RDX: 000000000000fdc7 RSI: 0000000000000000 RDI: 000000002057bff0 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 CPU: 1 PID: 20679 Comm: syz-executor1 Not tainted 4.16.0+ #288 INFO: task kworker/0:3:7985 blocked for more than 120 seconds. Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1a7/0x27d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x914/0xae0 lib/fault-inject.c:149 Not tainted 4.16.0+ #288 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:3 D 23720 7985 2 0x80000000 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3366 [inline] __do_kmalloc mm/slab.c:3704 [inline] __kmalloc+0x63/0x760 mm/slab.c:3715 Workqueue: events cgwb_release_workfn kmalloc include/linux/slab.h:517 [inline] SYSC_memfd_create mm/shmem.c:3706 [inline] SyS_memfd_create+0xca/0x4c0 mm/shmem.c:3679 Call Trace: do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392 context_switch kernel/sched/core.c:2848 [inline] __schedule+0x8fb/0x1ef0 kernel/sched/core.c:3490 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7fb1c99 RSP: 002b:00000000f5fad00c EFLAGS: 00000296 ORIG_RAX: 0000000000000164 RAX: ffffffffffffffda RBX: 00000000080d07d3 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 20675 Comm: syz-executor6 Not tainted 4.16.0+ #288 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1a7/0x27d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x914/0xae0 lib/fault-inject.c:149 schedule+0xf5/0x430 kernel/sched/core.c:3549 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3366 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3540 shmem_alloc_inode+0x1b/0x40 mm/shmem.c:3852 alloc_inode+0x65/0x180 fs/inode.c:209 new_inode_pseudo+0x69/0x190 fs/inode.c:890 new_inode+0x1c/0x40 fs/inode.c:919 shmem_get_inode+0xe1/0x930 mm/shmem.c:2166 bit_wait+0x18/0x90 kernel/sched/wait_bit.c:197 __shmem_file_setup+0x494/0x6a0 mm/shmem.c:4227 __wait_on_bit+0x88/0x130 kernel/sched/wait_bit.c:48 out_of_line_wait_on_bit+0x204/0x3a0 kernel/sched/wait_bit.c:63 shmem_file_setup mm/shmem.c:4276 [inline] SYSC_memfd_create mm/shmem.c:3736 [inline] SyS_memfd_create+0x3ba/0x4c0 mm/shmem.c:3679 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392 wait_on_bit include/linux/wait_bit.h:76 [inline] wb_shutdown+0x335/0x430 mm/backing-dev.c:377 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f98c99 RSP: 002b:00000000f5f9400c EFLAGS: 00000296 ORIG_RAX: 0000000000000164 RAX: ffffffffffffffda RBX: 00000000080d07d3 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 sctp: [Deprecated]: syz-executor5 (pid 20681) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead cgwb_release_workfn+0x8b/0x622 mm/backing-dev.c:520 sctp: [Deprecated]: syz-executor4 (pid 20685) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead process_one_work+0xc97/0x1c40 kernel/workqueue.c:2113 sctp: [Deprecated]: syz-executor4 (pid 20685) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead sctp: [Deprecated]: syz-executor5 (pid 20690) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead sctp: [Deprecated]: syz-executor4 (pid 20693) Use of int in max_burst socket option deprecated. Use struct sctp_assoc_value instead FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 worker_thread+0x1c3/0x1380 kernel/workqueue.c:2247 CPU: 1 PID: 20697 Comm: syz-executor6 Not tainted 4.16.0+ #288 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1a7/0x27d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x914/0xae0 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3366 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3540 kmem_cache_zalloc include/linux/slab.h:691 [inline] get_empty_filp+0xfb/0x510 fs/file_table.c:122 alloc_file+0x26/0x390 fs/file_table.c:163 __shmem_file_setup+0x54f/0x6a0 mm/shmem.c:4239 kthread+0x33c/0x400 kernel/kthread.c:238 shmem_file_setup mm/shmem.c:4276 [inline] SYSC_memfd_create mm/shmem.c:3736 [inline] SyS_memfd_create+0x3ba/0x4c0 mm/shmem.c:3679 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:411 Showing all locks held in the system: entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f98c99 RSP: 002b:00000000f5f9400c EFLAGS: 00000296 2 locks held by khungtaskd/876: ORIG_RAX: 0000000000000164 RAX: ffffffffffffffda RBX: 00000000080d07d3 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 #0: 000000001f405c1f (rcu_read_lock){....}, at: check_hung_uninterruptible_tasks kernel/hung_task.c:175 [inline] #0: 000000001f405c1f (rcu_read_lock){....}, at: watchdog+0x1d6/0xd70 kernel/hung_task.c:249 #1: 00000000a55d5ac4 (tasklist_lock){.+.