./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3196329311 <...> [ 3.301753][ T100] udevd[100]: starting eudev-3.2.11 [ 4.193576][ T147] chmod (147) used greatest stack depth: 23120 bytes left [ 6.873424][ T114] udevd (114) used greatest stack depth: 22576 bytes left [ 12.975845][ T224] sshd (224) used greatest stack depth: 22208 bytes left [ 13.038873][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 13.038883][ T30] audit: type=1400 audit(1713029079.283:61): avc: denied { transition } for pid=225 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.042746][ T30] audit: type=1400 audit(1713029079.283:62): avc: denied { noatsecure } for pid=225 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.047267][ T30] audit: type=1400 audit(1713029079.283:63): avc: denied { write } for pid=225 comm="sh" path="pipe:[12104]" dev="pipefs" ino=12104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.052434][ T30] audit: type=1400 audit(1713029079.293:64): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.055865][ T30] audit: type=1400 audit(1713029079.293:65): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.145' (ED25519) to the list of known hosts. execve("./syz-executor3196329311", ["./syz-executor3196329311"], 0x7ffc5e970fa0 /* 10 vars */) = 0 brk(NULL) = 0x555556e15000 brk(0x555556e15d00) = 0x555556e15d00 arch_prctl(ARCH_SET_FS, 0x555556e15380) = 0 set_tid_address(0x555556e15650) = 293 set_robust_list(0x555556e15660, 24) = 0 rseq(0x555556e15ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3196329311", 4096) = 28 getrandom("\xcb\xba\x71\xb4\xc1\x21\x5c\x3a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556e15d00 brk(0x555556e36d00) = 0x555556e36d00 brk(0x555556e37000) = 0x555556e37000 mprotect(0x7f2128037000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 294 attached , child_tidptr=0x555556e15650) = 294 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] set_robust_list(0x555556e15660, 24) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 295 attached [pid 293] <... clone resumed>, child_tidptr=0x555556e15650) = 295 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 296 attached [pid 295] set_robust_list(0x555556e15660, 24./strace-static-x86_64: Process 297 attached [pid 293] <... clone resumed>, child_tidptr=0x555556e15650) = 297 [pid 296] set_robust_list(0x555556e15660, 24 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... set_robust_list resumed>) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556e15650) = 296 [pid 297] set_robust_list(0x555556e15660, 24 [pid 296] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 298 attached [pid 293] <... clone resumed>, child_tidptr=0x555556e15650) = 298 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... set_robust_list resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] set_robust_list(0x555556e15660, 24 [pid 295] <... clone resumed>, child_tidptr=0x555556e15650) = 299 ./strace-static-x86_64: Process 300 attached ./strace-static-x86_64: Process 299 attached [pid 293] <... clone resumed>, child_tidptr=0x555556e15650) = 300 [pid 298] <... set_robust_list resumed>) = 0 [pid 296] <... prctl resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555556e15650) = 301 [pid 300] set_robust_list(0x555556e15660, 24 [pid 296] setpgid(0, 0./strace-static-x86_64: Process 301 attached [pid 299] set_robust_list(0x555556e15660, 24 [pid 296] <... setpgid resumed>) = 0 [pid 300] <... set_robust_list resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 300] <... clone resumed>, child_tidptr=0x555556e15650) = 303 ./strace-static-x86_64: Process 302 attached [pid 302] set_robust_list(0x555556e15660, 24) = 0 [pid 302] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 302] setpgid(0, 0) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556e15650) = 302 [pid 296] <... openat resumed>) = 3 [pid 302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] write(3, "1000", 4 [pid 302] <... openat resumed>) = 3 [pid 302] write(3, "1000", 4 [pid 296] <... write resumed>) = 4 [pid 302] <... write resumed>) = 4 [pid 296] close(3 [pid 302] close(3 [pid 296] <... close resumed>) = 0 [pid 302] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 302] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 302] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 296] <... ioctl resumed>) = 0 [pid 296] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 302] <... ioctl resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 302] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 302] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 296] <... openat resumed>) = 4 [pid 296] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 299] <... set_robust_list resumed>) = 0 [pid 296] <... ioctl resumed>) = 0 [pid 296] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 296] ioctl(3, SNDRV_TIMER_IOCTL_CONTINUE, 0) = 0 [pid 299] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 302] <... openat resumed>) = 4 [pid 296] exit_group(0 [pid 299] <... prctl resumed>) = 0 [pid 296] <... exit_group resumed>) = ? [pid 302] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 302] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 302] ioctl(3, SNDRV_TIMER_IOCTL_CONTINUE, 