[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.125' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 560.996290][ T2960] Bluetooth: hci0: command 0x0409 tx timeout [ 563.075411][ T2960] Bluetooth: hci0: command 0x041b tx timeout [ 565.155385][ T8501] Bluetooth: hci0: command 0x040f tx timeout [ 567.235135][ T8501] Bluetooth: hci0: command 0x0419 tx timeout [ 569.314970][ T8501] Bluetooth: hci0: command 0x0405 tx timeout [ 682.427600][ T8501] Bluetooth: hci0: command 0x0406 tx timeout [ 721.305593][ T1653] INFO: task syz-executor255:8499 blocked for more than 143 seconds. [ 721.313854][ T1653] Not tainted 5.14.0-rc7-syzkaller #0 [ 721.320891][ T1653] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 721.329680][ T1653] task:syz-executor255 state:D stack:27528 pid: 8499 ppid: 8467 flags:0x00004006 [ 721.339018][ T1653] Call Trace: [ 721.342304][ T1653] __schedule+0x93a/0x26f0 [ 721.346883][ T1653] ? io_schedule_timeout+0x140/0x140 [ 721.352179][ T1653] ? mark_held_locks+0x9f/0xe0 [ 721.357048][ T1653] schedule+0xd3/0x270 [ 721.361177][ T1653] __lock_sock+0x13d/0x260 [ 721.365721][ T1653] ? sock_omalloc+0x180/0x180 [ 721.370413][ T1653] ? finish_wait+0x270/0x270 [ 721.375058][ T1653] ? rwlock_bug.part.0+0x90/0x90 [ 721.380068][ T1653] lock_sock_nested+0xf6/0x120 [ 721.384845][ T1653] rfcomm_sk_state_change+0xb4/0x390 [ 721.390284][ T1653] __rfcomm_dlc_close+0x1b6/0x8a0 [ 721.395479][ T1653] rfcomm_dlc_close+0x1ea/0x240 [ 721.400351][ T1653] __rfcomm_sock_close+0xac/0x260 [ 721.405459][ T1653] rfcomm_sock_shutdown+0xe9/0x210 [ 721.410586][ T1653] rfcomm_sock_release+0x5f/0x140 [ 721.415672][ T1653] __sock_release+0xcd/0x280 [ 721.420334][ T1653] sock_close+0x18/0x20 [ 721.424487][ T1653] __fput+0x288/0x920 [ 721.428815][ T1653] ? __sock_release+0x280/0x280 [ 721.433688][ T1653] task_work_run+0xdd/0x1a0 [ 721.438342][ T1653] do_exit+0xbd4/0x2a60 [ 721.442563][ T1653] ? mm_update_next_owner+0x7a0/0x7a0 [ 721.447995][ T1653] ? lock_downgrade+0x6e0/0x6e0 [ 721.452857][ T1653] do_group_exit+0x125/0x310 [ 721.457504][ T1653] get_signal+0x47f/0x2160 [ 721.461981][ T1653] ? lock_downgrade+0x6e0/0x6e0 [ 721.466994][ T1653] arch_do_signal_or_restart+0x2a9/0x1c40 [ 721.472776][ T1653] ? rfcomm_sock_connect+0x15f/0x460 [ 721.478126][ T1653] ? rfcomm_sock_getname+0x300/0x300 [ 721.483434][ T1653] ? __sys_connect_file+0x4e/0x1a0 [ 721.488744][ T1653] ? get_sigframe_size+0x10/0x10 [ 721.493687][ T1653] ? __sys_connect_file+0x1a0/0x1a0 [ 721.499060][ T1653] exit_to_user_mode_prepare+0x17d/0x290 [ 721.504771][ T1653] syscall_exit_to_user_mode+0x19/0x60 [ 721.510472][ T1653] do_syscall_64+0x42/0xb0 [ 721.514911][ T1653] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 721.520993][ T1653] RIP: 0033:0x445fe9 [ 721.524898][ T1653] RSP: 002b:00007ffcbd932648 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 721.533394][ T1653] RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 0000000000445fe9 [ 721.541495][ T1653] RDX: 0000000000000080 RSI: 0000000020000000 RDI: 0000000000000004 [ 721.549608][ T1653] RBP: 0000000000000003 R08: 000000ff00000001 R09: 000000ff00000001 [ 721.557637][ T1653] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000234d2b8 [ 721.565876][ T1653] R13: 0000000000000072 R14: 00007ffcbd9326a0 R15: 0000000000000003 [ 721.573918][ T1653] [ 721.573918][ T1653] Showing all locks held in the system: [ 721.581698][ T1653] 1 lock held by khungtaskd/1653: [ 721.586878][ T1653] #0: ffffffff8b97c280 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 721.596871][ T1653] 1 lock held by krfcommd/4781: [ 721.601716][ T1653] #0: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_run+0x2ed/0x4a20 [ 721.610840][ T1653] 2 locks held by in:imklog/8206: [ 721.615960][ T1653] #0: ffff8880182ce5f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 [ 721.625211][ T1653] #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x233/0x26f0 [ 721.634275][ T1653] 4 locks held by syz-executor255/8499: [ 721.640004][ T1653] #0: ffff888039a83690 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at: __sock_release+0x86/0x280 [ 721.650726][ T1653] #1: ffff88802fa31120 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sock_shutdown+0x54/0x210 [ 