./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2590864571 <...> DUID 00:04:64:fe:60:40:6b:21:45:e2:2b:76:87:02:d2:43:fb:60 forked to background, child pid 3206 [ 31.819032][ T3207] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.828856][ T3207] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.43' (ECDSA) to the list of known hosts. execve("./syz-executor2590864571", ["./syz-executor2590864571"], 0x7ffed36ca3c0 /* 10 vars */) = 0 brk(NULL) = 0x5555570bf000 brk(0x5555570bfc40) = 0x5555570bfc40 arch_prctl(ARCH_SET_FS, 0x5555570bf300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2590864571", 4096) = 28 brk(0x5555570e0c40) = 0x5555570e0c40 brk(0x5555570e1000) = 0x5555570e1000 mprotect(0x7fa249369000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3629 attached , child_tidptr=0x5555570bf5d0) = 3629 [pid 3629] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3629] setsid() = 1 [pid 3629] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3629] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3629] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3629] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3629] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3629] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3629] unshare(CLONE_NEWNS) = 0 [pid 3629] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3629] unshare(CLONE_NEWIPC) = 0 [pid 3629] unshare(CLONE_NEWCGROUP) = 0 [pid 3629] unshare(CLONE_NEWUTS) = 0 [pid 3629] unshare(CLONE_SYSVSEM) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "16777216", 8) = 8 [pid 3629] close(3) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "536870912", 9) = 9 [pid 3629] close(3) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "1024", 4) = 4 [pid 3629] close(3) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "8192", 4) = 4 [pid 3629] close(3) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "1024", 4) = 4 [pid 3629] close(3) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "1024", 4) = 4 [pid 3629] close(3) = 0 [pid 3629] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3629] close(3) = 0 [pid 3629] getpid() = 1 [pid 3629] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3629] kill(-2, SIGKILL) = 0 [pid 3629] kill(2, SIGKILL) = 0 [pid 3629] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3629] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3629] getdents64(3, 0x5555570c0620 /* 2 entries */, 32768) = 48 [pid 3629] getdents64(3, 0x5555570c0620 /* 0 entries */, 32768) = 0 [pid 3629] close(3) = 0 [ 76.288722][ T14] cfg80211: failed to load regulatory.db [ 286.199108][ T28] INFO: task syz-executor259:3640 blocked for more than 143 seconds. [ 286.207379][ T28] Not tainted 6.1.0-rc7-syzkaller-01884-gff36c447e233 #0 [ 286.215256][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.224221][ T28] task:syz-executor259 state:D stack:25608 pid:3640 ppid:3629 flags:0x00004004 [ 286.233612][ T28] Call Trace: [ 286.236900][ T28] [ 286.240054][ T28] __schedule+0xae9/0x53f0 [ 286.244572][ T28] ? find_held_lock+0x2d/0x110 [ 286.249585][ T28] ? find_held_lock+0x2d/0x110 [ 286.254377][ T28] ? __lock_sock+0x120/0x260 [ 286.259233][ T28] ? io_schedule_timeout+0x150/0x150 [ 286.264586][ T28] ? mark_held_locks+0x9f/0xe0 [ 286.269611][ T28] schedule+0xde/0x1b0 [ 286.273708][ T28] __lock_sock+0x141/0x260 [ 286.278126][ T28] ? sock_omalloc+0x180/0x180 [ 286.283034][ T28] ? prepare_to_wait_exclusive+0x2c0/0x2c0 [ 286.288876][ T28] lock_sock_nested+0xda/0xf0 [ 286.293754][ T28] __mptcp_close_ssk+0x19e/0x780 [ 286.298768][ T28] ? detach_if_pending+0x500/0x500 [ 286.304526][ T28] mptcp_destroy_common+0x169/0x650 [ 286.310014][ T28] mptcp_disconnect+0xb7/0x450 [ 286.314795][ T28] __inet_stream_connect+0xc95/0xed0 [ 286.320338][ T28] ? inet_listen+0x640/0x640 [ 286.324958][ T28] tcp_sendmsg_fastopen+0x3ca/0x710 [ 286.330413][ T28] mptcp_sendmsg+0x1368/0x1930 [ 286.335386][ T28] ? aa_sk_perm+0x313/0xab0 [ 286.340230][ T28] ? __mptcp_push_pending+0x770/0x770 [ 286.345617][ T28] ? aa_af_perm+0x240/0x240 [ 286.350349][ T28] inet_sendmsg+0x9d/0xe0 [ 286.354705][ T28] ? inet_send_prepare+0x4e0/0x4e0 [ 286.360141][ T28] sock_sendmsg+0xd3/0x120 [ 286.364666][ T28] __sys_sendto+0x23a/0x340 [ 286.369399][ T28] ? __ia32_sys_getpeername+0xb0/0xb0 [ 286.374787][ T28] ? do_raw_spin_lock+0x124/0x2b0 [ 286.380099][ T28] ? _raw_spin_lock_irq+0x45/0x50 [ 286.385236][ T28] ? ptrace_notify+0xfe/0x140 [ 286.390276][ T28] ? lock_downgrade+0x6e0/0x6e0 [ 286.395191][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.400449][ T28] ? lockdep_hardirqs_on+0x7d/0x100 [ 286.405668][ T28] __x64_sys_sendto+0xe1/0x1b0 [ 286.410676][ T28] ? syscall_trace_enter.constprop.0+0xb0/0x250 [ 286.416952][ T28] do_syscall_64+0x39/0xb0 [ 286.421477][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.427468][ T28] RIP: 0033:0x7fa2492f5b09 [ 286.432065][ T28] RSP: 002b:00007ffd7d67dc48 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 286.441119][ T28] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa2492f5b09 [ 286.450090][ T28] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 286.458164][ T28] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 286.466979][ T28] R10: 000000002400c844 R11: 0000000000000246 R12: 00007ffd7d67dc70 [ 286.475846][ T28] R13: 00000000000f4240 R14: 0000000000000000 R15: 0000000000000000 [ 286.484049][ T28] [ 286.487080][ T28] [ 286.487080][ T28] Showing all locks held in the system: [ 286.495922][ T28] 1 lock held by rcu_tasks_kthre/12: [ 286.501316][ T28] #0: ffffffff8c58f270 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 [ 286.511895][ T28] 1 lock held by rcu_tasks_trace/13: [ 286.517231][ T28] #0: ffffffff8c58ef70 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 [ 286.528304][ T28] 1 lock held by khungtaskd/28: [ 286.533193][ T28] #0: ffffffff8c58fdc0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x57/0x264 [ 286.543208][ T28] 2 locks held by getty/3306: [ 286.547900][ T28] #0: ffff888017085098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 [ 286.558039][ T28] #1: ffffc900031262f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xef4/0x13e0 [ 286.569012][ T28] 3 locks held by syz-executor259/3640: [ 286.574573][ T28] #0: ffff8880749d8130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0xce/0x1930 [ 286.584146][ T28] #1: ffff8880766599b0 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x12a5/0x1930 [ 286.594028][ T28] #2: ffff8880766599b0 (k-sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk+0x19e/0x780 [ 286.604338][ T28] [ 286.606672][ T28] ============================================= [ 286.606672][ T28] [ 286.615111][ T28] NMI backtrace for cpu 0 [ 286.619440][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.0-rc7-syzkaller-01884-gff36c447e233 #0 [ 286.629241][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 286.639382][ T28] Call Trace: [ 286.642652][ T28] [ 286.645578][ T28] dump_stack_lvl+0xd1/0x138 [ 286.650172][ T28] nmi_cpu_backtrace.cold+0x24/0x18a [ 286.655480][ T28] nmi_trigger_cpumask_backtrace+0x333/0x3c0 [ 286.661491][ T28] ? lapic_can_unplug_cpu+0x80/0x80 [ 286.666703][ T28] watchdog+0xc75/0xfc0 [ 286.670870][ T28] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.676862][ T28] kthread+0x2e8/0x3a0 [ 286.680929][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 286.686591][ T28] ret_from_fork+0x1f/0x30 [ 286.691026][ T28] [ 286.694253][ T28] Sending NMI from