0) = 0 [pid 302] exit_group(0) = ? ./strace-static-x86_64: Process 303 attached [pid 303] set_robust_list(0x555556e15660, 24) = 0 [pid 303] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 303] setpgid(0, 0) = 0 [pid 303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 303] write(3, "1000", 4) = 4 [pid 303] close(3) = 0 [pid 303] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 303] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 301] set_robust_list(0x555556e15660, 24) = 0 [pid 301] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 301] setpgid(0, 0) = 0 [pid 301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 301] write(3, "1000", 4) = 4 [pid 301] close(3) = 0 [pid 301] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 301] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 299] setpgid(0, 0) = 0 [pid 299] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 299] write(3, "1000", 4) = 4 [pid 299] close(3) = 0 [pid 299] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [ 21.337294][ T30] audit: type=1400 audit(1713029087.583:66): avc: denied { execmem } for pid=293 comm="syz-executor319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 299] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 294] kill(-296, SIGKILL) = 0 [pid 294] kill(296, SIGKILL) = 0 [pid 300] kill(-303, SIGKILL [pid 297] kill(-301, SIGKILL [pid 295] kill(-299, SIGKILL [pid 300] <... kill resumed>) = 0 [pid 297] <... kill resumed>) = 0 [pid 295] <... kill resumed>) = 0 [pid 300] kill(303, SIGKILL [pid 297] kill(301, SIGKILL [pid 295] kill(299, SIGKILL [pid 300] <... kill resumed>) = 0 [ 121.386959][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 121.393746][ C0] rcu: 1-...!: (1 ticks this GP) idle=be3/1/0x4000000000000000 softirq=2211/2211 fqs=0 last_accelerate: 92d6/b9ec dyntick_enabled: 1 [ 121.407277][ C0] (detected by 0, t=10004 jiffies, g=309, q=1061) [ 121.413610][ C0] Sending NMI from CPU 0 to CPUs 1: [ 121.418655][ C1] NMI backtrace for cpu 1 [ 121.418665][ C1] CPU: 1 PID: 296 Comm: syz-executor319 Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 121.418681][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 121.418689][ C1] RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.418726][ C1] Code: 41 51 41 52 41 53 e8 cb 0a 00 00 41 5b 41 5a 41 59 41 58 5f 5e 5a 59 5d c3 90 55 48 89 e5 52 b8 01 00 00 00 31 d2 f0 0f b0 17 <3c> 01 75 03 5a 5d c3 56 0f b6 f0 e8 bc ff ff ff 5e 5a 5d c3 0f 1f [ 121.418738][ C1] RSP: 0018:ffffc900001d0a08 EFLAGS: 00000046 [ 121.418752][ C1] RAX: 0000000000000001 RBX: ffff88810de41670 RCX: dffffc0000000000 [ 121.418762][ C1] RDX: 0000000000000000 RSI: 0000000000000046 RDI: ffff88810de41670 [ 121.418772][ C1] RBP: ffffc900001d0a10 R08: 0000000000000000 R09: ffffc900001d0a80 [ 121.418782][ C1] R10: fffff5200003a134 R11: dffffc0000000001 R12: 0000000000000046 [ 121.418793][ C1] R13: 0000000000000001 R14: 0000000000000046 R15: 0000000000000003 [ 121.418801][ C1] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 121.418814][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 121.418824][ C1] CR2: 00007f212803e130 CR3: 000000000680f000 CR4: 00000000003506a0 [ 121.418837][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 121.418846][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 121.418855][ C1] Call Trace: [ 121.418859][ C1] [ 121.418865][ C1] ? show_regs+0x58/0x60 [ 121.418898][ C1] ? nmi_cpu_backtrace+0x29f/0x300 [ 121.418982][ C1] ? nmi_trigger_cpumask_backtrace+0x270/0x270 [ 121.419013][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.419031][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.419048][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 121.419064][ C1] ? nmi_handle+0xa8/0x280 [ 121.419079][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.419096][ C1] ? default_do_nmi+0x69/0x160 [ 121.419111][ C1] ? exc_nmi+0xaf/0x120 [ 121.419124][ C1] ? end_repeat_nmi+0x16/0x31 [ 121.419139][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.419156][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.419173][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 121.419190][ C1] [ 121.419194][ C1] [ 121.419199][ C1] _raw_spin_unlock_irqrestore+0x46/0x80 [ 121.419216][ C1] __wake_up+0x120/0x1c0 [ 121.419230][ C1] ? remove_wait_queue+0x140/0x140 [ 121.419251][ C1] ? _raw_spin_trylock_bh+0x190/0x190 [ 121.419270][ C1] ? snd_kill_fasync+0x152/0x2a0 [ 121.419288][ C1] snd_timer_user_interrupt+0x2e5/0x470 [ 121.419303][ C1] ? snd_timer_user_tinterrupt+0xc90/0xc90 [ 121.419317][ C1] snd_timer_process_callbacks+0x24b/0x310 [ 121.419332][ C1] snd_timer_interrupt+0xe94/0x1050 [ 121.419347][ C1] snd_hrtimer_callback+0x1db/0x330 [ 121.419362][ C1] ? snd_hrtimer_stop+0xa0/0xa0 [ 121.419375][ C1] __hrtimer_run_queues+0x41a/0xad0 [ 121.419391][ C1] ? hrtimer_interrupt+0xaa0/0xaa0 [ 121.419404][ C1] ? clockevents_program_event+0x236/0x300 [ 121.419420][ C1] ? ktime_get_update_offsets_now+0x2ba/0x2d0 [ 121.419436][ C1] hrtimer_interrupt+0x40c/0xaa0 [ 121.419452][ C1] __sysvec_apic_timer_interrupt+0xfd/0x3c0 [ 121.419466][ C1] sysvec_apic_timer_interrupt+0x95/0xc0 [ 121.419482][ C1] [ 121.419486][ C1] [ 121.419490][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 