./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1949150480 <...> forked to background, child pid 4640 no interfaces have a carrier [ 28.759418][ T4641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.769118][ T4641] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.61' (ECDSA) to the list of known hosts. execve("./syz-executor1949150480", ["./syz-executor1949150480"], 0x7ffe94977470 /* 10 vars */) = 0 brk(NULL) = 0x555556256000 brk(0x555556256c40) = 0x555556256c40 arch_prctl(ARCH_SET_FS, 0x555556256300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1949150480", 4096) = 28 brk(0x555556277c40) = 0x555556277c40 brk(0x555556278000) = 0x555556278000 mprotect(0x7f6e855e3000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555562565d0) = 5064 ./strace-static-x86_64: Process 5064 attached [pid 5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5064] setpgid(0, 0) = 0 [pid 5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5064] write(3, "1000", 4) = 4 [pid 5064] close(3) = 0 [pid 5064] memfd_create("syzkaller", 0) = 3 [pid 5064] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6e7d128000 [pid 5064] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 5064] munmap(0x7f6e7d128000, 262144) = 0 [pid 5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5064] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5064] close(3) = 0 [pid 5064] mkdir("./file0", 0777) = 0 [pid 5064] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_LAZYTIME, ",errors=continue") = 0 [pid 5064] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5064] chdir("./file0") = 0 [pid 5064] ioctl(4, LOOP_CLR_FD) = 0 [pid 5064] close(4) = 0 [pid 5064] setxattr("./file0", "user.incfs.metadata", "\x10\x95\xf4\x01\x01", 5, 0) = 0 [pid 5064] chdir("./file0") = 0 syzkaller login: [ 53.455086][ T5064] loop0: detected capacity change from 0 to 512 [ 53.470707][ T5064] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. [pid 5064] openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5063] kill(-5064, SIGKILL) = 0 [pid 5063] kill(5064, SIGKILL) = 0 [pid 5063] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5063] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 5063] getdents64(3, 0x555556257620 /* 2 entries */, 32768) = 48 [pid 5063] getdents64(3, 0x555556257620 /* 0 entries */, 32768) = 0 [pid 5063] close(3) = 0 [ 75.798427][ T2677] cfg80211: failed to load regulatory.db [ 285.716966][ T28] INFO: task syz-executor194:5064 blocked for more than 143 seconds. [ 285.725175][ T28] Not tainted 6.1.0-syzkaller-14594-g72a85e2b0a1e #0 [ 285.732607][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 285.741428][ T28] task:syz-executor194 state:D stack:24576 pid:5064 ppid:5063 flags:0x00004004 [ 285.750780][ T28] Call Trace: [ 285.754076][ T28] [ 285.757543][ T28] __schedule+0xb8a/0x5450 [ 285.762042][ T28] ? find_held_lock+0x2d/0x110 [ 285.766974][ T28] ? io_schedule_timeout+0x150/0x150 [ 285.772296][ T28] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 285.778186][ T28] schedule+0xde/0x1b0 [ 285.782308][ T28] io_schedule+0xbe/0x130 [ 285.786821][ T28] bit_wait_io+0x16/0xe0 [ 285.791092][ T28] __wait_on_bit_lock+0x11f/0x1a0 [ 285.796120][ T28] ? out_of_line_wait_on_bit_timeout+0x170/0x170 [ 285.802538][ T28] out_of_line_wait_on_bit_lock+0xd9/0x110 [ 285.808423][ T28] ? __wait_on_bit_lock+0x1a0/0x1a0 [ 285.813641][ T28] ? sugov_start+0x580/0x580 [ 285.818301][ T28] __sync_dirty_buffer+0x30e/0x380 [ 285.823431][ T28] __ext4_handle_dirty_metadata+0x2b7/0x6f0 [ 285.829399][ T28] ext4_handle_dirty_dirblock+0x371/0x470 [ 285.835170][ T28] ? ext4_rename_dir_prepare+0x7b0/0x7b0 [ 285.840893][ T28] ? memcpy+0x3d/0x60 [ 285.844908][ T28] ? ext4_init_dot_dotdot+0x3d7/0x5a0 [ 285.850739][ T28] ext4_convert_inline_data_nolock+0xac1/0xf10 [ 285.857036][ T28] ? ext4_destroy_inline_data_nolock+0x580/0x580 [ 285.863419][ T28] ? ext4_inode_attach_jinode+0x230/0x230 [ 285.869206][ T28] ? get_max_inline_xattr_value_size+0x114/0x560 [ 285.875579][ T28] ext4_try_add_inline_entry+0x473/0x8d0 [ 285.881314][ T28] ? ext4_set_context+0x5a0/0x5a0 [ 285.886375][ T28] ? ext4_da_write_inline_data_begin+0x1270/0x1270 [ 285.892974][ T28] ext4_add_entry+0x80d/0xe30 [ 285.897725][ T28] ? make_indexed_dir+0x1080/0x1080 [ 285.902947][ T28] ? _raw_spin_unlock+0x28/0x40 [ 285.907852][ T28] ? d_splice_alias+0x4e1/0xd40 [ 285.912760][ T28] ext4_add_nondir+0x90/0x290 [ 285.917500][ T28] ext4_create+0x380/0x4e0 [ 285.921957][ T28] ? ext4_symlink+0xa00/0xa00 [ 285.926628][ T28] ? bpf_lsm_inode_create+0x9/0x10 [ 285.931801][ T28] ? ext4_symlink+0xa00/0xa00 [ 285.936546][ T28] lookup_open.isra.0+0xee7/0x1270 [ 285.941803][ T28] ? link_path_walk.part.0+0xdf0/0xdf0 [ 285.947816][ T28] path_openat+0x975/0x2a50 [ 285.952520][ T28] ? path_lookupat+0x840/0x840 [ 285.957899][ T28] do_filp_open+0x1ba/0x410 [ 285.962485][ T28] ? may_open_dev+0xf0/0xf0 [ 285.967046][ T28] ? find_held_lock+0x2d/0x110 [ 285.971874][ T28] ? do_raw_spin_lock+0x124/0x2b0 [ 285.976967][ T28] ? rwlock_bug.part.0+0x90/0x90 [ 285.981969][ T28] ? _raw_spin_unlock+0x28/0x40 [ 285.986896][ T28] ? alloc_fd+0x2d8/0x6d0 [ 285.991260][ T28] do_sys_openat2+0x16d/0x4c0 [ 285.995933][ T28] ? build_open_flags+0x6f0/0x6f0 [ 286.001056][ T28] ? ptrace_notify+0xfe/0x140 [ 286.005763][ T28] ? lock_downgrade+0x6e0/0x6e0 [ 286.010696][ T28] __x64_sys_openat+0x143/0x1f0 [ 286.015589][ T28] ? __ia32_sys_open+0x1c0/0x1c0 [ 286.020592][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.025838][ T28] ? lockdep_hardirqs_on+0x7d/0x100 [ 286.031111][ T28] ? _raw_spin_unlock_irq+0x2e/0x50 [ 286.036347][ T28] ? ptrace_notify+0xfe/0x140 [ 286.041124][ T28] do_syscall_64+0x39/0xb0 [ 286.045585][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.051574][ T28] RIP: 0033:0x7f6e85575259 [ 286.056048][ T28] RSP: 002b:00007ffc69dc76a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 286.064571][ T28] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f6e85575259 [ 286.072653][ T28] RDX: 000000000000275a RSI: 0000000020000100 RDI: 00000000ffffff9c [ 286.080737][ T28] RBP: 0000000020000100 R08: 0000000000000001 R09: 0000000000000001 [ 286.088788][ T28] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc69dc76d0 [ 286.096854][ T28] R13: 0000000000000000 R14: 431bde82d7b634db R15: 0000000000000000 [ 286.104855][ T28] [ 286.107946][ T28] [ 286.107946][ T28] Showing all locks held in the system: [ 286.115708][ T28] 1 lock held by rcu_tasks_kthre/12: [ 286.121120][ T28] #0: ffffffff8c790c70 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 [ 286.131744][ T28] 1 lock held by rcu_tasks_trace/13: [ 286.137187][ T28] #0: ffffffff8c790970 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 [ 286.148303][ T28] 1 lock held by khungtaskd/28: [ 286.153144][ T28] #0: ffffffff8c7917c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x57/0x264 [ 286.163105][ T28] 2 locks held by getty/4739: [ 286.167843][ T28] #0: ffff88814a05f098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 [ 286.177685][ T28] #1: ffffc900015b02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xef4/0x13e0 [ 286.187934][ T28] 3 locks held by syz-executor194/5064: [ 286.193469][ T28] #0: ffff888029106460 (sb_writers#4){.+.+}-{0:0}, at: path_openat+0x2a25/0x2a50 [ 286.202928][ T28] #1: ffff888076a4ca38 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: path_openat+0x90f/0x2a50 [ 286.213288][ T28] #2: ffff888076a4c700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_add_inline_entry+0x10c/0x8d0 [ 286.223955][ T28] [ 286.226304][ T28] ============================================= [ 286.226304][ T28] [ 286.234843][ T28] NMI backtrace for cpu 0 [ 286.239184][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.0-syzkaller-14594-g72a85e2b0a1e #0 [ 286.248639][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 286.258707][ T28] Call Trace: [ 286.261986][ T28] [ 286.264910][ T28] dump_stack_lvl+0xd1/0x138 [ 286.269516][ T28] nmi_cpu_backtrace.cold+0x24/0x18a [ 286.274907][ T28] nmi_trigger_cpumask_backtrace+0x333/0x3c0 [ 286.280895][ T28] ? lapic_can_unplug_cpu+0x80/0x80 [ 286.286096][ T28] watchdog+0xc75/0xfc0 [ 286.290265][ T28] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.296258][ T28] kthread+0x2e8/0x3a0 [ 286.300326][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 286.305957][ T28] ret_from_fork+0x1f/0x30 [ 286.310388][ T28] [ 286.313513][ T28] Sending NMI from CPU 0 to CPUs 1: [ 286.318809][ C1] NMI backtrace for cpu 1 skipped: idling at acpi_idle_do_entry+0x1fd/0x2a0 [ 286.319793][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 286.335379][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.0-syzkaller-14594-g72a85e2b0a1e #0 [ 286.344834][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 286.354883][ T28] Call Trace: [ 286.358151][ T28] [ 286.361065][ T28] dump_stack_lvl+0xd1/0x138 [ 286.365644][ T28] panic+0x2cc/0x626 [ 286.369528][ T28] ? panic_print_sys_info.part.0+0x110/0x110 [ 286.375501][ T28] ? preempt_schedule_thunk+0x1a/0x20 [ 286.380957][ T28] ? watchdog.cold+0x130/0x158 [ 286.385734][ T28] watchdog.cold+0x141/0x158 [ 286.390323][ T28] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.396297][ T28] kthread+0x2e8/0x3a0 [ 286.400364][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 286.405985][ T28] ret_from_fork+0x1f/0x30 [ 286.410406][ T28] [ 286.413887][ T28] Kernel Offset: disabled [ 286.418229][ T28] Rebooting in 86400 seconds..