][ C1] ? __jump_label_patch+0x173/0x340 [ 286.313123][ C1] arch_jump_label_transform_queue+0x97/0x100 [ 286.313141][ C1] __jump_label_update+0x125/0x420 [ 286.313157][ C1] jump_label_update+0x32e/0x410 [ 286.313172][ C1] static_key_disable_cpuslocked+0x154/0x1b0 [ 286.313187][ C1] static_key_disable+0x1a/0x20 [ 286.313201][ C1] toggle_allocation_gate+0x13f/0x250 [ 286.313213][ C1] ? wake_up_kfence_timer+0x30/0x30 [ 286.313224][ C1] ? spin_bug+0x1d0/0x1d0 [ 286.313242][ C1] process_one_work+0xaa2/0x16f0 [ 286.313258][ C1] ? lock_sync+0x190/0x190 [ 286.313272][ C1] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 286.313287][ C1] ? spin_bug+0x1d0/0x1d0 [ 286.313304][ C1] worker_thread+0x687/0x1110 [ 286.313321][ C1] ? process_one_work+0x16f0/0x16f0 [ 286.313334][ C1] kthread+0x33a/0x430 [ 286.313345][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 286.313358][ C1] ret_from_fork+0x1f/0x30 [ 286.313378][ C1] [ 286.313651][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 286.652848][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.5.0-rc1-syzkaller-00152-g4b810bf037e5 #0 [ 286.662640][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 [ 286.672684][ T28] Call Trace: [ 286.675951][ T28] [ 286.678873][ T28] dump_stack_lvl+0xd9/0x1b0 [ 286.683456][ T28] panic+0x6a4/0x750 [ 286.687344][ T28] ? panic_smp_self_stop+0xa0/0xa0 [ 286.692451][ T28] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 286.697644][ T28] ? preempt_schedule_thunk+0x1a/0x30 [ 286.703015][ T28] ? watchdog+0xce1/0x11b0 [ 286.707463][ T28] watchdog+0xcf2/0x11b0 [ 286.712485][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 286.718468][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 286.724448][ T28] kthread+0x33a/0x430 [ 286.728528][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 286.734354][ T28] ret_from_fork+0x1f/0x30 [ 286.738793][ T28] [ 286.742788][ T28] Kernel Offset: disabled [ 286.747107][ T28] Rebooting in 86400 seconds..