./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1708940297 <...> DUID 00:04:9f:e8:07:f9:ba:36:1f:d4:05:68:5a:d1:6a:7f:90:cd forked to background, child pid 4659 [ 39.456146][ T4660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.478539][ T4660] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.51' (ECDSA) to the list of known hosts. execve("./syz-executor1708940297", ["./syz-executor1708940297"], 0x7ffe48786b10 /* 10 vars */) = 0 brk(NULL) = 0x55555721d000 brk(0x55555721dc40) = 0x55555721dc40 arch_prctl(ARCH_SET_FS, 0x55555721d300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1708940297", 4096) = 28 brk(0x55555723ec40) = 0x55555723ec40 brk(0x55555723f000) = 0x55555723f000 mprotect(0x7f2e509ca000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 4995 attached , child_tidptr=0x55555721d5d0) = 4995 [pid 4995] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4995] setpgid(0, 0) = 0 [pid 4995] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 4995] write(3, "1000", 4) = 4 [pid 4995] close(3) = 0 [pid 4995] openat(AT_FDCWD, "/dev/nbd0", O_RDONLY) = 3 [pid 4995] socket(AF_AX25, SOCK_DGRAM, 0 /* AX25_P_??? */) = 4 [pid 4995] dup(4) = 5 [pid 4995] ioctl(3, NBD_SET_SOCK, 5) = 0 [pid 4995] ioctl(3, NBD_DO_IT [pid 4994] kill(-4995, SIGKILL) = 0 [pid 4994] kill(4995, SIGKILL) = 0 syzkaller login: [ 70.511860][ T4995] block nbd0: shutting down sockets [pid 4994] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 4994] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 4994] getdents64(3, 0x55555721e620 /* 2 entries */, 32768) = 48 [pid 4994] getdents64(3, 0x55555721e620 /* 0 entries */, 32768) = 0 [pid 4994] close(3) = 0 [ 81.557878][ T26] cfg80211: failed to load regulatory.db [ 286.355282][ T28] INFO: task syz-executor170:4995 blocked for more than 143 seconds. [ 286.363512][ T28] Not tainted 6.4.0-rc2-syzkaller-00015-g1b66c114d161 #0 [ 286.372070][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.381324][ T28] task:syz-executor170 state:D stack:26216 pid:4995 ppid:4994 flags:0x00004006 [ 286.390613][ T28] Call Trace: [ 286.393893][ T28] [ 286.396875][ T28] __schedule+0x187b/0x4900 [ 286.401577][ T28] ? validate_chain+0x119/0x58e0 [ 286.406657][ T28] ? release_firmware_map_entry+0x190/0x190 [ 286.412601][ T28] ? mark_lock+0x9a/0x340 [ 286.417027][ T28] schedule+0xc3/0x180 [ 286.421174][ T28] schedule_timeout+0xb0/0x310 [ 286.426015][ T28] ? console_conditional_schedule+0x40/0x40 [ 286.431960][ T28] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 286.438044][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.443371][ T28] ? lockdep_hardirqs_on+0x98/0x140 [ 286.448735][ T28] do_wait_for_common+0x449/0x5f0 [ 286.453940][ T28] ? console_conditional_schedule+0x40/0x40 [ 286.459904][ T28] ? bit_wait_io_timeout+0x120/0x120 [ 286.465283][ T28] ? _raw_spin_lock_irq+0xdf/0x120 [ 286.470412][ T28] ? flush_workqueue_prep_pwqs+0x455/0x4b0 [ 286.476623][ T28] wait_for_completion+0x4a/0x60 [ 286.481605][ T28] __flush_workqueue+0x743/0x1620 [ 286.486714][ T28] ? rcu_work_rcufn+0x140/0x140 [ 286.491601][ T28] ? blk_freeze_queue_start+0x100/0x100 [ 286.497297][ T28] ? ktime_get_mono_fast_ns+0x1bd/0x1e0 [ 286.502891][ T28] ? blk_mq_unquiesce_queue+0xc0/0x120 [ 286.508430][ T28] nbd_ioctl+0xb48/0xed0 [ 286.512799][ T28] ? nbd_release+0x130/0x130 [ 286.517452][ T28] ? __asan_memset+0x23/0x40 [ 286.522218][ T28] ? wake_bit_function+0x220/0x220 [ 286.527429][ T28] ? smack_file_alloc_security+0xe0/0xe0 [ 286.533178][ T28] ? nbd_release+0x130/0x130 [ 286.537860][ T28] blkdev_ioctl+0x602/0x7a0 [ 286.542477][ T28] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 286.548129][ T28] ? bpf_lsm_file_ioctl+0x9/0x10 [ 286.553147][ T28] ? security_file_ioctl+0x81/0xa0 [ 286.558407][ T28] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 286.563926][ T28] __se_sys_ioctl+0xf1/0x160 [ 286.568699][ T28] do_syscall_64+0x41/0xc0 [ 286.573178][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.579218][ T28] RIP: 0033:0x7f2e5095d379 [ 286.583752][ T28] RSP: 002b:00007fff3c9d7738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 286.592523][ T28] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2e5095d379 [ 286.600646][ T28] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 [ 286.608716][ T28] RBP: 0000000000000000 R08: 00007fff3c9d78d8 R09: 00007fff3c9d78d8 [ 286.616761][ T28] R10: 00007fff3c9d78d8 R11: 0000000000000246 R12: 00007f2e5091c690 [ 286.624764][ T28] R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 [ 286.632816][ T28] [ 286.635899][ T28] [ 286.635899][ T28] Showing all locks held in the system: [ 286.643634][ T28] 1 lock held by rcu_tasks_kthre/13: [ 286.648992][ T28] #0: ffffffff8cf27670 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20 [ 286.659570][ T28] 1 lock held by rcu_tasks_trace/14: [ 286.664854][ T28] #0: ffffffff8cf27a30 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20 [ 286.675898][ T28] 1 lock held by khungtaskd/28: [ 286.680768][ T28] #0: ffffffff8cf274a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 [ 286.690256][ T28] 2 locks held by kworker/u5:1/4398: [ 286.695777][ T28] #0: ffff88801ff6b138 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 [ 286.706485][ T28] #1: ffffc90006d17d20 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 [ 286.717780][ T28] 2 locks held by getty/4748: [ 286.722474][ T28] #0: ffff88802d542098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 286.732371][ T28] #1: ffffc900015902f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ab/0x1db0 [ 286.742561][ T28] [ 286.744886][ T28] ============================================= [ 286.744886][ T28] [ 286.753404][ T28] NMI backtrace for cpu 1 [ 286.757760][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.4.0-rc2-syzkaller-00015-g1b66c114d161 #0 [ 286.767569][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 [ 286.777636][ T28] Call Trace: [ 286.781004][ T28] [ 286.783934][ T28] dump_stack_lvl+0x1e7/0x2d0 [ 286.788636][ T28] ? nf_tcp_handle_invalid+0x650/0x650 [ 286.794104][ T28] ? panic+0x770/0x770 [ 286.798186][ T28] nmi_cpu_backtrace+0x498/0x4d0 [ 286.803167][ T28] ? vprintk_emit+0x10d/0x1f0 [ 286.807856][ T28] ? nmi_trigger_cpumask_backtrace+0x300/0x300 [ 286.814031][ T28] ? _printk+0xd5/0x120 [ 286.818190][ T28] ? panic+0x770/0x770 [ 286.822276][ T28] ? __wake_up_klogd+0xcc/0x100 [ 286.827133][ T28] ? panic+0x770/0x770 [ 286.831204][ T28] ? __rcu_read_unlock+0x96/0x100 [ 286.836240][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 286.842308][ T28] nmi_trigger_cpumask_backtrace+0x187/0x300 [ 286.848293][ T28] watchdog+0xec2/0xf00 [ 286.852462][ T28] kthread+0x2b8/0x350 [ 286.856550][ T28] ? hungtask_pm_notify+0x90/0x90 [ 286.861596][ T28] ? kthread_blkcg+0xd0/0xd0 [ 286.866203][ T28] ret_from_fork+0x1f/0x30 [ 286.870667][ T28] [ 286.873807][ T28] Sending NMI from CPU 1 to CPUs 0: [ 286.879094][ C0] NMI backtrace for cpu 0 [ 286.879106][ C0] CPU: 0 PID: 1008 Comm: kworker/u4:5 Not tainted 6.4.0-rc2-syzkaller-00015-g1b66c114d161 #0 [ 286.879124][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 [ 286.879134][ C0] Workqueue: events_unbound toggle_allocation_gate [ 286.879157][ C0] RIP: 0010:kasan_check_range+0x9/0x290 [ 286.879182][ C0] Code: c7 e8 6b 7d cc 08 31 c0 c3 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 0f 1f 84 00 00 00 00 00 66 0f 1f 00 55 41 57 41 56 <53> b0 01 48 85 f6 0f 84 9a 01 00 00 48 89 fd 48 01 f5 0f 82 5a 02 [ 286.879195][ C0] RSP: 0018:ffffc90005a5f558 EFLAGS: 00000046 [ 286.879208][ C0] RAX: 0000000000000000 RBX: 0000000000000032 RCX: ffffffff816b1c9a [ 286.879219][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90328260 [ 286.879229][ C0] RBP: 0000000000000019 R08: ffff888021310ac8 R09: 0000000000000000 [ 286.879239][ C0] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000040032 [ 286.879249][ C0] R13: 1ffff11004262155 R14: 