121.419512][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80 [ 121.419531][ C1] Code: 8d 86 e8 5c 76 e9 fc 48 83 3d 0c 99 c4 01 00 74 35 48 89 df e8 8e 28 8c fc 66 90 41 f7 c6 00 02 00 00 74 01 fb bf 01 00 00 00 44 6c 83 fc 65 8b 05 95 b1 39 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 121.419543][ C1] RSP: 0018:ffffc900009a7a68 EFLAGS: 00000206 [ 121.419557][ C1] RAX: 0000000000000001 RBX: ffff88810ac7e138 RCX: dffffc0000000000 [ 121.419568][ C1] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000001 [ 121.419577][ C1] RBP: ffffc900009a7a78 R08: ffffffff83c281c7 R09: ffffed10239c54ee [ 121.419588][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88810ac7e0b0 [ 121.419598][ C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000001 [ 121.419608][ C1] ? snd_timer_notify1+0x217/0x350 [ 121.419623][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x80 [ 121.419643][ C1] snd_timer_stop1+0x7af/0x8f0 [ 121.419657][ C1] snd_timer_close_locked+0x22e/0x920 [ 121.419672][ C1] snd_timer_user_release+0x121/0x2c0 [ 121.419687][ C1] ? snd_timer_user_open+0x180/0x180 [ 121.419701][ C1] ? percpu_counter_add_batch+0x13d/0x160 [ 121.419715][ C1] ? snd_timer_user_open+0x180/0x180 [ 121.419728][ C1] __fput+0x3fe/0x910 [ 121.419744][ C1] ____fput+0x15/0x20 [ 121.419757][ C1] task_work_run+0x129/0x190 [ 121.419771][ C1] do_exit+0xc48/0x2ca0 [ 121.419788][ C1] ? put_task_struct+0x80/0x80 [ 121.419802][ C1] ? ptrace_notify+0x24c/0x350 [ 121.419817][ C1] ? do_notify_parent+0xa30/0xa30 [ 121.419832][ C1] do_group_exit+0x141/0x310 [ 121.419847][ C1] __x64_sys_exit_group+0x3f/0x40 [ 121.419862][ C1] do_syscall_64+0x3d/0xb0 [ 121.419875][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 121.419892][ C1] RIP: 0033:0x7f2127fc2db9 [ 121.419903][ C1] Code: Unable to access opcode bytes at RIP 0x7f2127fc2d8f. [ 121.419910][ C1] RSP: 002b:00007ffe5d2ca048 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 121.419926][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc2db9 [ 121.419936][ C1] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 121.419945][ C1] RBP: 00007f212803d2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 121.419960][ C1] R10: 00000000000000a0 R11: 0000000000000246 R12: 00007f212803d2b0 [ 121.419970][ C1] R13: 0000000000000000 R14: 00007f212803dd20 R15: 00007f2127f93f50 [ 121.419982][ C1] [ 121.419988][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.333 msecs [ 121.420652][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10003 jiffies! g309 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 121.996468][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=369 [ 122.004015][ C0] rcu: rcu_preempt kthread starved for 10004 jiffies! g309 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 122.015038][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 122.024845][ C0] rcu: RCU grace-period kthread stack dump: [ 122.030573][ C0] task:rcu_preempt state:I stack:28328 pid: 14 ppid: 2 flags:0x00004000 [ 122.039602][ C0] Call Trace: [ 122.042728][ C0] [ 122.045510][ C0] __schedule+0xccc/0x1590 [ 122.049756][ C0] ? __sched_text_start+0x8/0x8 [ 122.054447][ C0] ? __kasan_check_write+0x14/0x20 [ 122.059387][ C0] schedule+0x11f/0x1e0 [ 122.063380][ C0] schedule_timeout+0x18c/0x370 [ 122.068069][ C0] ? _raw_spin_unlock_irq+0x4e/0x70 [ 122.073108][ C0] ? console_conditional_schedule+0x30/0x30 [ 122.078828][ C0] ? update_process_times+0x200/0x200 [ 122.084038][ C0] ? prepare_to_swait_event+0x308/0x320 [ 122.089418][ C0] rcu_gp_fqs_loop+0x2af/0xf80 [ 122.094018][ C0] ? debug_smp_processor_id+0x17/0x20 [ 122.099243][ C0] ? __note_gp_changes+0x4ab/0x920 [ 122.104173][ C0] ? rcu_gp_init+0xc30/0xc30 [ 122.108600][ C0] ? _raw_spin_unlock_irq+0x4e/0x70 [ 122.113718][ C0] ? rcu_gp_init+0x9cf/0xc30 [ 122.118236][ C0] rcu_gp_kthread+0xa4/0x350 [ 122.122657][ C0] ? _raw_spin_lock+0x1b0/0x1b0 [ 122.127343][ C0] ? rcu_barrier_callback+0x50/0x50 [ 122.132390][ C0] ? __kasan_check_read+0x11/0x20 [ 122.137239][ C0] ? __kthread_parkme+0xb2/0x200 [ 122.142012][ C0] kthread+0x421/0x510 [ 122.145919][ C0] ? rcu_barrier_callback+0x50/0x50 [ 122.150950][ C0] ? kthread_blkcg+0xd0/0xd0 [ 122.155379][ C0] ret_from_fork+0x1f/0x30 [ 122.159642][ C0] [ 122.162496][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 122.168745][ C0] Sending NMI from CPU 0 to CPUs 1: [ 122.173790][ C1] NMI backtrace for cpu 1 [ 122.173797][ C1] CPU: 1 PID: 296 Comm: syz-executor319 Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 122.173813][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 122.173820][ C1] RIP: 0010:_raw_spin_lock_irqsave+0x10a/0x210 [ 122.173839][ C1] Code: 89 ef be 04 00 00 00 e8 84 7d e9 fc 4c 89 e7 be 04 00 00 00 e8 77 7d e9 fc 42 0f b6 04 3b 84 c0 0f 85 bf 00 00 00 8b 44 24 40 01 00 00 00 f0 41 0f b1 4d 00 75 45 48 c7 44 24 20 0e 36 e0 45 [ 122.173851][ C1] RSP: 0018:ffffc900001d0b20 EFLAGS: 00000097 [ 122.173864][ C1] RAX: 0000000000000000 RBX: 1ffff9200003a16c RCX: ffffc900001d0b03 [ 122.173874][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc900001d0b60 [ 122.173884][ C1] RBP: ffffc900001d0c00 R08: dffffc0000000000 R09: 0000000000000003 [ 122.173894][ C1] R10: fffff5200003a16c R11: dffffc0000000001 