./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2017107590 <...> DUID 00:04:a3:03:08:15:93:78:e3:1f:4c:1c:fb:56:e6:f5:4b:05 forked to background, child pid 3192 [ 35.689771][ T3193] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.692453][ T3193] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.67' (ECDSA) to the list of known hosts. execve("./syz-executor2017107590", ["./syz-executor2017107590"], 0x7ffe1ca67590 /* 10 vars */) = 0 brk(NULL) = 0x555556c1a000 brk(0x555556c1ac40) = 0x555556c1ac40 arch_prctl(ARCH_SET_FS, 0x555556c1a300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2017107590", 4096) = 28 brk(0x555556c3bc40) = 0x555556c3bc40 brk(0x555556c3c000) = 0x555556c3c000 mprotect(0x7f6953d18000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c1a5d0) = 3614 ./strace-static-x86_64: Process 3614 attached [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c1a5d0) = 3615 ./strace-static-x86_64: Process 3616 attached ./strace-static-x86_64: Process 3615 attached [pid 3613] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3616 [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3616] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3615] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 ./strace-static-x86_64: Process 3617 attached [pid 3613] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3617 [pid 3616] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3618 [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3618 attached [pid 3617] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3618] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3613] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3619 [pid 3618] <... prctl resumed>) = 0 [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3618] setpgid(0, 0 [pid 3615] setpgid(0, 0 [pid 3613] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3620 ./strace-static-x86_64: Process 3621 attached ./strace-static-x86_64: Process 3620 attached ./strace-static-x86_64: Process 3619 attached [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3618] <... setpgid resumed>) = 0 [pid 3615] <... setpgid resumed>) = 0 [pid 3620] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3619] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3617] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3621 [pid 3615] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 3624 attached ./strace-static-x86_64: Process 3623 attached ./strace-static-x86_64: Process 3622 attached [pid 3613] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3622 [pid 3621] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3620] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3623 [pid 3619] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3624 [pid 3615] <... openat resumed>) = 3 [pid 3615] write(3, "1000", 4 [pid 3624] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3621] <... prctl resumed>) = 0 [pid 3615] <... write resumed>) = 4 [pid 3624] <... prctl resumed>) = 0 [pid 3618] <... openat resumed>) = 3 [pid 3621] setpgid(0, 0 [pid 3615] close(3 [pid 3624] setpgid(0, 0 [pid 3615] <... close resumed>) = 0 [pid 3624] <... setpgid resumed>) = 0 [pid 3623] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3621] <... setpgid resumed>) = 0 [pid 3618] write(3, "1000", 4 [pid 3615] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK./strace-static-x86_64: Process 3625 attached [pid 3624] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3623] <... prctl resumed>) = 0 [pid 3622] <... clone resumed>, child_tidptr=0x555556c1a5d0) = 3625 [pid 3621] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3618] <... write resumed>) = 4 [pid 3615] <... openat resumed>) = 3 [pid 3624] <... openat resumed>) = 3 [pid 3615] dup(3 [pid 3624] write(3, "1000", 4 [pid 3623] setpgid(0, 0 [pid 3621] <... openat resumed>) = 3 [pid 3618] close(3 [pid 3615] <... dup resumed>) = 4 [pid 3624] <... write resumed>) = 4 [pid 3623] <... setpgid resumed>) = 0 [pid 3621] write(3, "1000", 4 [pid 3618] <... close resumed>) = 0 [pid 3615] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3625] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3624] close(3 [pid 3623] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3621] <... write resumed>) = 4 [pid 3618] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK [pid 3624] <... close resumed>) = 0 [pid 3621] close(3 [pid 3625] <... prctl resumed>) = 0 [pid 3624] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK [pid 3623] <... openat resumed>) = 3 [pid 3621] <... close resumed>) = 0 [pid 3618] <... openat resumed>) = 3 [pid 3625] setpgid(0, 0 [pid 3624] <... openat resumed>) = 3 [pid 3623] write(3, "1000", 4 [pid 3621] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK [pid 3618] dup(3 [pid 3625] <... setpgid resumed>) = 0 [pid 3624] dup(3 [pid 3623] <... write resumed>) = 4 [pid 3621] <... openat resumed>) = 3 [pid 3618] <... dup resumed>) = 4 [pid 3624] <... dup resumed>) = 4 [pid 3623] close(3 [pid 3621] dup(3 [pid 3618] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3624] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3623] <... close resumed>) = 0 [pid 3621] <... dup resumed>) = 4 [pid 3623] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK [pid 3621] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3623] <... openat resumed>) = 3 [pid 3623] dup(3) = 4 [pid 3625] <... openat resumed>) = 3 [pid 3623] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3625] write(3, "1000", 4) = 4 [pid 3625] close(3) = 0 [pid 3625] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK) = 3 [pid 3625] dup(3) = 4 [pid 3625] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3614] kill(-3615, SIGKILL) = 0 [pid 3616] kill(-3618, SIGKILL [pid 3614] kill(3615, SIGKILL [pid 3616] <... kill resumed>) = 0 [pid 3614] <... kill resumed>) = 0 [pid 3616] kill(3618, SIGKILL [pid 3617] kill(-3621, SIGKILL [pid 3616] <... kill resumed>) = 0 [pid 3617] <... kill resumed>) = 0 [pid 3619] kill(-3624, SIGKILL [pid 3617] kill(3621, SIGKILL [pid 3619] <... kill resumed>) = 0 [pid 3617] <... kill resumed>) = 0 [pid 3619] kill(3624, SIGKILL) = 0 [pid 3620] kill(-3623, SIGKILL) = 0 [pid 3620] kill(3623, SIGKILL) = 0 [pid 3622] kill(-3625, SIGKILL) = 0 [pid 3622] kill(3625, SIGKILL) = 0 [pid 3617] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 3619] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 3622] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 3616] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3620] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 3616] fstat(3, [pid 3620] <... openat resumed>) = 3 [pid 3616] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3620] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3616] getdents64(3, [pid 3620] getdents64(3, 0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3616] <... getdents64 resumed>0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3620] getdents64(3, [pid 3616] getdents64(3, [pid 3620] <... getdents64 resumed>0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3616] <... getdents64 resumed>0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3620] close(3 [pid 3616] close(3 [pid 3619] <... openat resumed>) = 3 [pid 3616] <... close resumed>) = 0 [pid 3620] <... close resumed>) = 0 [pid 3617] <... openat resumed>) = 3 [pid 3617] fstat(3, [pid 3619] fstat(3, [pid 3617] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3619] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3617] getdents64(3, [pid 3619] getdents64(3, [pid 3617] <... getdents64 resumed>0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3619] <... getdents64 resumed>0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3614] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 3622] <... openat resumed>) = 3 [pid 3619] getdents64(3, [pid 3617] getdents64(3, [pid 