INFO: task syz-executor.0:14681 blocked for more than 143 seconds. Not tainted 5.11.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:25144 pid:14681 ppid: 8452 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4313 [inline] __schedule+0xa4d/0xf80 kernel/sched/core.c:5064 schedule+0x14b/0x200 kernel/sched/core.c:5143 schedule_timeout+0x98/0x2b0 kernel/time/timer.c:1854 do_wait_for_common+0x2dd/0x450 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x43/0x50 kernel/sched/completion.c:138 kthread_park+0x10d/0x1c0 kernel/kthread.c:557 io_sq_thread_park fs/io_uring.c:7408 [inline] io_uring_cancel_task_requests fs/io_uring.c:8909 [inline] __io_uring_files_cancel+0x423/0x19b0 fs/io_uring.c:9004 io_uring_files_cancel include/linux/io_uring.h:51 [inline] do_exit+0x2e6/0x2490 kernel/exit.c:780 do_group_exit+0x168/0x2d0 kernel/exit.c:922 get_signal+0x16b5/0x2030 kernel/signal.c:2770 arch_do_signal_or_restart+0x8e/0x6a0 arch/x86/kernel/signal.c:811 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0xac/0x1e0 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x48/0x190 kernel/entry/common.c:302 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e219 RSP: 002b:00007f9339e18cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000000 RBX: 000000000119c030 RCX: 000000000045e219 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000119c030 RBP: 000000000119c028 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119c034 R13: 00007ffe8d467d4f R14: 00007f9339e199c0 R15: 000000000119c034 Showing all locks held in the system: 1 lock held by khungtaskd/1599: #0: ffffffff8c311580 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 arch/x86/pci/mmconfig_64.c:151 2 locks held by systemd-journal/4860: 1 lock held by in:imklog/8142: #0: ffff888018765270 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:947 3 locks held by kworker/u4:7/10065: #0: ffff8880b9d34758 (&rq->lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1319 [inline] #0: ffff8880b9d34758 (&rq->lock){-.-.}-{2:2}, at: __schedule+0x144/0xf80 kernel/sched/core.c:4981 #1: ffff8880b9d1ff48 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x224/0x5c0 kernel/sched/psi.c:833 #2: ffffffff8fb0be10 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_check_no_obj_freed lib/debugobjects.c:975 [inline] #2: ffffffff8fb0be10 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_check_no_obj_freed+0xa9/0x650 lib/debugobjects.c:1018 1 lock held by syz-executor.0/14681: #0: ffff88802158a870 (&sqd->lock){+.+.}-{3:3}, at: io_sq_thread_park fs/io_uring.c:7407 [inline] #0: ffff88802158a870 (&sqd->lock){+.+.}-{3:3}, at: io_uring_cancel_task_requests fs/io_uring.c:8909 [inline] #0: ffff88802158a870 (&sqd->lock){+.+.}-{3:3}, at: __io_uring_files_cancel+0x402/0x19b0 fs/io_uring.c:9004 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1599 Comm: khungtaskd Not tainted 5.11.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x183/0x22e lib/dump_stack.c:120 nmi_cpu_backtrace+0x16c/0x190 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x191/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline] watchdog+0xce9/0xd30 kernel/hung_task.c:294 kthread+0x39a/0x3c0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10065 Comm: kworker/u4:7 Not tainted 5.11.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:83 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:101 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:127 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:158 [inline] RIP: 0010:check_memory_region_inline mm/kasan/generic.c:176 [inline] RIP: 0010:check_memory_region+0x95/0x2f0 mm/kasan/generic.c:185 Code: 85 f6 0f 84 ae 01 00 00 4c 89 cb 4c 29 d3 0f 1f 80 00 00 00 00 45 0f b6 19 45 84 db 0f 85 f3 01 00 00 49 ff c1 48 ff c3 75 eb 87 01 00 00 44 89 cb 83 e3 07 0f 84 04 01 00 00 41 be 08 00 00 RSP: 0018:ffffc900168cf690 EFLAGS: 00000056 RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff815f6b24 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8f2a0548 RBP: ffffc900168cfa50 R08: dffffc0000000000 R09: fffffbfff1e540aa R10: fffffbfff1e540aa R11: 0000000000000000 R12: 1ffffffff1e540a9 R13: dffffc0000000001 R14: 0000000000000001 R15: ffff88801c3ba5b8 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f283ad56000 CR3: 0000000012e3b000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] hlock_class kernel/locking/lockdep.c:198 [inline] __lock_acquire+0x10e4/0x5e40 kernel/locking/lockdep.c:4828 lock_acquire+0x174/0x6c0 kernel/locking/lockdep.c:5437 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:259 rcu_read_lock include/linux/rcupdate.h:648 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:404 [inline] batadv_nc_worker+0xc8/0x5c0 net/batman-adv/network-coding.c:715 process_one_work+0x833/0x10c0 kernel/workqueue.c:2275 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2421 kthread+0x39a/0x3c0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296