R12: ffffc900001d0b60 [ 122.173904][ C1] R13: ffff88810ac7e138 R14: 1ffff9200003a168 R15: dffffc0000000000 [ 122.173915][ C1] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 122.173927][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 122.173938][ C1] CR2: 00007f212803e130 CR3: 000000000680f000 CR4: 00000000003506a0 [ 122.173951][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 122.173959][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 122.173968][ C1] Call Trace: [ 122.173973][ C1] [ 122.173977][ C1] ? show_regs+0x58/0x60 [ 122.173992][ C1] ? nmi_cpu_backtrace+0x29f/0x300 [ 122.174013][ C1] ? ___ratelimit+0x3c0/0x5a0 [ 122.174029][ C1] ? nmi_trigger_cpumask_backtrace+0x270/0x270 [ 122.174045][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 122.174060][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 122.174076][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 122.174092][ C1] ? nmi_handle+0xa8/0x280 [ 122.174106][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 122.174120][ C1] ? __raw_callee_save___pv_queued_spin_unlock+0x10/0x17 [ 122.174138][ C1] ? default_do_nmi+0x69/0x160 [ 122.174153][ C1] ? exc_nmi+0xaf/0x120 [ 122.174165][ C1] ? end_repeat_nmi+0x16/0x31 [ 122.174180][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 122.174195][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 122.174210][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 122.174225][ C1] [ 122.174230][ C1] [ 122.174234][ C1] ? _raw_spin_lock+0x1b0/0x1b0 [ 122.174249][ C1] ? snd_timer_user_tinterrupt+0xc90/0xc90 [ 122.174264][ C1] ? snd_timer_process_callbacks+0x2f7/0x310 [ 122.174279][ C1] snd_timer_interrupt+0x22e/0x1050 [ 122.174292][ C1] ? __kasan_check_write+0x14/0x20 [ 122.174306][ C1] ? _raw_spin_lock+0xa4/0x1b0 [ 122.174320][ C1] ? _raw_spin_trylock_bh+0x190/0x190 [ 122.174337][ C1] snd_hrtimer_callback+0x1db/0x330 [ 122.174351][ C1] ? snd_hrtimer_stop+0xa0/0xa0 [ 122.174364][ C1] __hrtimer_run_queues+0x41a/0xad0 [ 122.174380][ C1] ? hrtimer_interrupt+0xaa0/0xaa0 [ 122.174393][ C1] ? clockevents_program_event+0x236/0x300 [ 122.174408][ C1] ? ktime_get_update_offsets_now+0x2ba/0x2d0 [ 122.174424][ C1] hrtimer_interrupt+0x40c/0xaa0 [ 122.174440][ C1] __sysvec_apic_timer_interrupt+0xfd/0x3c0 [ 122.174455][ C1] sysvec_apic_timer_interrupt+0x95/0xc0 [ 122.174470][ C1] [ 122.174474][ C1] [ 122.174478][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 122.174495][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80 [ 122.174512][ C1] Code: 8d 86 e8 5c 76 e9 fc 48 83 3d 0c 99 c4 01 00 74 35 48 89 df e8 8e 28 8c fc 66 90 41 f7 c6 00 02 00 00 74 01 fb bf 01 00 00 00 44 6c 83 fc 65 8b 05 95 b1 39 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 122.174524][ C1] RSP: 0018:ffffc900009a7a68 EFLAGS: 00000206 [ 122.174535][ C1] RAX: 0000000000000001 RBX: ffff88810ac7e138 RCX: dffffc0000000000 [ 122.174545][ C1] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000001 [ 122.174554][ C1] RBP: ffffc900009a7a78 R08: ffffffff83c281c7 R09: ffffed10239c54ee [ 122.174564][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88810ac7e0b0 [ 122.174574][ C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000001 [ 122.174584][ C1] ? snd_timer_notify1+0x217/0x350 [ 122.174598][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x80 [ 122.174614][ C1] snd_timer_stop1+0x7af/0x8f0 [ 122.174628][ C1] snd_timer_close_locked+0x22e/0x920 [ 122.174642][ C1] snd_timer_user_release+0x121/0x2c0 [ 122.174656][ C1] ? snd_timer_user_open+0x180/0x180 [ 122.174669][ C1] ? percpu_counter_add_batch+0x13d/0x160 [ 122.174683][ C1] ? snd_timer_user_open+0x180/0x180 [ 122.174696][ C1] __fput+0x3fe/0x910 [ 122.174712][ C1] ____fput+0x15/0x20 [ 122.174724][ C1] task_work_run+0x129/0x190 [ 122.174738][ C1] do_exit+0xc48/0x2ca0 [ 122.174753][ C1] ? put_task_struct+0x80/0x80 [ 122.174766][ C1] ? ptrace_notify+0x24c/0x350 [ 122.174781][ C1] ? do_notify_parent+0xa30/0xa30 [ 122.174796][ C1] do_group_exit+0x141/0x310 [ 122.174810][ C1] __x64_sys_exit_group+0x3f/0x40 [ 122.174824][ C1] do_syscall_64+0x3d/0xb0 [ 122.174837][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 122.174853][ C1] RIP: 0033:0x7f2127fc2db9 [ 122.174864][ C1] Code: Unable to access opcode bytes at RIP 0x7f2127fc2d8f. [ 122.174871][ C1] RSP: 002b:00007ffe5d2ca048 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 122.174884][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc2db9 [ 122.174894][ C1] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 122.174902][ C1] RBP: 00007f212803d2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 122.174912][ C1] R10: 00000000000000a0 R11: 0000000000000246 R12: 00007f212803d2b0 [ 122.174921][ C1] R13: 0000000000000000 R14: 00007f212803dd20 R15: 00007f2127f93f50 [ 122.174933][ C1] [ 244.467029][ T31] INFO: task jbd2/sda1-8:64 blocked for more than 121 seconds. [ 244.474409][ T31] Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 244.482050][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.490706][ T31] task:jbd2/sda1-8 state:D stack:24592 pid: 64 ppid: 2 flags:0x00004000 [ 244.499949][ T31] Call Trace: [ 244.503039][ T31] [ 244.505820][ T31] __schedule+0xccc/0x1590 [ 244.510866][ T31] ? __sched_text_start+0x8/0x8 [ 244.515527][ T31] ? _raw_spin_lock+0x1b0/0x1b0 [ 244.520410][ T31] schedule+0x11f/0x1e0 [ 244.524379][ T31] io_schedule+0x8f/0x120 [ 244.528695][ T31] bit_wait_io+0x15/0xd0 [ 244.532834][ T31] __wait_on_bit+0xb0/0x180 [ 244.537392][ T31] ? bit_wait+0xd0/0xd0 [ 244.541450][ T31] out_of_line_wait_on_bit+0x1ab/0x230 [ 244.546750][ T31] ? bit_wait+0xd0/0xd0 [ 244.550984][ T31] ? __wait_on_bit+0x180/0x180 [ 244.555559][ T31] ? bit_waitqueue+0x30/0x30 [ 244.560229][ T31] ? _raw_write_trylock+0x1a0/0x1a0 [ 244.565236][ T31] ? _raw_read_unlock+0x25/0x40 [ 244.570096][ T31] __wait_on_buffer+0x7c/0x90 [ 244.574651][ T31] jbd2_journal_commit_transaction+0x346c/0x61f0 [ 244.581019][ T31] ? jbd2_journal_finish_inode_data_buffers+0xb0/0xb0 [ 244.587700][ T31] ? kvm_sched_clock_read+0x18/0x40 [ 244.592757][ T31] ? _raw_spin_lock+0x1b0/0x1b0 [ 244.597621][ T31] ? finish_task_switch+0x167/0x7b0 [ 244.602700][ T31] ? __kasan_check_write+0x14/0x20 [ 244.607893][ T31] ? detach_if_pending+0xcd/0x390 [ 244.613157][ T31] ? lock_timer_base+0x25c/0x270 [ 244.618164][ T31] ? _raw_spin_unlock_irqrestore+0x5c/0x80 [ 244.623787][ T31] ? del_timer_sync+0x1bc/0x230 [ 244.628648][ T31] ? __kasan_check_write+0x14/0x20 [ 244.633680][ T31] ? try_to_del_timer_sync+0x150/0x150 [ 244.639225][ T31] ? _raw_spin_unlock_irqrestore+0x5c/0x80 [ 244.644841][ T31] ? finish_wait+0x17d/0x1b0 [ 244.649407][ T31] kjournald2+0x489/0x890 [ 244.653605][ T31] ? jbd2_seq_info_show+0x620/0x620 [ 244.658810][ T31] ? io_schedule+0x120/0x120 [ 244.663209][ T31] ? __kthread_parkme+0xb2/0x200 [ 244.668130][ T31] kthread+0x421/0x510 [ 244.672006][ T31] ? jbd2_seq_info_show+0x620/0x620 [ 244.677176][ T31] ? kthread_blkcg+0xd0/0xd0 [ 244.681577][ T31] ret_from_fork+0x1f/0x30 [ 244.685829][ T31] [ 244.688889][ T31] INFO: task syz-executor319:299 blocked for more than 121 seconds. [ 244.696679][ T31] Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 244.704230][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.713040][ T31] task:syz-executor319 state:D stack:26736 pid: 299 ppid: 295 flags:0x00004004 [ 244.722223][ T31] Call Trace: [ 244.725354][ T31] [ 244.728326][ T31] __schedule+0xccc/0x1590 [ 244.732567][ T31] ? __sched_text_start+0x8/0x8 [ 244.737551][ T31] ? __mutex_add_waiter+0xe4/0x310 [ 244.743874][ T31] ? __ww_mutex_check_waiters+0x350/0x350 [ 244.749688][ T31] schedule+0x11f/0x1e0 [ 244.753659][ T31] schedule_preempt_disabled+0x13/0x20 [ 244.759186][ T31] __mutex_lock+0x90e/0x1870 [ 244.764133][ T31] ? stack_trace_snprint+0xf0/0xf0 [ 244.769519][ T31] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 244.776105][ T31] ? ____kasan_kmalloc+0xed/0x110 [ 244.781212][ T31] ? ____kasan_kmalloc+0xdb/0x110 [ 244.786055][ T31] ? __kasan_kmalloc+0x9/0x10 [ 244.790715][ T31] ? kstrdup+0x34/0x70 [ 244.794706][ T31] ? __snd_timer_user_ioctl+0x19f8/0x5070 [ 244.800527][ T31] ? snd_timer_user_ioctl+0x62/0x80 [ 244.805541][ T31] ? __x64_sys_ioctl+0x7b/0x90 [ 244.814099][ T31] __mutex_lock_slowpath+0xe/0x10 [ 244.819155][ T31] mutex_lock+0x135/0x1e0 [ 244.823304][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 244.829957][ T31] snd_timer_open+0xb4/0x12e0 [ 244.834448][ T31] ? snd_timer_instance_free+0x90/0x90 [ 244.840018][ T31] ? memcpy+0x56/0x70 [ 244.843820][ T31] __snd_timer_user_ioctl+0x1d1b/0x5070 [ 244.849578][ T31] ? native_set_ldt+0x360/0x360 [ 244.854486][ T31] ? snd_timer_user_fasync+0x60/0x60 [ 244.860097][ T31] ? ioctl_has_perm+0x1f8/0x560 [ 244.865512][ T31] ? ioctl_has_perm+0x3f5/0x560 [ 244.870495][ T31] ? __kasan_check_write+0x14/0x20 [ 244.875540][ T31] ? _raw_spin_unlock_irq+0x4e/0x70 [ 244.881787][ T31] ? cgroup_leave_frozen+0x164/0x2c0 [ 244.887447][ T31] ? selinux_file_ioctl+0x3cc/0x540 [ 244.892511][ T31] ? __kasan_check_write+0x14/0x20 [ 244.898921][ T31] ? mutex_lock+0xb6/0x1e0 [ 244.903191][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 244.909895][ T31] ? ptrace_notify+0x24c/0x350 [ 244.914573][ T31] snd_timer_user_ioctl+0x62/0x80 [ 244.921184][ T31] ? snd_timer_user_poll+0x150/0x150 [ 244.926217][ T31] __se_sys_ioctl+0x114/0x190 [ 244.930955][ T31] __x64_sys_ioctl+0x7b/0x90 [ 244.935357][ T31] do_syscall_64+0x3d/0xb0 [ 244.939784][ T31] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 244.945508][ T31] RIP: 0033:0x7f2127fc4c69 [ 244.950033][ T31] RSP: 002b:00007ffe5d2ca0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 244.959360][ T31] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc4c69 [ 244.967358][ T31] RDX: 0000000020000100 RSI: 0000000040345410 RDI: 0000000000000003 [ 244.975143][ T31] RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0 [ 244.983435][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 244.991464][ T31] R13: 00007ffe5d2ca2c8 R14: 00007ffe5d2ca0d0 R15: 00007ffe5d2ca0c0 [ 244.999647][ T31] [ 245.002642][ T31] INFO: task syz-executor319:301 blocked for more than 122 seconds. [ 245.010607][ T31] Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 245.018010][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 245.026475][ T31] task:syz-executor319 state:D stack:26824 pid: 301 ppid: 297 flags:0x00004004 [ 245.035773][ T31] Call Trace: [ 245.038951][ T31] [ 245.041636][ T31] __schedule+0xccc/0x1590 [ 245.046100][ T31] ? __sched_text_start+0x8/0x8 [ 245.050934][ T31] ? __mutex_add_waiter+0xe4/0x310 [ 245.055853][ T31] ? __ww_mutex_check_waiters+0x350/0x350 [ 245.061541][ T31] schedule+0x11f/0x1e0 [ 245.065500][ T31] schedule_preempt_disabled+0x13/0x20 [ 245.070932][ T31] __mutex_lock+0x90e/0x1870 [ 245.075336][ T31] ? stack_trace_snprint+0xf0/0xf0 [ 245.080429][ T31] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 245.087091][ T31] ? ____kasan_kmalloc+0xed/0x110 [ 245.091856][ T31] ? ____kasan_kmalloc+0xdb/0x110 [ 245.096719][ T31] ? __kasan_kmalloc+0x9/0x10 [ 245.101530][ T31] ? kstrdup+0x34/0x70 [ 245.105405][ T31] ? __snd_timer_user_ioctl+0x19f8/0x5070 [ 245.111281][ T31] ? snd_timer_user_ioctl+0x62/0x80 [ 245.116284][ T31] ? __x64_sys_ioctl+0x7b/0x90 [ 245.121142][ T31] __mutex_lock_slowpath+0xe/0x10 [ 245.125974][ T31] mutex_lock+0x135/0x1e0 [ 245.130281][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 245.136673][ T31] snd_timer_open+0xb4/0x12e0 [ 245.141365][ T31] ? snd_timer_instance_free+0x90/0x90 [ 245.146629][ T31] ? memcpy+0x56/0x70 [ 245.150606][ T31] __snd_timer_user_ioctl+0x1d1b/0x5070 [ 245.155960][ T31] ? native_set_ldt+0x360/0x360 [ 245.160782][ T31] ? snd_timer_user_fasync+0x60/0x60 [ 245.165877][ T31] ? ioctl_has_perm+0x1f8/0x560 [ 245.171195][ T31] ? ioctl_has_perm+0x3f5/0x560 [ 245.175852][ T31] ? __kasan_check_write+0x14/0x20 [ 245.180954][ T31] ? _raw_spin_unlock_irq+0x4e/0x70 [ 245.186136][ T31] ? cgroup_leave_frozen+0x164/0x2c0 [ 245.191483][ T31] ? selinux_file_ioctl+0x3cc/0x540 [ 245.196492][ T31] ? __kasan_check_write+0x14/0x20 [ 245.201576][ T31] ? mutex_lock+0xb6/0x1e0 [ 245.205799][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 245.212380][ T31] ? ptrace_notify+0x24c/0x350 [ 245.217062][ T31] snd_timer_user_ioctl+0x62/0x80 [ 245.221811][ T31] ? snd_timer_user_poll+0x150/0x150 [ 245.227149][ T31] __se_sys_ioctl+0x114/0x190 [ 245.231534][ T31] __x64_sys_ioctl+0x7b/0x90 [ 245.236130][ T31] do_syscall_64+0x3d/0xb0 [ 245.240736][ T31] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 245.246435][ T31] RIP: 0033:0x7f2127fc4c69 [ 245.250846][ T31] RSP: 002b:00007ffe5d2ca0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 245.259176][ T31] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc4c69 [ 245.266876][ T31] RDX: 0000000020000100 RSI: 0000000040345410 RDI: 0000000000000003 [ 245.274789][ T31] RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0 [ 245.282719][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.290507][ T31] R13: 00007ffe5d2ca2c8 R14: 00007ffe5d2ca0d0 R15: 00007ffe5d2ca0c0 [ 245.298404][ T31] [ 245.301178][ T31] INFO: task syz-executor319:302 blocked for more than 122 seconds. [ 245.309117][ T31] Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 245.316275][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 245.324937][ T31] task:syz-executor319 state:D stack:27280 pid: 302 ppid: 298 flags:0x00004002 [ 245.334148][ T31] Call Trace: [ 245.337270][ T31] [ 245.339947][ T31] __schedule+0xccc/0x1590 [ 245.344191][ T31] ? __sched_text_start+0x8/0x8 [ 245.349045][ T31] ? __mutex_add_waiter+0x1b5/0x310 [ 245.354048][ T31] ? __ww_mutex_check_waiters+0x350/0x350 [ 245.359751][ T31] schedule+0x11f/0x1e0 [ 245.363714][ T31] schedule_preempt_disabled+0x13/0x20 [ 245.369160][ T31] __mutex_lock+0x90e/0x1870 [ 245.373730][ T31] ? stack_trace_snprint+0xf0/0xf0 [ 245.378816][ T31] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 245.385386][ T31] ? __stack_depot_save+0x34/0x470 [ 245.390469][ T31] ? kasan_set_free_info+0x23/0x40 [ 245.395387][ T31] ? kmem_cache_free+0x116/0x2e0 [ 245.400329][ T31] ? kmem_cache_free+0x116/0x2e0 [ 245.405088][ T31] ? kasan_set_track+0x5d/0x70 [ 245.409808][ T31] ? kasan_set_track+0x4b/0x70 [ 245.414461][ T31] ? kasan_set_free_info+0x23/0x40 [ 245.419571][ T31] ? locks_remove_file+0x41a/0x1180 [ 245.424720][ T31] ? kmem_cache_free+0x116/0x2e0 [ 245.429620][ T31] ? exit_fs+0x121/0x150 [ 245.433680][ T31] ? do_exit+0xc19/0x2ca0 [ 245.438153][ T31] ? __x64_sys_exit_group+0x3f/0x40 [ 245.443406][ T31] ? locks_remove_posix+0x610/0x610 [ 245.448836][ T31] __mutex_lock_slowpath+0xe/0x10 [ 245.453676][ T31] mutex_lock+0x135/0x1e0 [ 245.457999][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 245.464402][ T31] ? __fsnotify_parent+0x4b9/0x6c0 [ 245.469511][ T31] snd_timer_user_release+0x114/0x2c0 [ 245.474693][ T31] ? snd_timer_user_open+0x180/0x180 [ 245.479980][ T31] ? kmem_cache_free+0x116/0x2e0 [ 245.484724][ T31] ? ____kasan_slab_free+0x131/0x160 [ 245.489988][ T31] ? snd_timer_user_open+0x180/0x180 [ 245.495080][ T31] __fput+0x3fe/0x910 [ 245.499141][ T31] ____fput+0x15/0x20 [ 245.503018][ T31] task_work_run+0x129/0x190 [ 245.507585][ T31] do_exit+0xc48/0x2ca0 [ 245.511549][ T31] ? put_task_struct+0x80/0x80 [ 245.516323][ T31] ? ptrace_notify+0x24c/0x350 [ 245.521128][ T31] ? do_notify_parent+0xa30/0xa30 [ 245.525961][ T31] do_group_exit+0x141/0x310 [ 245.530530][ T31] __x64_sys_exit_group+0x3f/0x40 [ 245.535365][ T31] do_syscall_64+0x3d/0xb0 [ 245.539747][ T31] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 245.545459][ T31] RIP: 0033:0x7f2127fc2db9 [ 245.549851][ T31] RSP: 002b:00007ffe5d2ca048 