INFO: task khugepaged:33 blocked for more than 143 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:khugepaged state:D stack:23720 pid: 33 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x176/0x280 kernel/sched/completion.c:138 __flush_work+0x56e/0xb10 kernel/workqueue.c:3083 __lru_add_drain_all+0x3fd/0x760 mm/swap.c:833 khugepaged_do_scan mm/khugepaged.c:2214 [inline] khugepaged+0x10f/0x55a0 mm/khugepaged.c:2275 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:17:17180 blocked for more than 143 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:17 state:D stack:24976 pid:17180 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x176/0x280 kernel/sched/completion.c:138 __synchronize_srcu+0x1f4/0x290 kernel/rcu/srcutree.c:930 fsnotify_mark_destroy_workfn+0xfd/0x340 fs/notify/mark.c:861 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:25:17209 blocked for more than 144 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:25 state:D stack:25816 pid:17209 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x176/0x280 kernel/sched/completion.c:138 __synchronize_srcu+0x1f4/0x290 kernel/rcu/srcutree.c:930 fsnotify_connector_destroy_workfn+0x49/0xa0 fs/notify/mark.c:164 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor.5:18806 blocked for more than 144 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.5 state:D stack:23720 pid:18806 ppid: 14938 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729 account_event kernel/events/core.c:11386 [inline] perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:11971 [inline] __do_sys_perf_event_open+0x4ae/0x3130 kernel/events/core.c:12069 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f87325448d9 RSP: 002b:00007f872fabb188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f8732648f60 RCX: 00007f87325448d9 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007f873259ecb4 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffde0ccbbbf R14: 00007f872fabb300 R15: 0000000000022000 INFO: task syz-executor.5:18822 blocked for more than 144 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.5 state:D stack:25432 pid:18822 ppid: 14938 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729 account_event kernel/events/core.c:11386 [inline] perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:11971 [inline] __do_sys_perf_event_open+0x4ae/0x3130 kernel/events/core.c:12069 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f87325448d9 RSP: 002b:00007f872fa9a188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f8732649020 RCX: 00007f87325448d9 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007f873259ecb4 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffde0ccbbbf R14: 00007f872fa9a300 R15: 0000000000022000 INFO: task syz-executor.0:18805 blocked for more than 145 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:27832 pid:18805 ppid: 6558 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729 exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] synchronize_rcu_expedited+0x2d5/0x620 kernel/rcu/tree_exp.h:837 synchronize_net+0x3c/0x60 net/core/dev.c:10955 netif_napi_del include/linux/netdevice.h:2520 [inline] tun_napi_del drivers/net/tun.c:280 [inline] __tun_detach+0x1b3/0x13d0 drivers/net/tun.c:633 tun_detach drivers/net/tun.c:687 [inline] tun_chr_close+0xc4/0x180 drivers/net/tun.c:3397 __fput+0x288/0x9f0 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:175 [inline] exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7feb5582f8d9 RSP: 002b:00007feb52da6188 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 00007feb55933f60 RCX: 00007feb5582f8d9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007feb55889cb4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe167b6fef R14: 00007feb52da6300 R15: 0000000000022000 INFO: task syz-executor.0:18813 blocked for more than 145 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:29616 pid:18813 ppid: 6558 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729 account_event kernel/events/core.c:11386 [inline] perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:11971 [inline] __do_sys_perf_event_open+0x4ae/0x3130 kernel/events/core.c:12069 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7feb5582f8d9 RSP: 002b:00007feb52d85188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007feb55934020 RCX: 00007feb5582f8d9 RDX: ffffffdfffffffff RSI: 0000000000000000 RDI: 0000000020000100 RBP: 00007feb55889cb4 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe167b6fef R14: 00007feb52d85300 R15: 0000000000022000 INFO: task syz-executor.0:18817 blocked for more than 146 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:29344 pid:18817 ppid: 6558 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729 __tun_chr_ioctl.isra.0+0x5a8/0x4230 drivers/net/tun.c:3011 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7feb5582f8d9 RSP: 002b:00007feb52d64188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007feb559340e0 RCX: 00007feb5582f8d9 RDX: 00000000200000c0 RSI: 00000000400454ca RDI: 0000000000000004 RBP: 00007feb55889cb4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe167b6fef R14: 00007feb52d64300 R15: 0000000000022000 INFO: task syz-executor.0:18828 blocked for more than 146 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:28512 pid:18828 ppid: 6558 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xa34/0x12f0 kernel/locking/mutex.c:729 account_event kernel/events/core.c:11386 [inline] perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:11971 [inline] __do_sys_perf_event_open+0x4ae/0x3130 kernel/events/core.c:12069 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7feb5582f8d9 RSP: 002b:00007feb52d43188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007feb559341a0 RCX: 00007feb5582f8d9 RDX: ffffffdfffffffff RSI: 0000000000000000 RDI: 0000000020000100 RBP: 00007feb55889cb4 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe167b6fef R14: 00007feb52d43300 R15: 0000000000022000 INFO: task syz-executor.4:18800 blocked for more than 147 seconds. Not tainted 5.15.0-rc3-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:26808 pid:18800 ppid: 6685 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline] synchronize_rcu_expedited+0x5ac/0x620 kernel/rcu/tree_exp.h:837 synchronize_net+0x3c/0x60 net/core/dev.c:10955 packet_release+0xa2a/0xcc0 net/packet/af_packet.c:3100 __sock_release+0xcd/0x280 net/socket.c:649 sock_close+0x18/0x20 net/socket.c:1314 __fput+0x288/0x9f0 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:175 [inline] exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f182860651b RSP: 002b:00007ffe603ad330 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f182860651b RDX: 0000001b2e12264c RSI: ffffffff8937bd78 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2e121f88 R10: 0000000000001e0f R11: 0000000000000293 R12: 00007f1828758b60 R13: 00007f1828758b60 R14: 00007f1828757f60 R15: 0000000000067c0a Showing all locks held in the system: 1 lock held by khungtaskd/26: #0: ffffffff8b9801e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446 1 lock held by khugepaged/33: #0: ffffffff8ba63f68 (lock#5){+.+.}-{3:3}, at: __lru_add_drain_all+0x65/0x760 mm/swap.c:782 1 lock held by in:imklog/6232: #0: ffff888073b22870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 4 locks held by kworker/0:4/8207: 3 locks held by kworker/1:7/8543: 2 locks held by kworker/u4:17/17180: #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268 #1: ffffc90004b2fdb0 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272 2 locks held by kworker/u4:25/17209: #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8a3/0x16b0 kernel/workqueue.c:2268 #1: ffffc90004fafdb0 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x8d7/0x16b0 kernel/workqueue.c:2272 1 lock held by syz-executor.5/18806: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 1 lock held by syz-executor.5/18822: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 2 locks held by syz-executor.0/18805: #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:684 [inline] #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3a/0x180 drivers/net/tun.c:3397 #1: ffffffff8b989568 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #1: ffffffff8b989568 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d5/0x620 kernel/rcu/tree_exp.h:837 1 lock held by syz-executor.0/18813: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 1 lock held by syz-executor.0/18817: #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl.isra.0+0x5a8/0x4230 drivers/net/tun.c:3011 1 lock held by syz-executor.0/18828: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 1 lock held by syz-executor.4/18800: #0: ffff888034513e10 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #0: ffff888034513e10 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at: __sock_release+0x86/0x280 net/socket.c:648 1 lock held by syz-executor.4/18808: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 4 locks held by syz-executor.2/18803: #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: ioctl_setflags fs/ioctl.c:729 [inline] #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: do_vfs_ioctl+0xe36/0x15d0 fs/ioctl.c:843 #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: vfs_fileattr_set+0x148/0xbe0 fs/ioctl.c:685 #2: ffff88807f9a2bd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ind_migrate+0x237/0x840 fs/ext4/migrate.c:623 #3: ffffffff8b989568 