3619] <... getdents64 resumed>0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3617] <... getdents64 resumed>0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3614] <... openat resumed>) = 3 [pid 3622] fstat(3, [pid 3619] close(3 [pid 3614] fstat(3, [pid 3617] close(3 [pid 3622] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3614] <... fstat resumed>{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3619] <... close resumed>) = 0 [pid 3617] <... close resumed>) = 0 [pid 3622] getdents64(3, [pid 3614] getdents64(3, [pid 3622] <... getdents64 resumed>0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3614] <... getdents64 resumed>0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3622] getdents64(3, [pid 3614] getdents64(3, [pid 3622] <... getdents64 resumed>0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3614] <... getdents64 resumed>0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3622] close(3 [pid 3614] close(3 [pid 3622] <... close resumed>) = 0 [pid 3614] <... close resumed>) = 0 syzkaller login: [ 76.267523][ T14] cfg80211: failed to load regulatory.db [pid 3615] <... fallocate resumed>) = ? [pid 3615] +++ killed by SIGKILL +++ [pid 3614] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3615, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=5484} --- [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c1a5d0) = 3643 ./strace-static-x86_64: Process 3643 attached [pid 3643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3643] setpgid(0, 0) = 0 [pid 3643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3643] write(3, "1000", 4) = 4 [pid 3643] close(3) = 0 [pid 3643] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK) = 3 [pid 3643] dup(3) = 4 [pid 3643] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3614] kill(-3643, SIGKILL) = 0 [pid 3614] kill(3643, SIGKILL) = 0 [pid 3614] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3614] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3614] getdents64(3, 0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3614] getdents64(3, 0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3614] close(3) = 0 [pid 3618] <... fallocate resumed>) = ? [pid 3618] +++ killed by SIGKILL +++ [pid 3616] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3618, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=5391} --- [pid 3616] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3644 attached , child_tidptr=0x555556c1a5d0) = 3644 [pid 3644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3644] setpgid(0, 0) = 0 [pid 3644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3644] write(3, "1000", 4) = 4 [pid 3644] close(3) = 0 [pid 3644] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK) = 3 [pid 3644] dup(3) = 4 [pid 3644] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3616] kill(-3644, SIGKILL) = 0 [pid 3616] kill(3644, SIGKILL) = 0 [pid 3616] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3616] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3616] getdents64(3, 0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3616] getdents64(3, 0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3616] close(3) = 0 [pid 3624] <... fallocate resumed>) = ? [pid 3624] +++ killed by SIGKILL +++ [pid 3619] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3624, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=5414} --- [pid 3619] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c1a5d0) = 3651 ./strace-static-x86_64: Process 3651 attached [pid 3651] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3651] setpgid(0, 0) = 0 [pid 3651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3651] write(3, "1000", 4) = 4 [pid 3651] close(3) = 0 [pid 3651] openat(AT_FDCWD, "/dev/nullb0", O_RDWR|O_TRUNC|O_NONBLOCK) = 3 [pid 3651] dup(3) = 4 [pid 3651] fallocate(4, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 9223372036854775807 [pid 3619] kill(-3651, SIGKILL) = 