INFO: task syz-executor.3:1352 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:27360 pid: 1352 ppid: 32267 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
blk_mq_freeze_queue_wait+0x112/0x160 block/blk-mq.c:178
loop_set_status+0x17d/0x930 drivers/block/loop.c:1264
loop_set_status_old+0x148/0x1b0 drivers/block/loop.c:1396
lo_ioctl+0x3e9/0x17c0 drivers/block/loop.c:1566
blkdev_ioctl+0x37a/0x800 block/ioctl.c:609
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f853a18cae9
RSP: 002b:00007f8537702188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f853a29ff60 RCX: 00007f853a18cae9
RDX: 0000000020000780 RSI: 0000000000004c02 RDI: 0000000000000007
RBP: 00007f853a1e6f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe86cb55bf R14: 00007f8537702300 R15: 0000000000022000
INFO: task syz-executor.3:1360 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:26160 pid: 1360 ppid: 32267 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
__bio_queue_enter+0x3c5/0x6a0 block/blk-core.c:441
bio_queue_enter block/blk.h:91 [inline]
blk_mq_get_request block/blk-mq.c:2588 [inline]
blk_mq_submit_bio+0x4ae/0x22c0 block/blk-mq.c:2632
__submit_bio block/blk-core.c:849 [inline]
__submit_bio_noacct_mq block/blk-core.c:924 [inline]
submit_bio_noacct block/blk-core.c:950 [inline]
submit_bio_noacct+0x82c/0xa20 block/blk-core.c:939
submit_bio block/blk-core.c:1011 [inline]
submit_bio+0x1ea/0x430 block/blk-core.c:969
submit_bio_wait+0x106/0x230 block/bio.c:1254
blkdev_issue_flush+0xd6/0x130 block/blk-flush.c:458
blkdev_fsync+0x68/0xa0 block/fops.c:474
vfs_fsync_range+0x13a/0x220 fs/sync.c:182
generic_write_sync include/linux/fs.h:2956 [inline]
blkdev_write_iter+0x552/0x690 block/fops.c:559
call_write_iter include/linux/fs.h:2162 [inline]
do_iter_readv_writev+0x472/0x750 fs/read_write.c:725
do_iter_write+0x188/0x710 fs/read_write.c:851
vfs_iter_write+0x70/0xa0 fs/read_write.c:892
iter_file_splice_write+0x723/0xc70 fs/splice.c:689
do_splice_from fs/splice.c:767 [inline]
direct_splice_actor+0x110/0x180 fs/splice.c:936
splice_direct_to_actor+0x34b/0x8c0 fs/splice.c:891
do_splice_direct+0x1b3/0x280 fs/splice.c:979
do_sendfile+0xaf2/0x1250 fs/read_write.c:1245
__do_sys_sendfile64 fs/read_write.c:1310 [inline]
__se_sys_sendfile64 fs/read_write.c:1296 [inline]
__x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1296
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f853a18cae9
RSP: 002b:00007f85376e1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f853a2a0020 RCX: 00007f853a18cae9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000007
RBP: 00007f853a1e6f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000024002da8 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe86cb55bf R14: 00007f85376e1300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8bb83b60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
2 locks held by systemd-udevd/2972:
#0: ffff88801a46d918 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xb50 block/bdev.c:819
#1: ffff88801a469360 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_open+0x75/0x120 drivers/block/loop.c:1733
1 lock held by in:imklog/6215:
2 locks held by rs:main Q:Reg/6216:
#0: ffff888071cf5c70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
#1: ffff8880b9d279c8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x173/0x490 kernel/sched/psi.c:871
1 lock held by syz-executor.3/1352:
#0: ffff88801a469360 (&lo->lo_mutex){+.+.}-{3:3}, at: loop_set_status+0x2a/0x930 drivers/block/loop.c:1248
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6216 Comm: rs:main Q:Reg Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:iowrite16+0x59/0xa0 lib/iomap.c:196