721.662582][ T1653] #2: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_close+0x34/0x240 [ 721.672074][ T1653] #3: ffff888141bd6d28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x162/0x8a0 [ 721.681522][ T1653] [ 721.683873][ T1653] ============================================= [ 721.683873][ T1653] [ 721.692395][ T1653] NMI backtrace for cpu 1 [ 721.696801][ T1653] CPU: 1 PID: 1653 Comm: khungtaskd Not tainted 5.14.0-rc7-syzkaller #0 [ 721.705127][ T1653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 721.715163][ T1653] Call Trace: [ 721.718439][ T1653] dump_stack_lvl+0xcd/0x134 [ 721.723175][ T1653] nmi_cpu_backtrace.cold+0x44/0xd7 [ 721.728363][ T1653] ? lapic_can_unplug_cpu+0x80/0x80 [ 721.733602][ T1653] nmi_trigger_cpumask_backtrace+0x1b3/0x230 [ 721.739606][ T1653] watchdog+0xd0a/0xfc0 [ 721.743778][ T1653] ? reset_hung_task_detector+0x30/0x30 [ 721.749305][ T1653] kthread+0x3e5/0x4d0 [ 721.753390][ T1653] ? set_kthread_struct+0x130/0x130 [ 721.758572][ T1653] ret_from_fork+0x1f/0x30 [ 721.763144][ T1653] Sending NMI from CPU 1 to CPUs 0: [ 721.768881][ C0] NMI backtrace for cpu 0 [ 721.768892][ C0] CPU: 0 PID: 14 Comm: rcu_preempt Not tainted 5.14.0-rc7-syzkaller #0 [ 721.768903][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 721.768915][ C0] RIP: 0010:try_to_del_timer_sync+0x2f/0x110 [ 721.768929][ C0] Code: 00 00 00 00 fc ff df 41 54 49 89 fc 55 53 48 83 ec 60 48 89 e3 48 c7 04 24 b3 8a b5 41 48 c7 44 24 08 fe df 13 8b 48 c1 eb 03 <48> c7 44 24 10 10 ea 64 81 4a 8d 04 2b c7 00 f1 f1 f1 f1 c7 40 04 [ 721.768950][ C0] RSP: 0018:ffffc90000d37c70 EFLAGS: 00000a06 [ 721.768964][ C0] RAX: 0000000000000000 RBX: 1ffff920001a6f8e RCX: 0000000000000000 [ 721.768975][ C0] RDX: ffff888010e71c40 RSI: ffffffff8164ec50 RDI: ffffc90000d37d50 [ 721.768986][ C0] RBP: ffffc90000d37d18 R08: 0000000000000000 R09: 0000000000000001 [ 721.768997][ C0] R10: ffffffff8164ec03 R11: 0000000000000001 R12: ffffc90000d37d50 [ 721.769008][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888010e71c40 [ 721.769019][ C0] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 721.769030][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 721.769039][ C0] CR2: 00007f4cc40c0000 CR3: 000000003724f000 CR4: 00000000001506f0 [ 721.769050][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 721.769061][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 721.769070][ C0] Call Trace: [ 721.769075][ C0] ? del_timer_sync+0x17e/0x1b0 [ 721.769082][ C0] del_timer_sync+0x138/0x1b0 [ 721.769089][ C0] schedule_timeout+0x152/0x2a0 [ 721.769095][ C0] ? usleep_range+0x170/0x170 [ 721.769102][ C0] ? destroy_timer_on_stack+0x20/0x20 [ 721.769109][ C0] ? nozomi_card_init.cold+0xdb/0xdef [ 721.769117][ C0] ? _raw_spin_unlock_irqrestore+0x3d/0x70 [ 721.769125][ C0] ? prepare_to_swait_event+0xee/0x470 [ 721.769132][ C0] rcu_gp_kthread+0xd34/0x1980 [ 721.769139][ C0] ? print_cpu_stall_info+0x6b0/0x6b0 [ 721.769147][ C0] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 721.769155][ C0] ? __kthread_parkme+0x15f/0x220 [ 721.769162][ C0] ? print_cpu_stall_info+0x6b0/0x6b0 [ 721.769169][ C0] kthread+0x3e5/0x4d0 [ 721.769175][ C0] ? set_kthread_struct+0x130/0x130 [ 721.769182][ C0] ret_from_fork+0x1f/0x30 [ 721.769398][ T1653] Kernel panic - not syncing: hung_task: blocked tasks [ 721.993808][ T1653] CPU: 1 PID: 1653 Comm: khungtaskd Not tainted 5.14.0-rc7-syzkaller #0 [ 722.002137][ T1653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 722.012183][ T1653] Call Trace: [ 722.015455][ T1653] dump_stack_lvl+0xcd/0x134 [ 722.020058][ T1653] panic+0x306/0x73d [ 722.023984][ T1653] ? __warn_printk+0xf3/0xf3 [ 722.028586][ T1653] ? lapic_can_unplug_cpu+0x80/0x80 [ 722.033798][ T1653] ? preempt_schedule_thunk+0x16/0x18 [ 722.039183][ T1653] ? nmi_trigger_cpumask_backtrace+0x196/0x230 [ 722.045345][ T1653] ? watchdog.cold+0x5/0x158 [ 722.049965][ T1653] watchdog.cold+0x16/0x158 [ 722.054473][ T1653] ? reset_hung_task_detector+0x30/0x30 [ 722.060041][ T1653] kthread+0x3e5/0x4d0 [ 722.064111][ T1653] ? set_kthread_struct+0x130/0x130 [ 722.069399][ T1653] ret_from_fork+0x1f/0x30 [ 722.075314][ T1653] Kernel Offset: disabled [ 722.079636][ T1653] Rebooting in 86400 seconds..