0 [pid 3619] kill(3651, SIGKILL) = 0 [pid 3619] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 3619] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 3619] getdents64(3, 0x555556c1b620 /* 2 entries */, 32768) = 48 [pid 3619] getdents64(3, 0x555556c1b620 /* 0 entries */, 32768) = 0 [pid 3619] close(3) = 0 [ 286.166321][ T29] INFO: task syz-executor201:3623 blocked for more than 143 seconds. [ 286.174485][ T29] Not tainted 5.18.0-next-20220527-syzkaller #0 [ 286.181758][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.190765][ T29] task:syz-executor201 state:D stack:28032 pid: 3623 ppid: 3620 flags:0x00004004 [ 286.200056][ T29] Call Trace: [ 286.203350][ T29] [ 286.206355][ T29] __schedule+0xa00/0x4b30 [ 286.210894][ T29] ? find_held_lock+0x2d/0x110 [ 286.216235][ T29] ? io_schedule_timeout+0x140/0x140 [ 286.221971][ T29] ? mark_held_locks+0x9f/0xe0 [ 286.226856][ T29] schedule+0xd2/0x1f0 [ 286.230958][ T29] rwsem_down_write_slowpath+0x68a/0x11a0 [ 286.237187][ T29] ? __down_timeout+0x10/0x10 [ 286.242301][ T29] ? lock_release+0x780/0x780 [ 286.247499][ T29] down_write+0x135/0x150 [ 286.252277][ T29] ? down_write_killable+0x170/0x170 [ 286.258046][ T29] blkdev_fallocate+0x1e2/0x410 [ 286.263368][ T29] ? blkdev_writepage+0x30/0x30 [ 286.268699][ T29] vfs_fallocate+0x487/0xe00 [ 286.273815][ T29] __x64_sys_fallocate+0xcf/0x140 [ 286.278935][ T29] do_syscall_64+0x35/0xb0 [ 286.283399][ T29] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 286.289829][ T29] RIP: 0033:0x7f6953cabe29 [ 286.294673][ T29] RSP: 002b:00007ffebb6a7498 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 286.303203][ T29] RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f6953cabe29 [ 286.313476][ T29] RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000004 [ 286.325118][ T29] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 286.333829][ T29] R10: 7fffffffffffffff R11: 0000000000000246 R12: 00007f6953c6f600 [ 286.342213][ T29] R13: 0000000000000000 R14: 00007ffebb6a74c0 R15: 00007ffebb6a74b0 [ 286.350651][ T29] [ 286.353729][ T29] INFO: task syz-executor201:3625 blocked for more than 143 seconds. [ 286.361949][ T29] Not tainted 5.18.0-next-20220527-syzkaller #0 [ 286.368798][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.377910][ T29] task:syz-executor201 state:D stack:27440 pid: 3625 ppid: 3622 flags:0x00004004 [ 286.387569][ T29] Call Trace: [ 286.391273][ T29] [ 286.394630][ T29] __schedule+0xa00/0x4b30 [ 286.399550][ T29] ? find_held_lock+0x2d/0x110 [ 286.404772][ T29] ? io_schedule_timeout+0x140/0x140 [ 286.410591][ T29] ? mark_held_locks+0x9f/0xe0 [ 286.415799][ T29] schedule+0xd2/0x1f0 [ 286.419995][ T29] rwsem_down_write_slowpath+0x68a/0x11a0 [ 286.425760][ T29] ? __down_timeout+0x10/0x10 [ 286.430537][ T29] ? lock_release+0x780/0x780 [ 286.435271][ T29] down_write+0x135/0x150 [ 286.440083][ T29] ? down_write_killable+0x170/0x170 [ 286.445826][ T29] blkdev_fallocate+0x1e2/0x410 [ 286.451165][ T29] ? blkdev_writepage+0x30/0x30 [ 286.456509][ T29] vfs_fallocate+0x487/0xe00 [ 286.461630][ T29] __x64_sys_fallocate+0xcf/0x140 [ 286.466775][ T29] do_syscall_64+0x35/0xb0 [ 286.471576][ T29] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 286.478069][ T29] RIP: 0033:0x7f6953cabe29 [ 286.482595][ T29] RSP: 002b:00007ffebb6a7498 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 286.491515][ T29] RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f6953cabe29 [ 286.500537][ T29] RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000004 [ 286.508756][ T29] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 286.517211][ T29] R10: 7fffffffffffffff R11: 0000000000000246 R12: 00007f6953c6f600 [ 286.525665][ T29] R13: 0000000000000000 R14: 00007ffebb6a74c0 R15: 00007ffebb6a74b0 [ 286.534115][ T29] [ 286.537632][ T29] INFO: task syz-executor201:3643 blocked for more than 143 seconds. [ 286.546081][ T29] Not tainted 5.18.0-next-20220527-syzkaller #0 [ 286.553350][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.562608][ T29] task:syz-executor201 state:D stack:27344 pid: 3643 ppid: 3614 flags:0x00004004 [ 286.572345][ T29] Call Trace: [ 286.575646][ T29] [ 286.578681][ T29] __schedule+0xa00/0x4b30 [ 286.583142][ T29] ? find_held_lock+0x2d/0x110 [ 286.588434][ T29] ? io_schedule_timeout+0x140/0x140 [ 286.594164][ T29] ? mark_held_locks+0x9f/0xe0 [ 286.599469][ T29] schedule+0xd2/0x1f0 [ 286.603990][ T29] rwsem_down_write_slowpath+0x68a/0x11a0 [ 286.609857][ T29] ? __down_timeout+0x10/0x10 [ 286.614954][ T29] ? lock_release+0x780/0x780 [ 286.620419][ T29] down_write+0x135/0x150 [ 286.624908][ T29] ? down_write_killable+0x170/0x170 [ 286.630759][ T29] blkdev_fallocate+0x1e2/0x410 [ 286.636344][ T29] ? blkdev_writepage+0x30/0x30 [ 286.641795][ T29] vfs_fallocate+0x487/0xe00 [ 286.646956][ T29] __x64_sys_fallocate+0xcf/0x140 [ 286.652392][ T29] do_syscall_64+0x35/0xb0 [ 286.657372][ T29] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 286.663301][ T29] RIP: 0033:0x7f6953cabe29 [ 286.668225][ T29] RSP: 002b:00007ffebb6a7498 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 286.677241][ T29] RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f6953cabe29 [ 286.685650][ T29] RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000004 [ 286.694130][ T29] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 286.702288][ T29] R10: 7fffffffffffffff R11: 0000000000000246 R12: 000000000000cf47 [ 286.710515][ T29] R13: 00007ffebb6a74ac R14: 00007ffebb6a74c0 R15: 00007ffebb6a74b0 [ 286.718651][ T29] [ 286.721711][ T29] [ 286.721711][ T29] Showing all locks held in the system: [ 286.729984][ T29] 1 lock held by khungtaskd/29: [ 286.734854][ T29] #0: ffffffff8bd87060 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 286.745110][ T29] 2 locks held by getty/3290: [ 286.753472][ T29] #0: ffff88814ad6d098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 [ 286.763509][ T29] #1: ffffc90002cd62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xe50/0x13c0 [ 286.774139][ T29] 1 lock held by syz-executor201/3621: [ 286.780125][ T29] 1 lock held by syz-executor201/3623: [ 286.785995][ T29] #0: ffff888140caf6c0 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x1e2/0x410 [ 286.797183][ T29] 1 lock held by syz-executor201/3625: [ 286.803019][ T29] #0: ffff888140caf6c0 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x1e2/0x410 [ 286.814194][ T29] 1 lock held by syz-executor201/3643: [ 286.820182][ T29] #0: ffff888140caf6c0 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x1e2/0x410 [ 286.831325][ T29] 1 lock held by syz-executor201/3644: [ 286.837277][ T29] #0: ffff888140caf6c0 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x1e2/0x410 [ 286.848039][ T29] 1 lock held by syz-executor201/3651: [ 286.853918][ T29] #0: ffff888140caf6c0 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x1e2/0x410 [ 286.865065][ T29] [ 286.867943][ T29] ============================================= [ 286.867943][ T29] [ 286.876887][ T29] NMI backtrace for cpu 0 [ 286.881240][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted 5.18.0-next-20220527-syzkaller #0 [ 286.890245][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 286.900300][ T29] Call Trace: [ 286.903567][ T29] [ 286.906488][ T29] dump_stack_lvl+0xcd/0x134 [ 286.911139][ T29] nmi_cpu_backtrace.cold+0x47/0x144 [ 286.916416][ T29] ? lapic_can_unplug_cpu+0x80/0x80 [ 286.921647][ T29] nmi_trigger_cpumask_backtrace+0x1e6/0x230 [ 286.927640][ T29] watchdog+0xc22/0xf90 [ 286.931832][ T29] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.937805][ T29] kthread+0x2e9/0x3a0 [ 286.941906][ T29] ? kthread_complete_and_exit+0x40/0x40 [ 286.947538][ T29] ret_from_fork+0x1f/0x30 [ 286.952084][ T29] [ 286.955345][ T29] Sending NMI from CPU 0 to CPUs 1: [ 286.960610][ C1] NMI backtrace for cpu 1 [ 286.960619][ C1] CPU: 1 PID: 1214 Comm: kworker/u4:6 