0000000000000000 R15: 0000000000000032 [ 286.879259][ C0] FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 286.879272][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.879283][ C0] CR2: 0000559686d15680 CR3: 000000000cd30000 CR4: 00000000003506f0 [ 286.879297][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.879306][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.879316][ C0] Call Trace: [ 286.879321][ C0] [ 286.879327][ C0] __lock_acquire+0x4aa/0x2000 [ 286.879357][ C0] lock_acquire+0x1e3/0x520 [ 286.879378][ C0] ? __get_locked_pte+0x16d/0x1c0 [ 286.879398][ C0] ? inat_get_opcode_attribute+0xc/0x50 [ 286.879418][ C0] ? read_lock_is_recursive+0x20/0x20 [ 286.879443][ C0] ? __text_poke+0x81e/0x9b0 [ 286.879465][ C0] ? __lock_acquire+0x2000/0x2000 [ 286.879486][ C0] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 286.879512][ C0] _raw_spin_lock+0x2e/0x40 [ 286.879528][ C0] ? __get_locked_pte+0x16d/0x1c0 [ 286.879548][ C0] __get_locked_pte+0x16d/0x1c0 [ 286.879568][ C0] ? kmem_cache_alloc_node+0x68/0x350 [ 286.879584][ C0] __text_poke+0x284/0x9b0 [ 286.879606][ C0] ? text_poke_sync+0x20/0x20 [ 286.879649][ C0] ? kmem_cache_alloc_node+0x68/0x350 [ 286.879664][ C0] ? __text_poke+0x9b0/0x9b0 [ 286.879687][ C0] ? text_poke+0x90/0x90 [ 286.879708][ C0] ? __kmem_cache_alloc_node+0x60/0x290 [ 286.879723][ C0] ? perf_event_text_poke+0x258/0x330 [ 286.879745][ C0] ? perf_event_bpf_output+0x2f0/0x2f0 [ 286.879772][ C0] text_poke_bp_batch+0x485/0x950 [ 286.879799][ C0] ? kmem_cache_alloc_node+0x68/0x350 [ 286.879814][ C0] ? text_poke_loc_init+0x680/0x680 [ 286.879839][ C0] ? arch_jump_label_transform_queue+0x81/0xd0 [ 286.879864][ C0] text_poke_finish+0x1a/0x30 [ 286.879885][ C0] arch_jump_label_transform_apply+0x17/0x30 [ 286.879905][ C0] static_key_disable_cpuslocked+0xce/0x1b0 [ 286.879929][ C0] static_key_disable+0x1a/0x20 [ 286.879950][ C0] toggle_allocation_gate+0x1b8/0x250 [ 286.879967][ C0] ? show_object+0xa0/0xa0 [ 286.879983][ C0] ? print_irqtrace_events+0x220/0x220 [ 286.880003][ C0] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 286.880025][ C0] process_one_work+0x8a0/0x10e0 [ 286.880064][ C0] ? worker_detach_from_pool+0x290/0x290 [ 286.880090][ C0] ? _raw_spin_lock_irqsave+0x120/0x120 [ 286.880106][ C0] ? kthread_data+0x52/0xc0 [ 286.880127][ C0] ? wq_worker_running+0x9b/0x1a0 [ 286.880148][ C0] worker_thread+0xa63/0x1210 [ 286.880177][ C0] ? _raw_spin_unlock+0x40/0x40 [ 286.880198][ C0] kthread+0x2b8/0x350 [ 286.880217][ C0] ? pr_cont_work+0x5e0/0x5e0 [ 286.880240][ C0] ? kthread_blkcg+0xd0/0xd0 [ 286.880261][ C0] ret_from_fork+0x1f/0x30 [ 286.880291][ C0] [ 286.880297][ C0] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.202 msecs [ 286.881121][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 287.265490][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.4.0-rc2-syzkaller-00015-g1b66c114d161 #0 [ 287.275316][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 [ 287.285380][ T28] Call Trace: [ 287.288668][ T28] [ 287.291632][ T28] dump_stack_lvl+0x1e7/0x2d0 [ 287.296334][ T28] ? nf_tcp_handle_invalid+0x650/0x650 [ 287.301986][ T28] ? panic+0x770/0x770 [ 287.306074][ T28] ? vscnprintf+0x5d/0x80 [ 287.310441][ T28] panic+0x30f/0x770 [ 287.314406][ T28] ? nmi_trigger_cpumask_backtrace+0x233/0x300 [ 287.320604][ T28] ? __memcpy_flushcache+0x2b0/0x2b0 [ 287.325913][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 287.332029][ T28] ? nmi_trigger_cpumask_backtrace+0x233/0x300 [ 287.338210][ T28] ? nmi_trigger_cpumask_backtrace+0x2b4/0x300 [ 287.344377][ T28] ? nmi_trigger_cpumask_backtrace+0x2b9/0x300 [ 287.350546][ T28] watchdog+0xf00/0xf00 [ 287.354735][ T28] kthread+0x2b8/0x350 [ 287.358816][ T28] ? hungtask_pm_notify+0x90/0x90 [ 287.363858][ T28] ? kthread_blkcg+0xd0/0xd0 [ 287.368460][ T28] ret_from_fork+0x1f/0x30 [ 287.372903][ T28] [ 287.376208][ T28] Kernel Offset: disabled [ 287.380543][ T28] Rebooting in 86400 seconds..