./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3428298670 <...> DUID 00:04:e5:d7:6b:3e:19:ba:e5:eb:4b:9e:6a:98:ce:0b:a0:29 forked to background, child pid 4647 [ 40.184998][ T4648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.194337][ T4648] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.200' (ECDSA) to the list of known hosts. execve("./syz-executor3428298670", ["./syz-executor3428298670"], 0x7ffd8bc613c0 /* 10 vars */) = 0 brk(NULL) = 0x555556bf3000 brk(0x555556bf3c40) = 0x555556bf3c40 arch_prctl(ARCH_SET_FS, 0x555556bf3300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3428298670", 4096) = 28 brk(0x555556c14c40) = 0x555556c14c40 brk(0x555556c15000) = 0x555556c15000 mprotect(0x7f6156a67000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 5072 mkdir("./syzkaller.rg0JqI", 0700) = 0 chmod("./syzkaller.rg0JqI", 0777) = 0 chdir("./syzkaller.rg0JqI") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556bf35d0) = 5073 ./strace-static-x86_64: Process 5073 attached [pid 5073] chdir("./0") = 0 [pid 5073] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5073] setpgid(0, 0) = 0 [pid 5073] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5073] write(3, "1000", 4) = 4 [pid 5073] close(3) = 0 [pid 5073] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5073] memfd_create("syzkaller", 0) = 3 [pid 5073] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f614e599000 syzkaller login: [ 61.543983][ T5073] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5073 'syz-executor342' [pid 5073] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5073] munmap(0x7f614e599000, 16777216) = 0 [pid 5073] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5073] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5073] close(3) = 0 [pid 5073] mkdir("./file1", 0777) = 0 [ 61.807131][ T5073] loop0: detected capacity change from 0 to 32768 [ 61.821963][ T5073] gfs2: fsid=mounts: Trying to join cluster "lock_nolock", "mounts" [ 61.830155][ T5073] gfs2: fsid=mounts: Now mounting FS (format 1801)... [ 61.844385][ T5073] gfs2: fsid=mounts.0: journal 0 mapped with 5 extents in 0ms [ 61.854187][ T1113] gfs2: fsid=mounts.0: jid=0, already locked for use [ 61.861111][ T1113] gfs2: fsid=mounts.0: jid=0: Looking at journal... [pid 5073] mount("/dev/loop0", "./file1", "gfs2", MS_RDONLY|MS_SYNCHRONOUS|MS_NODIRATIME|MS_LAZYTIME, "hostdata=:,noacl,quota_quantum=0x000000000000001f,locktable=mounts") = 0 [pid 5073] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5073] chdir("./file1") = 0 [pid 5073] ioctl(4, LOOP_CLR_FD) = 0 [pid 5073] close(4) = 0 [pid 5073] fspick(AT_FDCWD, ".", 0) = 4 [ 61.911752][ T1113] gfs2: fsid=mounts.0: jid=0: Journal head lookup took 50ms [ 61.919771][ T1113] gfs2: fsid=mounts.0: jid=0: Done [ 61.925441][ T5073] gfs2: fsid=mounts.0: first mount done, others may mount [pid 5073] fsconfig(4, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0) = 0 [pid 5073] exit_group(0) = ? [pid 5073] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5073, si_uid=0, si_status=0, si_utime=0, si_stime=38 /* 0.38 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555556bf4620 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./0/binderfs") = 0 [ 62.085132][ T5073] gfs2: fsid=mounts.0: found 1 quota changes [ 81.487916][ T2494] cfg80211: failed to load regulatory.db [ 286.286393][ T28] INFO: task syz-executor342:5072 blocked for more than 143 seconds. [ 286.294612][ T28] Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0 [ 286.302324][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.311142][ T28] task:syz-executor342 state:D stack:24760 pid:5072 ppid:5069 flags:0x00004002 [ 286.320542][ T28] Call Trace: [ 286.323840][ T28] [ 286.326962][ T28] __schedule+0x173b/0x4630 [ 286.331649][ T28] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 286.337788][ T28] ? lockdep_hardirqs_on+0x98/0x140 [ 286.343071][ T28] ? release_firmware_map_entry+0x190/0x190 [ 286.349150][ T28] ? __asan_memset+0x23/0x40 [ 286.353858][ T28] ? mod_timer_pending+0x30/0x30 [ 286.358895][ T28] ? lockdep_softirqs_off+0x420/0x420 [ 286.364307][ T28] ? print_irqtrace_events+0x220/0x220 [ 286.369850][ T28] schedule+0xc3/0x180 [ 286.373994][ T28] schedule_timeout+0x1bd/0x310 [ 286.378906][ T28] ? console_conditional_schedule+0x40/0x40 [ 286.384837][ T28] ? update_process_times+0x1b0/0x1b0 [ 286.390307][ T28] ? prepare_to_wait_event+0x3b2/0x3f0 [ 286.395796][ T28] gfs2_gl_hash_clear+0x1a3/0x310 [ 286.401002][ T28] ? gfs2_jindex_free+0x46c/0x500 [ 286.406064][ T28] ? withdraw_dq+0x250/0x250 [ 286.410731][ T28] ? gfs2_jindex_free+0x499/0x500 [ 286.415777][ T28] ? wake_bit_function+0x220/0x220 [ 286.420952][ T28] ? gfs2_setbit+0x630/0x630 [ 286.425580][ T28] ? gfs2_clear_rgrpd+0x6a0/0x6c0 [ 286.430726][ T28] gfs2_put_super+0x827/0x890 [ 286.435433][ T28] ? gfs2_evict_inode+0x14a0/0x14a0 [ 286.440677][ T28] generic_shutdown_super+0x134/0x340 [ 286.446121][ T28] kill_block_super+0x7e/0xe0 [ 286.450890][ T28] deactivate_locked_super+0xa4/0x110 [ 286.456334][ T28] cleanup_mnt+0x426/0x4c0 [ 286.461131][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.466419][ T28] task_work_run+0x24a/0x300 [ 286.471098][ T28] ? dput+0x3a1/0x420 [ 286.475126][ T28] ? task_work_cancel+0x2b0/0x2b0 [ 286.480360][ T28] ? __x64_sys_umount+0x126/0x170 [ 286.485452][ T28] ptrace_notify+0x2cd/0x380 [ 286.490191][ T28] ? do_notify_parent+0xf50/0xf50 [ 286.495251][ T28] ? user_path_at_empty+0x12f/0x180 [ 286.500511][ T28] ? __x64_sys_umount+0x126/0x170 [ 286.505559][ T28] ? path_umount+0xea0/0xea0 [ 286.510234][ T28] ? syscall_enter_from_user_mode+0x32/0x230 [ 286.516279][ T28] syscall_exit_to_user_mode+0x157/0x280 [ 286.521931][ T28] do_syscall_64+0x4d/0xc0 [ 286.526478][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.532510][ T28] RIP: 0033:0x7f61569e7d17 [ 286.537018][ T28] RSP: 002b:00007ffcc9f425a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 286.545479][ T28] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f61569e7d17 [ 286.553569][ T28] RDX: 00007ffcc9f42669 RSI: 000000000000000a RDI: 00007ffcc9f42660 [ 286.561622][ T28] RBP: 00007ffcc9f42660 R08: 00000000ffffffff R09: 00007ffcc9f42440 [ 286.569692][ T28] R10: 0000555556bf4653 R11: 0000000000000202 R12: 00007ffcc9f436d0 [ 286.577721][ T28] R13: 0000555556bf45f0 R14: 00007ffcc9f425d0 R15: 0000000000000001 [ 286.585717][ T28] [ 286.588819][ T28] [ 286.588819][ T28] Showing all locks held in the system: [ 286.596589][ T28] 1 lock held by rcu_tasks_kthre/12: [ 286.601897][ T28] #0: ffffffff8cf255b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20 [ 286.612577][ T28] 1 lock held by rcu_tasks_trace/13: [ 286.617914][ T28] #0: ffffffff8cf25db0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20 [ 286.628984][ T28] 1 lock held by khungtaskd/28: [ 286.633856][ T28] #0: ffffffff8cf253e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 [ 286.643313][ T28] 1 lock held by klogd/4424: [ 286.647992][ T28] #0: ffff8880b993be98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 286.658104][ T28] 2 locks held by getty/4748: [ 286.662813][ T28] #0: ffff8880284e9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 286.672769][ T28] #1: ffffc900015902f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ab/0x1db0 [ 286.682958][ T28] 1 lock held by syz-executor342/5072: [ 286.688488][ T28] #0: ffff88802869c0e0 (&type->s_umount_key#43){+.+.}-{3:3}, at: deactivate_super+0xad/0xf0 [ 286.698765][ T28] [ 286.701086][ T28] ============================================= [ 286.701086][ T28] [ 286.709550][ T28] NMI backtrace for cpu 0 [ 286.713909][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0 [ 286.723706][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 286.733768][ T28] Call Trace: [ 286.737042][ T28] [ 286.739970][ T28] dump_stack_lvl+0x1e7/0x2d0 [ 286.744659][ T28] ? nf_tcp_handle_invalid+0x650/0x650 [ 286.750134][ T28] ? panic+0x770/0x770 [ 286.754210][ T28] nmi_cpu_backtrace+0x498/0x4d0 [ 286.759151][ T28] ? vprintk_emit+0x10d/0x1f0 [ 286.763838][ T28] ? nmi_trigger_cpumask_backtrace+0x300/0x300 [ 286.769995][ T28] ? _printk+0xd5/0x120 [ 286.774165][ T28] ? panic+0x770/0x770 [ 286.778242][ T28] ? __wake_up_klogd+0xcc/0x100 [ 286.783103][ T28] ? panic+0x770/0x770 [ 286.787184][ T28] ? wq_watchdog_touch+0x72/0x110 [ 286.792230][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 286.798368][ T28] nmi_trigger_cpumask_backtrace+0x187/0x300 [ 286.804361][ T28] watchdog+0xec2/0xf00 [ 286.808561][ T28] kthread+0x270/0x300 [ 286.812636][ T28] ? hungtask_pm_notify+0x90/0x90 [ 286.817668][ T28] ? kthread_blkcg+0xd0/0xd0 [ 286.822267][ T28] ret_from_fork+0x1f/0x30 [ 286.826728][ T28] [ 286.829897][ T28] Sending NMI from CPU 0 to CPUs 1: [ 286.835180][ C1] NMI backtrace for cpu 1 [ 286.835191][ C1] CPU: 1 PID: 56 Comm: kworker/u4:4 Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0 [ 286.835210][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 286.835221][ C1] Workqueue: events_unbound toggle_allocation_gate [ 286.835243][ C1] RIP: 0010:inat_get_opcode_attribute+0x31/0x50 [ 286.835266][ C1] Code: e8 14 a1 ec f6 89 d8 48 8d 1c 85 20 4a f7 8b 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 04 8b 03 <5b> c3 89 d9 80 e1 07 80 c1 03 38 c1 7c f0 48 89 df e8 69 57 42 f7 [ 286.835280][ C1] RSP: 0018:ffffc90001577670 EFLAGS: 00000246 [ 286.835294][ C1] RAX: 000000000000b000 RBX: ffffffff8bf74dc4 RCX: dffffc0000000000 [ 286.835307][ C1] RDX: 0000000000000000 RSI: 00000000000000e9 RDI: 00000000000000e9 [ 286.835317][ C1] RBP: 00000000000000e9 R08: ffffffff8a9e0df4 R09: ffffc900015779c0 [ 286.835329][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90001577a28 [ 286.835342][ C1] R13: ffffffff81df239e R14: dffffc0000000000 R15: ffffc900015779c0 [ 286.835354][ C1] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 286.835369][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.835382][ C1] CR2: 000055cfe0c9c680 CR3: 000000000cd30000 CR4: 00000000003506e0 [ 286.835396][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.835406][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.835417][ C1] Call Trace: [ 286.835422][ C1] [ 286.835428][ C1] insn_get_prefixes+0x45a/0x18a0 [ 286.835448][ C1] ? kmem_cache_alloc+0x5f/0x2e0 [ 286.835518][ C1] ? mark_lock+0x9a/0x340 [ 286.835538][ C1] ? __lock_acquire+0x125b/0x1f80 [ 286.835556][ C1] insn_get_opcode+0x1b2/0xa50 [ 286.835584][ C1] insn_get_modrm+0x22e/0x7a0 [ 286.835604][ C1] ? read_lock_is_recursive+0x20/0x20 [ 286.835623][ C1] insn_get_displacement+0x13e/0x980 [ 286.835651][ C1] insn_get_immediate+0x382/0x13d0 [ 286.835671][ C1] ? rcu_is_watching+0x15/0xb0 [ 286.835694][ C1] insn_decode+0x370/0x500 [ 286.835713][ C1] ? kmem_cache_alloc+0x5e/0x2e0 [ 286.835739][ C1] __jump_label_patch+0xe8/0x440 [ 286.835784][ C1] ? kmem_cache_alloc+0x5e/0x2e0 [ 286.835810][ C1] ? arch_jump_label_transform_queue+0xd0/0xd0 [ 286.835829][ C1] ? __mutex_lock_common+0x42d/0x2530 [ 286.835856][ C1] ? kmem_cache_alloc+0x5e/0x2e0 [ 286.835881][ C1] ? kmem_cache_alloc+0x6d/0x2e0 [ 286.835905][ C1] ? kmem_cache_alloc+0x5e/0x2e0 [ 286.835933][ C1] ? mutex_lock_io_nested+0x60/0x60 [ 286.835957][ C1] arch_jump_label_transform_queue+0x4e/0xd0 [ 286.835978][ C1] __jump_label_update+0x177/0x3a0 [ 286.836030][ C1] static_key_disable_cpuslocked+0xce/0x1b0 [ 286.836056][ C1] static_key_disable+0x1a/0x20 [ 286.836079][ C1] toggle_allocation_gate+0x1b8/0x250 [ 286.836097][ C1] ? virt_to_slab+0x2b0/0x2b0 [ 286.836113][ C1] ? print_irqtrace_events+0x220/0x220 [ 286.836128][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 286.836163][ C1] process_one_work+0x8a0/0x10e0 [ 286.836199][ C1] ? worker_detach_from_pool+0x290/0x290 [ 286.836225][ C1] ? _raw_spin_lock_irqsave+0x120/0x120 [ 286.836251][ C1] ? kthread_data+0x52/0xc0 [ 286.836270][ C1] ? wq_worker_running+0x9b/0x1a0 [ 286.836289][ C1] worker_thread+0xa63/0x1210 [ 286.836312][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 286.836342][ C1] ? _raw_spin_unlock+0x40/0x40 [ 286.836373][ C1] kthread+0x270/0x300 [ 286.836389][ C1] ? pr_cont_work+0x5e0/0x5e0 [ 286.836409][ C1] ? kthread_blkcg+0xd0/0xd0 [ 286.836428][ C1] ret_from_fork+0x1f/0x30 [ 286.836460][ C1] [ 286.836466][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.286 msecs [ 286.838588][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 286.838602][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0 [ 286.838625][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 286.838637][ T28] Call Trace: [ 286.838643][ T28] [ 286.838651][ T28] dump_stack_lvl+0x1e7/0x2d0 [ 286.838693][ T28] ? nf_tcp_handle_invalid+0x650/0x650 [ 286.838727][ T28] ? panic+0x770/0x770 [ 286.838759][ T28] ? vscnprintf+0x5d/0x80 [ 286.838789][ T28] panic+0x31c/0x770 [ 286.838817][ T28] ? nmi_trigger_cpumask_backtrace+0x233/0x300 [ 286.838841][ T28] ? memcpy_page_flushcache+0x100/0x100 [ 286.838867][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 286.838894][ T28] ? nmi_trigger_cpumask_backtrace+0x233/0x300 [ 286.838916][ T28] ? nmi_trigger_cpumask_backtrace+0x2b4/0x300 [ 286.838941][ T28] ? nmi_trigger_cpumask_backtrace+0x2b9/0x300 [ 286.838967][ T28] watchdog+0xf00/0xf00 [ 286.839002][ T28] kthread+0x270/0x300 [ 286.839024][ T28] ? hungtask_pm_notify+0x90/0x90 [ 286.839045][ T28] ? kthread_blkcg+0xd0/0xd0 [ 286.839069][ T28] ret_from_fork+0x1f/0x30 [ 286.839114][ T28] [ 286.841195][ T28] Kernel Offset: disabled [ 287.320663][ T28] Rebooting in 86400 seconds..