+}, at: debug_show_all_locks+0xd3/0x3d0 kernel/locking/lockdep.c:4470 2 locks held by getty/4449: #0: 00000000abe66848 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 000000007ec7edca (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by getty/4450: #0: 0000000092aa0932 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 00000000de4b5f6b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by getty/4451: #0: 00000000b7dea5fd (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 000000002fd73b32 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by getty/4452: #0: 00000000ac95997d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 00000000ff70d2d5 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by getty/4453: #0: 0000000047cbb324 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 00000000c82d9dea (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by getty/4454: #0: 000000008fe37121 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 00000000df6b3448 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by getty/4455: #0: 000000007253d627 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365 #1: 00000000ef135edb (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131 2 locks held by kworker/0:3/7985: #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: __write_once_size include/linux/compiler.h:215 [inline] #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline] #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:57 [inline] #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: set_work_data kernel/workqueue.c:619 [inline] #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:646 [inline] #0: 0000000051a1763a ((wq_completion)"events"){+.+.}, at: process_one_work+0xb83/0x1c40 kernel/workqueue.c:2084 #1: 000000002370d6aa ((work_completion)(&wb->release_work)){+.+.}, at: process_one_work+0xbd9/0x1c40 kernel/workqueue.c:2088 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 876 Comm: khungtaskd Not tainted 4.16.0+ #288 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1a7/0x27d lib/dump_stack.c:53 nmi_cpu_backtrace+0x1e0/0x220 lib/nmi_backtrace.c:103 nmi_trigger_cpumask_backtrace+0x123/0x180 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:138 [inline] check_hung_task kernel/hung_task.c:132 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:190 [inline] watchdog+0x969/0xd70 kernel/hung_task.c:249 kthread+0x33c/0x400 kernel/kthread.c:238 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:411 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 20679 Comm: syz-executor1 Not tainted 4.16.0+ #288 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__wrmsr arch/x86/include/asm/msr.h:105 [inline] RIP: 0010:native_write_msr+0xa/0x30 arch/x86/include/asm/msr.h:162 RSP: 0018:ffff8801db107d40 EFLAGS: 00000046 RAX: 000000000000ec1a RBX: 0000000000000838 RCX: 0000000000000838 RDX: 0000000000000000 RSI: 000000000000ec1a RDI: 0000000000000838 RBP: ffff8801db107d40 R08: ffff88021fff805c R09: ffff88021fff8048 R10: ffff88021fff805d R11: ffff88021fff8050 R12: 000000000000ec1a R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f5fabdb0 CR3: 00000001976c4000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: paravirt_write_msr arch/x86/include/asm/paravirt.h:117 [inline] native_apic_msr_write+0x5c/0x80 arch/x86/include/asm/apic.h:208 apic_write arch/x86/include/asm/apic.h:396 [inline] lapic_next_event+0x54/0x80 arch/x86/kernel/apic/apic.c:460 clockevents_program_event+0x248/0x2e0 kernel/time/clockevents.c:344 tick_program_event+0x7c/0x100 kernel/time/tick-oneshot.c:48 hrtimer_interrupt+0x2f9/0x6f0 kernel/time/hrtimer.c:1482 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline] smp_apic_timer_interrupt+0x14a/0x700 arch/x86/kernel/apic/apic.c:1050 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:862 RIP: 0010:PageHuge+0x177/0x270 mm/hugetlb.c:1344 RSP: 0018:ffff88018d166788 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff12 RAX: dffffc0000000000 RBX: 1ffff10031a2ccf2 RCX: ffffffff81a3c95c RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea0006a99f80 RBP: ffff88018d166858 R08: ffffed003b6246c3 R09: ffffed003b6246c3 R10: 0000000000000001 R11: ffffed003b6246c2 R12: ffffea0006a99f80 R13: 0000000000000000 R14: ffff88018d166830 R15: 1ffff10031a2ccf6 page_remove_file_rmap mm/rmap.c:1216 [inline] page_remove_rmap+0x3b9/0xf40 mm/rmap.c:1298 zap_pte_range mm/memory.c:1337 [inline] zap_pmd_range mm/memory.c:1441 [inline] zap_pud_range mm/memory.c:1470 [inline] zap_p4d_range mm/memory.c:1491 [inline] unmap_page_range+0xfff/0x2330 mm/memory.c:1512 unmap_single_vma+0x15f/0x2d0 mm/memory.c:1557 unmap_vmas+0xf1/0x1b0 mm/memory.c:1587 exit_mmap+0x23a/0x500 mm/mmap.c:3027 __mmput kernel/fork.c:960 [inline] mmput+0x23d/0x700 kernel/fork.c:981 exit_mm kernel/exit.c:544 [inline] do_exit+0x9c5/0x2700 kernel/exit.c:852 do_group_exit+0x149/0x400 kernel/exit.c:968 get_signal+0x74c/0x16e0 kernel/signal.c:2469 do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:810 exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:265 [inline] do_syscall_32_irqs_on arch/x86/entry/common.c:336 [inline] do_fast_syscall_32+0xbe6/0xf9f arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7fb1c99 RSP: 002b:00000000f5fad00c EFLAGS: 00000296 ORIG_RAX: 0000000000000164 RAX: fffffffffffffff4 RBX: 00000000080d07d3 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Code: 5d c3 0f 21 d0 5d c3 0f 21 d8 5d c3 0f 21 f0 5d c3 0f 0b 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 89 f9 89 f0 48 89 e5 0f 30 <0f> 1f 44 00 00 5d c3 48 89 d6 89 c2 48 c1 e6 20 48 09 d6 31 d2