Not tainted 5.18.0-next-20220527-syzkaller #0 [ 286.960639][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 286.960651][ C1] Workqueue: events_unbound toggle_allocation_gate [ 286.960757][ C1] RIP: 0010:load_new_mm_cr3+0x32/0x130 [ 286.960795][ C1] Code: f3 74 2a e9 85 00 00 00 48 89 ef e8 88 f8 ff ff 66 81 fb fe 0f 48 89 c6 0f 87 df 00 00 00 83 c3 01 0f b7 c3 48 09 f0 0f 22 d8 <5b> 5d c3 66 81 fe fe 0f 77 68 be 08 00 00 00 48 c7 c7 70 4f bb 8d [ 286.960813][ C1] RSP: 0018:ffffc900056af968 EFLAGS: 00000093 [ 286.960827][ C1] RAX: 000000000ba8e000 RBX: 0000000000000000 RCX: 0000000000000000 [ 286.960839][ C1] RDX: ffff88801ee69d80 RSI: ffffffff81366cf4 RDI: 0000000000000007 [ 286.960851][ C1] RBP: ffffffff8ba8e000 R08: 0000000000000007 R09: 000000001fffffff [ 286.960863][ C1] R10: 000000000ba8e000 R11: 0000000000000001 R12: ffff888140168000 [ 286.960875][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 286.960886][ C1] FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 [ 286.960904][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.960916][ C1] CR2: 0000555556c1a2c0 CR3: 000000000ba8e000 CR4: 00000000003506e0 [ 286.960928][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.960939][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.960950][ C1] Call Trace: [ 286.960956][ C1] [ 286.960963][ C1] switch_mm_irqs_off+0x496/0xa10 [ 286.960992][ C1] ? kasan_check_range+0x13d/0x180 [ 286.961013][ C1] ? kmem_cache_alloc_node_trace+0x116/0x420 [ 286.961047][ C1] __text_poke+0x54b/0x8e0 [ 286.961108][ C1] ? cpumask_weight+0x40/0x40 [ 286.961139][ C1] ? text_poke_memset+0x60/0x60 [ 286.961170][ C1] text_poke_bp_batch+0x44a/0x6c0 [ 286.961198][ C1] ? kmem_cache_alloc_node_trace+0x116/0x420 [ 286.961228][ C1] ? do_sync_core+0x20/0x20 [ 286.961258][ C1] ? __jump_label_update+0x351/0x400 [ 286.961303][ C1] text_poke_finish+0x16/0x30 [ 286.961320][ C1] arch_jump_label_transform_apply+0x13/0x20 [ 286.961346][ C1] jump_label_update+0x32f/0x410 [ 286.961365][ C1] static_key_enable_cpuslocked+0x1b1/0x260 [ 286.961389][ C1] static_key_enable+0x16/0x20 [ 286.961406][ C1] toggle_allocation_gate+0x100/0x390 [ 286.961429][ C1] ? lock_release+0x780/0x780 [ 286.961458][ C1] ? wake_up_kfence_timer+0x20/0x20 [ 286.961480][ C1] ? lockdep_hardirqs_on+0x79/0x100 [ 286.961510][ C1] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 286.961544][ C1] process_one_work+0x996/0x1610 [ 286.961586][ C1] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 286.961611][ C1] ? rwlock_bug.part.0+0x90/0x90 [ 286.961628][ C1] ? _raw_spin_lock_irq+0x41/0x50 [ 286.961650][ C1] worker_thread+0x665/0x1080 [ 286.961676][ C1] ? __kthread_parkme+0x15f/0x220 [ 286.961705][ C1] ? process_one_work+0x1610/0x1610 [ 286.961728][ C1] kthread+0x2e9/0x3a0 [ 286.961744][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 286.961764][ C1] ret_from_fork+0x1f/0x30 [ 286.961795][ C1] [ 286.961801][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.191 msecs [ 286.988986][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 286.989002][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted 5.18.0-next-20220527-syzkaller #0 [ 286.989026][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 286.989039][ T29] Call Trace: [ 286.989045][ T29] [ 286.989053][ T29] dump_stack_lvl+0xcd/0x134 [ 286.989087][ T29] panic+0x2d7/0x636 [ 286.989134][ T29] ? panic_print_sys_info.part.0+0x10b/0x10b [ 286.989164][ T29] ? lapic_can_unplug_cpu+0x80/0x80 [ 286.989191][ T29] ? preempt_schedule_thunk+0x16/0x18 [ 286.989264][ T29] ? watchdog.cold+0x5/0x143 [ 286.989314][ T29] watchdog.cold+0x16/0x143 [ 286.989350][ T29] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.989382][ T29] kthread+0x2e9/0x3a0 [ 286.989403][ T29] ? kthread_complete_and_exit+0x40/0x40 [ 286.989428][ T29] ret_from_fork+0x1f/0x30 [ 286.989471][ T29] [ 286.992648][ T29] Kernel Offset: disabled [ 287.366598][ T29] Rebooting in 86400 seconds..