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #3: ffffffff8b989568 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4fc/0x620 kernel/rcu/tree_exp.h:837 1 lock held by syz-executor.2/18812: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 2 locks held by syz-executor.2/18816: #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3421 [inline] #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x1b65/0x2740 fs/namei.c:3561 #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: process_measurement+0x71a/0x1920 security/integrity/ima/ima_main.c:241 2 locks held by syz-executor.2/18819: #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3421 [inline] #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x1b65/0x2740 fs/namei.c:3561 #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: process_measurement+0x71a/0x1920 security/integrity/ima/ima_main.c:241 1 lock held by syz-executor.2/18823: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 2 locks held by syz-executor.2/18825: #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3421 [inline] #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x1b65/0x2740 fs/namei.c:3561 #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: process_measurement+0x71a/0x1920 security/integrity/ima/ima_main.c:241 2 locks held by syz-executor.2/18827: #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3421 [inline] #0: ffff88807f9a0460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x1b65/0x2740 fs/namei.c:3561 #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806b8935c8 (&sb->s_type->i_mutex_key#10){++++}-{3:3}, at: process_measurement+0x71a/0x1920 security/integrity/ima/ima_main.c:241 1 lock held by syz-executor.3/18811: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 1 lock held by syz-executor.3/18838: #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: account_event kernel/events/core.c:11386 [inline] #0: ffffffff8ba4c608 (perf_sched_mutex){+.+.}-{3:3}, at: perf_event_alloc.part.0+0x31ed/0x3b10 kernel/events/core.c:11619 1 lock held by syz-executor.1/18840: #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:684 [inline] #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3a/0x180 drivers/net/tun.c:3397 1 lock held by syz-executor.1/18841: #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl.isra.0+0x5a8/0x4230 drivers/net/tun.c:3011 1 lock held by syz-executor.1/18843: #0: ffffffff8d0e5868 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl.isra.0+0x19e/0x4230 drivers/net/tun.c:3011 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 26 Comm: khungtaskd Not tainted 5.15.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc1d/0xf50 kernel/hung_task.c:295 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 8207 Comm: kworker/0:4 Not tainted 5.15.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events prog_array_map_clear_deferred RIP: 0010:__kasan_check_read+0x0/0x10 mm/kasan/shadow.c:31 Code: 8b e8 f8 d4 36 07 48 85 db 0f 85 c2 2d 38 07 48 83 c4 60 5b 5d 41 5c 41 5d c3 c3 e9 c2 2e 38 07 cc cc cc cc cc cc cc cc cc cc <48> 8b 0c 24 89 f6 31 d2 e9 03 f9 ff ff 0f 1f 00 48 8b 0c 24 89 f6 RSP: 0018:ffffc90016a1f8a8 EFLAGS: 00000002 RAX: 0000000000000023 RBX: 00000000000008dc RCX: ffffffff815b1512 RDX: 1ffff110055b8bfd RSI: 0000000000000008 RDI: ffffffff8fd0ca38 RBP: ffff88802adc5fea R08: 0000000000000000 R09: ffffffff8fd0ca3f R10: fffffbfff1fa1947 R11: 0000000000000000 R12: ffff88802adc5fc8 R13: ffff88802adc5580 R14: 0000000000000000 R15: 619568bb938e1e91 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f45ed0d9000 CR3: 000000000b68e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] hlock_class kernel/locking/lockdep.c:199 [inline] __lock_acquire+0xbc2/0x54a0 kernel/locking/lockdep.c:5012 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 __mutex_lock_common kernel/locking/mutex.c:596 [inline] __mutex_lock+0x131/0x12f0 kernel/locking/mutex.c:729 fd_array_map_delete_elem+0x120/0x2e0 kernel/bpf/arraymap.c:821 bpf_fd_array_map_clear kernel/bpf/arraymap.c:871 [inline] prog_array_map_clear_deferred+0x10b/0x1b0 kernel/bpf/arraymap.c:1050 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: e8 f8 d4 36 07 callq 0x736d4fd 5: 48 85 db test %rbx,%rbx 8: 0f 85 c2 2d 38 07 jne 0x7382dd0 e: 48 83 c4 60 add $0x60,%rsp 12: 5b pop %rbx 13: 5d pop %rbp 14: 41 5c pop %r12 16: 41 5d pop %r13 18: c3 retq 19: c3 retq 1a: e9 c2 2e 38 07 jmpq 0x7382ee1 1f: cc int3 20: cc int3 21: cc int3 22: cc int3 23: cc int3 24: cc int3 25: cc int3 26: cc int3 27: cc int3 28: cc int3 * 29: 48 8b 0c 24 mov (%rsp),%rcx <-- trapping instruction 2d: 89 f6 mov %esi,%esi 2f: 31 d2 xor %edx,%edx 31: e9 03 f9 ff ff jmpq 0xfffff939 36: 0f 1f 00 nopl (%rax) 39: 48 8b 0c 24 mov (%rsp),%rcx 3d: 89 f6 mov %esi,%esi