[ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.53' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 717.694568] INFO: task syz-executor297:8097 blocked for more than 140 seconds. [ 717.702096] Not tainted 4.19.211-syzkaller #0 [ 717.708533] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 717.717402] syz-executor297 D27696 8097 8095 0x00000004 [ 717.723035] Call Trace: [ 717.726908] __schedule+0x887/0x2040 [ 717.730647] ? io_schedule_timeout+0x140/0x140 [ 717.736263] ? lock_downgrade+0x720/0x720 [ 717.740423] ? __mutex_lock+0x418/0x1190 [ 717.745475] schedule+0x8d/0x1b0 [ 717.748853] schedule_preempt_disabled+0xf/0x20 [ 717.753515] __mutex_lock+0x5f0/0x1190 [ 717.758773] ? pipe_wait+0x1bd/0x1e0 [ 717.762493] ? mutex_trylock+0x1a0/0x1a0 [ 717.767514] ? _raw_spin_unlock_irqrestore+0x79/0xe0 [ 717.772640] pipe_wait+0x1bd/0x1e0 [ 717.777178] ? pipe_double_lock+0x200/0x200 [ 717.781505] ? copyin+0xa4/0xf0 [ 717.785729] ? wait_woken+0x250/0x250 [ 717.789536] ? copy_page_from_iter+0x5bd/0x7f0 [ 717.794118] ? kill_fasync+0x1c/0x480 [ 717.800161] pipe_write+0x5c3/0xf80 [ 717.803806] __vfs_write+0x51b/0x770 [ 717.808465] ? kernel_read+0x110/0x110 [ 717.812373] ? security_file_permission+0x1c0/0x220 [ 717.818391] vfs_write+0x1f3/0x540 [ 717.821942] ksys_write+0x12b/0x2a0 [ 717.826498] ? __ia32_sys_read+0xb0/0xb0 [ 717.830573] ? trace_hardirqs_off_caller+0x6e/0x210 [ 717.836614] ? do_syscall_64+0x21/0x620 [ 717.840602] do_syscall_64+0xf9/0x620 [ 717.846355] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 717.851551] RIP: 0033:0x7f50c2931b29 [ 717.856267] Code: Bad RIP value. [ 717.859633] RSP: 002b:00007f50c28e32f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 717.868506] RAX: ffffffffffffffda RBX: 00007f50c29b9428 RCX: 00007f50c2931b29 [ 717.876395] RDX: 00000000fffffecc RSI: 0000000020000000 RDI: 0000000000000004 [ 717.883672] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 717.892044] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f50c29b9420 [ 717.899940] R13: 00007ffed35eafdf R14: 00007f50c29b942c R15: 00007f50c2987074 [ 717.907853] [ 717.907853] Showing all locks held in the system: [ 717.914180] 1 lock held by khungtaskd/1570: [ 717.919494] #0: 000000005519c19a (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 [ 717.928936] 1 lock held by in:imklog/7766: [ 717.933160] #0: 00000000f7d75f86 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 [ 717.942621] 1 lock held by syz-executor297/8097: [ 717.947981] #0: 0000000089367ee1 (&pipe->mutex/1){+.+.}, at: pipe_wait+0x1bd/0x1e0 [ 717.956401] 2 locks held by syz-executor297/8098: [ 717.961291] [ 717.962911] ============================================= [ 717.962911] [ 717.971389] NMI backtrace for cpu 1 [ 717.975082] CPU: 1 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0 [ 717.982523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 717.991870] Call Trace: [ 717.994459] dump_stack+0x1fc/0x2ef [ 717.998099] nmi_cpu_backtrace.cold+0x63/0xa2 [ 718.002590] ? lapic_can_unplug_cpu+0x80/0x80 [ 718.007083] nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 [ 718.012372] watchdog+0x991/0xe60 [ 718.015825] ? reset_hung_task_detector+0x30/0x30 [ 718.020662] kthread+0x33f/0x460 [ 718.024024] ? kthread_park+0x180/0x180 [ 718.027996] ret_from_fork+0x24/0x30 [ 718.031848] Sending NMI from CPU 1 to CPUs 0: [ 718.037254] NMI backtrace for cpu 0 [ 718.037260] CPU: 0 PID: 8098 Comm: syz-executor297 Not tainted 4.19.211-syzkaller #0 [ 718.037267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 718.037270] RIP: 0010:mark_lock+0x73/0x1160 [ 718.037281] Code: 45 20 66 a9 ff 1f 74 7c 48 ba 00 00 00 00 00 fc ff df 4c 89 f1 48 c1 e9 03 0f b6 14 11 84 d2 74 09 80 fa 03 0f 8e d2 07 00 00 <25> ff 1f 00 00 48 69 d8 50 01 00 00 48 81 eb 50 01 00 00 48 81 c3 [ 718.037285] RSP: 0018:ffff888092107148 EFLAGS: 00000046 [ 718.037293] RAX: 00000000000004f3 RBX: 0000000000000000 RCX: 1ffff1101648c5d5 [ 718.037298] RDX: 0000000000000000 RSI: ffff8880b2462e88 RDI: ffff8880b2462600 [ 718.037303] RBP: ffff8880b2462e88 R08: 0000000000000000 R09: 0000000000000000 [ 718.037307] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000040 [ 718.037312] R13: ffff8880b2462600 R14: ffff8880b2462ea8 R15: 0000000000000006 [ 718.037318] FS: 00007f50c28c2700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 [ 718.037322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 718.037327] CR2: 00007f86e5135000 CR3: 00000000b4b4a000 CR4: 00000000003406f0 [ 718.037332] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 718.037336] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 718.037339] Call Trace: [ 718.037342] ? __alloc_skb+0xae/0x560 [ 718.037346] ? ip_set_protocol+0xaa/0x540 [ 718.037349] ? nfnetlink_rcv_msg+0xc4f/0xf60 [ 718.037353] mark_held_locks+0xa6/0xf0 [ 718.037356] ? pipe_to_sendpage+0x268/0x330 [ 718.037360] ? kmem_cache_alloc_node_trace+0x2da/0x3b0 [ 718.037364] lockdep_hardirqs_on+0x3a8/0x5c0 [ 718.037368] kmem_cache_alloc_node_trace+0x2da/0x3b0 [ 718.037371] __kmalloc_node_track_caller+0x38/0x70 [ 718.037374] pskb_expand_head+0x159/0xf20 [ 718.037377] ? do_raw_spin_lock+0xcb/0x220 [ 718.037380] ? check_preemption_disabled+0x41/0x280 [ 718.037383] netlink_trim+0x200/0x250 [ 718.037385] netlink_unicast+0xb9/0x690 [ 718.037388] ? memset+0x20/0x40 [ 718.037391] ? netlink_sendskb+0x110/0x110 [ 718.037393] ? memcpy+0x35/0x50 [ 718.037396] ip_set_protocol+0x3c4/0x540 [ 718.037399] ? ip_set_dump_done+0x230/0x230 [ 718.037402] ? ip_set_dump_done+0x230/0x230 [ 718.037405] nfnetlink_rcv_msg+0xc4f/0xf60 [ 718.037408] ? nfnetlink_net_exit_batch+0x150/0x150 [ 718.037411] ? __lock_acquire+0x6de/0x3ff0 [ 718.037414] ? __lock_acquire+0x6de/0x3ff0 [ 718.037417] ? mark_held_locks+0xf0/0xf0 [ 718.037419] ? kasan_kmalloc+0x139/0x160 [ 718.037422] netlink_rcv_skb+0x160/0x440 [ 718.037425] ? nfnetlink_net_exit_batch+0x150/0x150 [ 718.037428] ? netlink_ack+0xae0/0xae0 [ 718.037431] ? ns_capable+0xde/0x100 [ 718.037434] nfnetlink_rcv+0x1b2/0x420 [ 718.037437] ? nfnetlink_rcv_batch+0x1df0/0x1df0 [ 718.037440] netlink_unicast+0x4d5/0x690 [ 718.037443] ? netlink_sendskb+0x110/0x110 [ 718.037446] ? _copy_from_iter_full+0x229/0x7c0 [ 718.037449] ? __phys_addr_symbol+0x2c/0x70 [ 718.037453] ? __check_object_size+0x17b/0x3e0 [ 718.037456] netlink_sendmsg+0x6c3/0xc50 [ 718.037458] ? aa_af_perm+0x230/0x230 [ 718.037461] ? nlmsg_notify+0x1f0/0x1f0 [ 718.037464] ? nlmsg_notify+0x1f0/0x1f0 [ 718.037467] sock_sendmsg+0xc3/0x120 [ 718.037470] sock_no_sendpage+0xf5/0x140 [ 718.037473] ? __sk_mem_schedule+0xd0/0xd0 [ 718.037476] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 718.037479] ? debug_check_no_obj_freed+0x201/0x490 [ 718.037482] ? __sk_mem_schedule+0xd0/0xd0 [ 718.037485] sock_sendpage+0xdf/0x140 [ 718.037488] pipe_to_sendpage+0x268/0x330 [ 718.037491] ? sockfs_setattr+0x160/0x160 [ 718.037494] ? direct_splice_actor+0x160/0x160 [ 718.037497] ? __put_page+0xcc/0x3a0 [ 718.037500] __splice_from_pipe+0x389/0x800 [ 718.037503] ? direct_splice_actor+0x160/0x160 [ 718.037506] generic_splice_sendpage+0xd4/0x140 [ 718.037509] ? __splice_from_pipe+0x800/0x800 [ 718.037513] ? security_file_permission+0x1c0/0x220 [ 718.037516] ? __splice_from_pipe+0x800/0x800 [ 718.037519] __se_sys_splice+0xfe7/0x16d0 [ 718.037521] ? do_futex+0x1880/0x1880 [ 718.037524] ? __se_sys_tee+0xb90/0xb90 [ 718.037527] ? trace_hardirqs_off_caller+0x6e/0x210 [ 718.037530] ? do_syscall_64+0x21/0x620 [ 718.037533] do_syscall_64+0xf9/0x620 [ 718.037536] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 718.037538] RIP: 0033:0x7f50c2931b29 [ 718.037548] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 718.037551] RSP: 002b:00007f50c28c22e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 718.037558] RAX: ffffffffffffffda RBX: 00007f50c29b9438 RCX: 00007f50c2931b29 [ 718.037563] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 718.037567] RBP: 000000000000001e R08: 000000000004ffe6 R09: 0000000000000000 [ 718.037571] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f50c29b9430 [ 718.037576] R13: 00007f50c29b7140 R14: 00007f50c29b943c R15: 00007f50c2987074 [ 718.037908] Kernel panic - not syncing: hung_task: blocked tasks [ 718.511675] CPU: 1 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0 [ 718.519113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 718.528459] Call Trace: [ 718.531048] dump_stack+0x1fc/0x2ef [ 718.534681] panic+0x26a/0x50e [ 718.537870] ? __warn_printk+0xf3/0xf3 [ 718.541757] ? lapic_can_unplug_cpu+0x80/0x80 [ 718.546243] ? ___preempt_schedule+0x16/0x18 [ 718.550648] ? watchdog+0x991/0xe60 [ 718.554271] ? nmi_trigger_cpumask_backtrace+0x15e/0x1f0 [ 718.559721] watchdog+0x9a2/0xe60 [ 718.563175] ? reset_hung_task_detector+0x30/0x30 [ 718.568015] kthread+0x33f/0x460 [ 718.571374] ? kthread_park+0x180/0x180 [ 718.575343] ret_from_fork+0x24/0x30 [ 718.579327] Kernel Offset: disabled [ 718.582940] Rebooting in 86400 seconds..