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 245.558170][ T31] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc2db9 [ 245.565886][ T31] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 245.573957][ T31] RBP: 00007f212803d2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 245.581860][ T31] R10: 00000000000000a0 R11: 0000000000000246 R12: 00007f212803d2b0 [ 245.589781][ T31] R13: 0000000000000000 R14: 00007f212803dd20 R15: 00007f2127f93f50 [ 245.597686][ T31] [ 245.600542][ T31] INFO: task syz-executor319:303 blocked for more than 122 seconds. [ 245.608611][ T31] Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 245.615868][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 245.624597][ T31] task:syz-executor319 state:D stack:26824 pid: 303 ppid: 300 flags:0x00004004 [ 245.633936][ T31] Call Trace: [ 245.637154][ T31] [ 245.639915][ T31] __schedule+0xccc/0x1590 [ 245.644167][ T31] ? __sched_text_start+0x8/0x8 [ 245.649134][ T31] ? __mutex_add_waiter+0xe4/0x310 [ 245.654151][ T31] ? __ww_mutex_check_waiters+0x350/0x350 [ 245.659881][ T31] schedule+0x11f/0x1e0 [ 245.663853][ T31] schedule_preempt_disabled+0x13/0x20 [ 245.669334][ T31] __mutex_lock+0x90e/0x1870 [ 245.673733][ T31] ? stack_trace_snprint+0xf0/0xf0 [ 245.678845][ T31] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 245.685431][ T31] ? ____kasan_kmalloc+0xed/0x110 [ 245.690417][ T31] ? ____kasan_kmalloc+0xdb/0x110 [ 245.695346][ T31] ? __kasan_kmalloc+0x9/0x10 [ 245.700078][ T31] ? kstrdup+0x34/0x70 [ 245.703889][ T31] ? __snd_timer_user_ioctl+0x19f8/0x5070 [ 245.709545][ T31] ? snd_timer_user_ioctl+0x62/0x80 [ 245.714548][ T31] ? __x64_sys_ioctl+0x7b/0x90 [ 245.719326][ T31] __mutex_lock_slowpath+0xe/0x10 [ 245.724156][ T31] mutex_lock+0x135/0x1e0 [ 245.728466][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 245.734863][ T31] snd_timer_open+0xb4/0x12e0 [ 245.739530][ T31] ? snd_timer_instance_free+0x90/0x90 [ 245.744791][ T31] ? memcpy+0x56/0x70 [ 245.748750][ T31] __snd_timer_user_ioctl+0x1d1b/0x5070 [ 245.754190][ T31] ? native_set_ldt+0x360/0x360 [ 245.760458][ T31] ? snd_timer_user_fasync+0x60/0x60 [ 245.765568][ T31] ? ioctl_has_perm+0x1f8/0x560 [ 245.770554][ T31] ? ioctl_has_perm+0x3f5/0x560 [ 245.775218][ T31] ? __kasan_check_write+0x14/0x20 [ 245.780517][ T31] ? _raw_spin_unlock_irq+0x4e/0x70 [ 245.785524][ T31] ? cgroup_leave_frozen+0x164/0x2c0 [ 245.790913][ T31] ? selinux_file_ioctl+0x3cc/0x540 [ 245.795928][ T31] ? __kasan_check_write+0x14/0x20 [ 245.801020][ T31] ? mutex_lock+0xb6/0x1e0 [ 245.805244][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 245.811835][ T31] ? ptrace_notify+0x24c/0x350 [ 245.816408][ T31] snd_timer_user_ioctl+0x62/0x80 [ 245.821469][ T31] ? snd_timer_user_poll+0x150/0x150 [ 245.826570][ T31] __se_sys_ioctl+0x114/0x190 [ 245.831226][ T31] __x64_sys_ioctl+0x7b/0x90 [ 245.835721][ T31] do_syscall_64+0x3d/0xb0 [ 245.840117][ T31] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 245.845819][ T31] RIP: 0033:0x7f2127fc4c69 [ 245.850210][ T31] RSP: 002b:00007ffe5d2ca0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 245.858560][ T31] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc4c69 [ 245.866262][ T31] RDX: 0000000020000100 RSI: 0000000040345410 RDI: 0000000000000003 [ 245.874452][ T31] RBP: 00000000000f4240 R08: 00000000000000a0 R09: 00000000000000a0 [ 245.882358][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.890397][ T31] R13: 00007ffe5d2ca2c8 R14: 00007ffe5d2ca0d0 R15: 00007ffe5d2ca0c0 [ 245.898417][ T31] [ 245.901381][ T31] NMI backtrace for cpu 0 [ 245.905526][ T31] CPU: 0 PID: 31 Comm: khungtaskd Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 245.915230][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 245.925302][ T31] Call Trace: [ 245.928427][ T31] [ 245.931199][ T31] dump_stack_lvl+0x151/0x1b7 [ 245.935806][ T31] ? io_uring_drop_tctx_refs+0x190/0x190 [ 245.941276][ T31] dump_stack+0x15/0x17 [ 245.945260][ T31] nmi_cpu_backtrace+0x2f7/0x300 [ 245.950031][ T31] ? nmi_trigger_cpumask_backtrace+0x270/0x270 [ 245.956024][ T31] ? sched_show_task+0x3d8/0x620 [ 245.960793][ T31] ? __rcu_read_unlock+0xd0/0xd0 [ 245.965566][ T31] ? arch_trigger_cpumask_backtrace+0x20/0x20 [ 245.971468][ T31] nmi_trigger_cpumask_backtrace+0x15d/0x270 [ 245.977283][ T31] ? arch_trigger_cpumask_backtrace+0x20/0x20 [ 245.983223][ T31] arch_trigger_cpumask_backtrace+0x10/0x20 [ 245.989001][ T31] watchdog+0xdd7/0xf50 [ 245.993084][ T31] ? __kasan_check_write+0x14/0x20 [ 245.998119][ T31] ? hungtask_pm_notify+0x50/0x50 [ 246.002993][ T31] ? __kasan_check_read+0x11/0x20 [ 246.007832][ T31] ? __kthread_parkme+0xb2/0x200 [ 246.012609][ T31] kthread+0x421/0x510 [ 246.016520][ T31] ? hungtask_pm_notify+0x50/0x50 [ 246.021373][ T31] ? kthread_blkcg+0xd0/0xd0 [ 246.025800][ T31] ret_from_fork+0x1f/0x30 [ 246.030052][ T31] [ 246.032967][ T31] Sending NMI from CPU 0 to CPUs 1: [ 246.038007][ C1] NMI backtrace for cpu 1 [ 246.038015][ C1] CPU: 1 PID: 296 Comm: syz-executor319 Not tainted 5.15.148-syzkaller-00718-g993bed180178 #0 [ 246.038032][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 246.038040][ C1] RIP: 0010:kasan_check_range+0x6/0x2a0 [ 246.038059][ C1] Code: c6 48 89 c7 e8 6b 16 11 03 