CPU 0 to CPUs 1: [ 286.699508][ C1] NMI backtrace for cpu 1 [ 286.699517][ C1] CPU: 1 PID: 56 Comm: kworker/u4:4 Not tainted 6.1.0-rc7-syzkaller-01884-gff36c447e233 #0 [ 286.699537][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 286.699548][ C1] Workqueue: events_unbound toggle_allocation_gate [ 286.699639][ C1] RIP: 0010:insn_get_displacement+0x43c/0x6c0 [ 286.699672][ C1] Code: 03 38 d0 7c 09 84 d2 74 05 e8 10 98 24 f8 48 8d 7b 35 89 6b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 <48> 89 fa 83 e2 07 38 d0 7f 09 84 c0 74 05 e8 a1 97 24 f8 c6 43 35 [ 286.699688][ C1] RSP: 0018:ffffc900015779e8 EFLAGS: 00000a07 [ 286.699702][ C1] RAX: 0000000000000000 RBX: ffffc90001577a78 RCX: 0000000000000000 [ 286.699713][ C1] RDX: 1ffff920002aef55 RSI: ffffffff89a944fe RDI: ffffc90001577aad [ 286.699725][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 286.699735][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8a4654ef [ 286.699746][ C1] R13: 000000000000000f R14: 1ffff920002aef49 R15: ffffffff8a4654ea [ 286.699757][ C1] FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 286.699774][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.699786][ C1] CR2: 00005610ecd36018 CR3: 000000000c28e000 CR4: 00000000003506e0 [ 286.699798][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.699808][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.699819][ C1] Call Trace: [ 286.699823][ C1] [ 286.699830][ C1] insn_decode+0x35f/0x3b0 [ 286.699850][ C1] ? kmem_cache_alloc_lru+0x1bc/0x740 [ 286.699878][ C1] text_poke_loc_init+0xa6/0x450 [ 286.699898][ C1] ? arch_jump_label_transform_queue+0x5c/0x100 [ 286.699925][ C1] ? cpumask_weight+0x50/0x50 [ 286.699949][ C1] ? kmem_cache_alloc_lru+0x1bc/0x740 [ 286.699970][ C1] ? __jump_label_patch+0x173/0x330 [ 286.699998][ C1] arch_jump_label_transform_queue+0x98/0x100 [ 286.700026][ C1] __jump_label_update+0x12e/0x410 [ 286.700051][ C1] jump_label_update+0x32f/0x410 [ 286.700075][ C1] static_key_disable_cpuslocked+0x156/0x1b0 [ 286.700098][ C1] static_key_disable+0x1a/0x20 [ 286.700119][ C1] toggle_allocation_gate+0x187/0x390 [ 286.700137][ C1] ? lock_release+0x810/0x810 [ 286.700168][ C1] ? wake_up_kfence_timer+0x30/0x30 [ 286.700187][ C1] ? __switch_to+0x5d0/0x10e0 [ 286.700209][ C1] process_one_work+0x9bf/0x1710 [ 286.700233][ C1] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 286.700254][ C1] ? rwlock_bug.part.0+0x90/0x90 [ 286.700269][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 286.700291][ C1] worker_thread+0x669/0x1090 [ 286.700314][ C1] ? __kthread_parkme+0x163/0x220 [ 286.700338][ C1] ? process_one_work+0x1710/0x1710 [ 286.700358][ C1] kthread+0x2e8/0x3a0 [ 286.700372][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 286.700390][ C1] ret_from_fork+0x1f/0x30 [ 286.700419][ C1] [ 286.700547][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 286.994427][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.1.0-rc7-syzkaller-01884-gff36c447e233 #0 [ 287.004218][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 287.014264][ T28] Call Trace: [ 287.017531][ T28] [ 287.020451][ T28] dump_stack_lvl+0xd1/0x138 [ 287.025035][ T28] panic+0x2cc/0x626 [ 287.028960][ T28] ? panic_print_sys_info.part.0+0x110/0x110 [ 287.034960][ T28] ? preempt_schedule_thunk+0x1a/0x1c [ 287.040335][ T28] ? watchdog.cold+0x130/0x158 [ 287.045110][ T28] watchdog.cold+0x141/0x158 [ 287.049705][ T28] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 287.055702][ T28] kthread+0x2e8/0x3a0 [ 287.059757][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 287.065382][ T28] ret_from_fork+0x1f/0x30 [ 287.069799][ T28] [ 287.072877][ T28] Kernel Offset: disabled [ 287.077196][ T28] Rebooting in 86400 seconds..