audit: type=1800 audit(1651314600.583:2): pid=11080 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.0" name="bus" dev="sda1" ino=14184 res=0 watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [syz-executor.5:11053] Modules linked in: irq event stamp: 42848 hardirqs last enabled at (42847): [] restore_regs_and_return_to_kernel+0x0/0x2a hardirqs last disabled at (42848): [] apic_timer_interrupt+0x8e/0xa0 arch/x86/entry/entry_64.S:793 softirqs last enabled at (37750): [] __do_softirq+0x68b/0x9ff kernel/softirq.c:314 softirqs last disabled at (34245): [] invoke_softirq kernel/softirq.c:368 [inline] softirqs last disabled at (34245): [] irq_exit+0x193/0x240 kernel/softirq.c:409 CPU: 1 PID: 11053 Comm: syz-executor.5 Not tainted 4.14.277-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888065bf8000 task.stack: ffff888064868000 RIP: 0010:memcpy_erms+0x8/0x10 arch/x86/lib/memcpy_64.S:55 RSP: 0018:ffff88806486f288 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: ffff8880b34c9148 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000008 RSI: ffff88806486f368 RDI: ffff8880b34c9150 RBP: ffff88806486f360 R08: 0000000000000001 R09: ffffed1016699229 R10: ffff8880b34c914f R11: 0000001d36ec6fef R12: dffffc0000000000 R13: ffffed100c90deaa R14: ffff88806486f528 R15: 0000000000000008 FS: 00007fe3fd6de700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020fba000 CR3: 00000000aff30000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: memcpy include/linux/string.h:376 [inline] memcpy_common kernel/events/internal.h:172 [inline] __output_copy kernel/events/internal.h:176 [inline] perf_output_read_group kernel/events/core.c:5899 [inline] perf_output_read+0x6c9/0x1090 kernel/events/core.c:5932 perf_output_sample+0xa28/0x16f0 kernel/events/core.c:5974 __perf_event_output kernel/events/core.c:6287 [inline] perf_event_output_forward+0xf8/0x1f0 kernel/events/core.c:6300 __perf_event_overflow+0x113/0x310 kernel/events/core.c:7549 perf_swevent_overflow kernel/events/core.c:7625 [inline] perf_swevent_event+0x299/0x460 kernel/events/core.c:7653 do_perf_sw_event kernel/events/core.c:7766 [inline] ___perf_sw_event+0x2a1/0x480 kernel/events/core.c:7797 __perf_sw_event+0x4f/0x100 kernel/events/core.c:7809 perf_sw_event include/linux/perf_event.h:1046 [inline] __do_page_fault+0x692/0xad0 arch/x86/mm/fault.c:1483 page_fault+0x25/0x50 arch/x86/entry/entry_64.S:1123 RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 arch/x86/lib/copy_user_64.S:181 RSP: 0018:ffff88806486fa60 EFLAGS: 00050206 RAX: ffffed100c863000 RBX: 0000000000008000 RCX: 0000000000003acb RDX: 0000000000008000 RSI: 0000000020fba000 RDI: ffff888064314535 RBP: 0000000020fb5acb R08: 0000000000000001 R09: ffffed100c862fff R10: ffff888064317fff R11: 0000000000000000 R12: ffff888064310000 R13: 00007ffffffff000 R14: 0000000020fbdacb R15: ffff8880a9f48d00 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_from_user arch/x86/include/asm/uaccess_64.h:55 [inline] copyin+0x99/0xc0 lib/iov_iter.c:146 _copy_from_iter_full+0x19c/0x760 lib/iov_iter.c:610 copy_from_iter_full include/linux/uio.h:126 [inline] skb_do_copy_data_nocache include/net/sock.h:1892 [inline] skb_copy_to_page_nocache include/net/sock.h:1918 [inline] tcp_sendmsg_locked+0x23fc/0x2ef0 net/ipv4/tcp.c:1360 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1457 inet_sendmsg+0x11a/0x4e0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fe3fed690e9 RSP: 002b:00007fe3fd6de168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fe3fee7bf60 RCX: 00007fe3fed690e9 RDX: ffffffffffffffef RSI: 0000000020d7cfcb RDI: 000000000000000e RBP: 00007fe3fedc308d R08: 0000000000000000 R09: 0000000000000053 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9a8a66cf R14: 00007fe3fd6de300 R15: 0000000000022000 Code: 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe 7c Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff8724738e ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: eb 1e jmp 0x23 5: 0f 1f 00 nopl (%rax) 8: 48 89 f8 mov %rdi,%rax b: 48 89 d1 mov %rdx,%rcx e: 48 c1 e9 03 shr $0x3,%rcx 12: 83 e2 07 and $0x7,%edx 15: f3 48 a5 rep movsq %ds:(%rsi),%es:(%rdi) 18: 89 d1 mov %edx,%ecx 1a: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) 1c: c3 retq 1d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 23: 48 89 f8 mov %rdi,%rax 26: 48 89 d1 mov %rdx,%rcx 29: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) * 2b: c3 retq <-- trapping instruction 2c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 33: 48 89 f8 mov %rdi,%rax 36: 48 83 fa 20 cmp $0x20,%rdx 3a: 72 7e jb 0xba 3c: 40 38 fe cmp %dil,%sil 3f: 7c .byte 0x7c