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 fb 48 [ 246.038071][ C1] RSP: 0018:ffffc900001d0a78 EFLAGS: 00000056 [ 246.038085][ C1] RAX: 0000000000000001 RBX: 1ffff9200003a154 RCX: ffffffff84c8b4a4 [ 246.038096][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc900001d0ac0 [ 246.038106][ C1] RBP: ffffc900001d0a80 R08: dffffc0000000000 R09: ffffed1021bc82ca [ 246.038117][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 246.038127][ C1] R13: ffff88810de41648 R14: 1ffff9200003a158 R15: ffffc900001d0ac0 [ 246.038139][ C1] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 246.038151][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 246.038162][ C1] CR2: 00007f212803e130 CR3: 000000000680f000 CR4: 00000000003506a0 [ 246.038176][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 246.038185][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 246.038194][ C1] Call Trace: [ 246.038199][ C1] [ 246.038204][ C1] ? show_regs+0x58/0x60 [ 246.038225][ C1] ? nmi_cpu_backtrace+0x29f/0x300 [ 246.038241][ C1] ? ___ratelimit+0x3c0/0x5a0 [ 246.038256][ C1] ? nmi_trigger_cpumask_backtrace+0x270/0x270 [ 246.038273][ C1] ? kasan_check_range+0x6/0x2a0 [ 246.038286][ C1] ? kasan_check_range+0x6/0x2a0 [ 246.038299][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 246.038315][ C1] ? nmi_handle+0xa8/0x280 [ 246.038329][ C1] ? kasan_check_range+0x6/0x2a0 [ 246.038342][ C1] ? _raw_spin_lock_irqsave+0x10a/0x210 [ 246.038360][ C1] ? default_do_nmi+0x69/0x160 [ 246.038375][ C1] ? exc_nmi+0xaf/0x120 [ 246.038388][ C1] ? end_repeat_nmi+0x16/0x31 [ 246.038402][ C1] ? _raw_spin_lock+0xa4/0x1b0 [ 246.038417][ C1] ? kasan_check_range+0x6/0x2a0 [ 246.038430][ C1] ? kasan_check_range+0x6/0x2a0 [ 246.038443][ C1] ? kasan_check_range+0x6/0x2a0 [ 246.038456][ C1] [ 246.038461][ C1] [ 246.038465][ C1] __kasan_check_write+0x14/0x20 [ 246.038479][ C1] _raw_spin_lock+0xa4/0x1b0 [ 246.038493][ C1] ? _raw_spin_trylock_bh+0x190/0x190 [ 246.038509][ C1] ? __kasan_check_write+0x14/0x20 [ 246.038524][ C1] snd_timer_user_interrupt+0x55/0x470 [ 246.038539][ C1] ? _raw_spin_lock+0x1b0/0x1b0 [ 246.038554][ C1] ? snd_timer_user_tinterrupt+0xc90/0xc90 [ 246.038568][ C1] snd_timer_process_callbacks+0x24b/0x310 [ 246.038583][ C1] snd_timer_interrupt+0xe94/0x1050 [ 246.038598][ C1] snd_hrtimer_callback+0x1db/0x330 [ 246.038613][ C1] ? snd_hrtimer_stop+0xa0/0xa0 [ 246.038626][ C1] __hrtimer_run_queues+0x41a/0xad0 [ 246.038642][ C1] ? hrtimer_interrupt+0xaa0/0xaa0 [ 246.038655][ C1] ? clockevents_program_event+0x236/0x300 [ 246.038734][ C1] ? ktime_get_update_offsets_now+0x2ba/0x2d0 [ 246.038750][ C1] hrtimer_interrupt+0x40c/0xaa0 [ 246.038767][ C1] __sysvec_apic_timer_interrupt+0xfd/0x3c0 [ 246.038781][ C1] sysvec_apic_timer_interrupt+0x95/0xc0 [ 246.038798][ C1] [ 246.038802][ C1] [ 246.038806][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 246.038823][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80 [ 246.038840][ C1] Code: 8d 86 e8 5c 76 e9 fc 48 83 3d 0c 99 c4 01 00 74 35 48 89 df e8 8e 28 8c fc 66 90 41 f7 c6 00 02 00 00 74 01 fb bf 01 00 00 00 44 6c 83 fc 65 8b 05 95 b1 39 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 246.038851][ C1] RSP: 0018:ffffc900009a7a68 EFLAGS: 00000206 [ 246.038863][ C1] RAX: 0000000000000001 RBX: ffff88810ac7e138 RCX: dffffc0000000000 [ 246.038873][ C1] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000001 [ 246.038882][ C1] RBP: ffffc900009a7a78 R08: ffffffff83c281c7 R09: ffffed10239c54ee [ 246.038893][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88810ac7e0b0 [ 246.038903][ C1] R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000001 [ 246.038913][ C1] ? snd_timer_notify1+0x217/0x350 [ 246.038928][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x80 [ 246.038944][ C1] snd_timer_stop1+0x7af/0x8f0 [ 246.038958][ C1] snd_timer_close_locked+0x22e/0x920 [ 246.038973][ C1] snd_timer_user_release+0x121/0x2c0 [ 246.038987][ C1] ? snd_timer_user_open+0x180/0x180 [ 246.039000][ C1] ? percpu_counter_add_batch+0x13d/0x160 [ 246.039014][ C1] ? snd_timer_user_open+0x180/0x180 [ 246.039028][ C1] __fput+0x3fe/0x910 [ 246.039044][ C1] ____fput+0x15/0x20 [ 246.039057][ C1] task_work_run+0x129/0x190 [ 246.039072][ C1] do_exit+0xc48/0x2ca0 [ 246.039087][ C1] ? put_task_struct+0x80/0x80 [ 246.039101][ C1] ? ptrace_notify+0x24c/0x350 [ 246.039116][ C1] ? do_notify_parent+0xa30/0xa30 [ 246.039131][ C1] do_group_exit+0x141/0x310 [ 246.039146][ C1] __x64_sys_exit_group+0x3f/0x40 [ 246.039160][ C1] do_syscall_64+0x3d/0xb0 [ 246.039173][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 246.039189][ C1] RIP: 0033:0x7f2127fc2db9 [ 246.039200][ C1] Code: Unable to access opcode bytes at RIP 0x7f2127fc2d8f. [ 246.039207][ C1] RSP: 002b:00007ffe5d2ca048 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 246.039221][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2127fc2db9 [ 246.039231][ C1] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 246.039239][ C1] RBP: 00007f212803d2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 246.039249][ C1] R10: 00000000000000a0 R11: 0000000000000246 R12: 00007f212803d2b0 [ 246.039258][ C1] R13: 0000000000000000 R14: 00007f212803dd20 R15: 00007f2127f93f50 [ 246.039270][ C1]