Code: a9 99 fd e8 b9 a9 99 fd 48 89 ee bf 00 00 01 00 e8 3c ac 99 fd 48 81 fd 00 00 01 00 76 13 e8 9e a9 99 fd 0f b7 d5 89 d8 66 ef <5b> 5d e9 90 a9 99 fd e8 8b a9 99 fd 8b 1d f5 0e 68 08 31 ff 89 de
RSP: 0018:ffffc9000bff6d68 EFLAGS: 00000293
RAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000000
RDX: 000000000000c010 RSI: ffffffff83de3d52 RDI: 0000000000000003
RBP: 000000000001c010 R08: 0000000000010000 R09: 0000000000000000
R10: ffffffff83de3d44 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000293 R14: ffff8881472cd1f0 R15: 0000000000000033
FS: 00007f36536ee700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f36480450a0 CR3: 0000000018561000 CR4: 0000000000350ee0
Call Trace:
vp_notify+0x56/0x80 drivers/virtio/virtio_pci_common.c:74
virtqueue_notify+0x7f/0x110 drivers/virtio/virtio_ring.c:1995
virtscsi_add_cmd+0x10e/0x140 drivers/scsi/virtio_scsi.c:500
virtscsi_queuecommand+0x6b3/0xfd0 drivers/scsi/virtio_scsi.c:590
scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1519 [inline]
scsi_queue_rq+0x170a/0x32e0 drivers/scsi/scsi_lib.c:1708
blk_mq_dispatch_rq_list+0x6fd/0x2340 block/blk-mq.c:1662
__blk_mq_do_dispatch_sched+0x3bc/0xa70 block/blk-mq-sched.c:199
blk_mq_do_dispatch_sched block/blk-mq-sched.c:212 [inline]
__blk_mq_sched_dispatch_requests+0x2a0/0x410 block/blk-mq-sched.c:332
blk_mq_sched_dispatch_requests+0xfb/0x180 block/blk-mq-sched.c:358
__blk_mq_run_hw_queue+0xd8/0x150 block/blk-mq.c:1784
__blk_mq_delay_run_hw_queue+0x547/0x640 block/blk-mq.c:1861
blk_mq_run_hw_queue+0x16c/0x2f0 block/blk-mq.c:1914
blk_mq_sched_insert_requests+0x1d5/0x680 block/blk-mq-sched.c:511
blk_mq_flush_plug_list+0x43e/0xbe0 block/blk-mq.c:2291
blk_flush_plug block/blk-core.c:1590 [inline]
blk_finish_plug block/blk-core.c:1614 [inline]
blk_finish_plug+0xb7/0x160 block/blk-core.c:1611
ext4_writepages+0x2841/0x3b90 fs/ext4/inode.c:2846
do_writepages+0x1ab/0x690 mm/page-writeback.c:2364
filemap_fdatawrite_wbc mm/filemap.c:407 [inline]
filemap_fdatawrite_wbc+0x143/0x1b0 mm/filemap.c:397
__filemap_fdatawrite_range mm/filemap.c:440 [inline]
file_write_and_wait_range+0x163/0x1e0 mm/filemap.c:824
ext4_sync_file+0x21f/0xfd0 fs/ext4/fsync.c:151
vfs_fsync_range+0x13a/0x220 fs/sync.c:182
generic_write_sync include/linux/fs.h:2956 [inline]
ext4_buffered_write_iter+0x2d2/0x3b0 fs/ext4/file.c:277
ext4_file_write_iter+0x423/0x14e0 fs/ext4/file.c:681
call_write_iter include/linux/fs.h:2162 [inline]
new_sync_write+0x429/0x660 fs/read_write.c:503
vfs_write+0x7cd/0xae0 fs/read_write.c:590
ksys_write+0x12d/0x250 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f36561321cd
Code: c2 20 00 00 75 10 b8 01 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae fc ff ff 48 89 04 24 b8 01 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 f7 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007f36536ed590 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3648022980 RCX: 00007f36561321cd
RDX: 0000000000000547 RSI: 00007f3648022980 RDI: 0000000000000006
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f365528b967
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f3648022700
R13: 00007f36536ed5b0 R14: 000056538cb64360 R15: 0000000000000547
----------------
Code disassembly (best guess):
0: a9 99 fd e8 b9 test $0xb9e8fd99,%eax
5: a9 99 fd 48 89 test $0x8948fd99,%eax
a: ee out %al,(%dx)
b: bf 00 00 01 00 mov $0x10000,%edi
10: e8 3c ac 99 fd callq 0xfd99ac51
15: 48 81 fd 00 00 01 00 cmp $0x10000,%rbp
1c: 76 13 jbe 0x31
1e: e8 9e a9 99 fd callq 0xfd99a9c1
23: 0f b7 d5 movzwl %bp,%edx
26: 89 d8 mov %ebx,%eax
28: 66 ef out %ax,(%dx)
* 2a: 5b pop %rbx <-- trapping instruction
2b: 5d pop %rbp
2c: e9 90 a9 99 fd jmpq 0xfd99a9c1
31: e8 8b a9 99 fd callq 0xfd99a9c1
36: 8b 1d f5 0e 68 08 mov 0x8680ef5(%rip),%ebx # 0x8680f31
3c: 31 ff xor %edi,%edi
3e: 89 de mov %ebx,%esi