sg_write: data in/out 2097152/1 bytes for SCSI command 0x4-- guessing data in; program syz-executor.0 not setting count and/or reply_len properly INFO: rcu_preempt self-detected stall on CPU 1-...: (1 GPs behind) idle=1ba/140000000000002/0 softirq=55513/55517 fqs=11 (t=10500 jiffies g=16861 c=16860 q=98) rcu_preempt kthread starved for 10473 jiffies! g16861 c16860 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x0 ->cpu=0 rcu_preempt R running task 29920 8 2 0x80000000 Call Trace: schedule+0x8d/0x1b0 kernel/sched/core.c:3428 schedule_timeout+0x43c/0xe40 kernel/time/timer.c:1746 rcu_gp_kthread+0xb8e/0x1ce0 kernel/rcu/tree.c:2255 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 NMI backtrace for cpu 1 CPU: 1 PID: 24099 Comm: syz-executor.2 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x139/0x17e lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:158 [inline] rcu_dump_cpu_stacks+0x16d/0x1b8 kernel/rcu/tree.c:1396 print_cpu_stall kernel/rcu/tree.c:1542 [inline] check_cpu_stall kernel/rcu/tree.c:1610 [inline] __rcu_pending kernel/rcu/tree.c:3390 [inline] rcu_pending kernel/rcu/tree.c:3452 [inline] rcu_check_callbacks.cold+0x490/0xdaa kernel/rcu/tree.c:2792 update_process_times+0x29/0x60 kernel/time/timer.c:1590 tick_sched_handle+0x7d/0x150 kernel/time/tick-sched.c:165 tick_sched_timer+0x3e/0x120 kernel/time/tick-sched.c:1223 __run_hrtimer kernel/time/hrtimer.c:1223 [inline] __hrtimer_run_queues+0x25c/0xbb0 kernel/time/hrtimer.c:1287 hrtimer_interrupt+0x1e6/0x5e0 kernel/time/hrtimer.c:1321 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1075 [inline] smp_apic_timer_interrupt+0x117/0x5e0 arch/x86/kernel/apic/apic.c:1100 apic_timer_interrupt+0x8f/0xa0 arch/x86/entry/entry_64.S:792 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x91/0xe0 kernel/locking/spinlock.c:192 RSP: 0018:ffff8880aeb07ca8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff0fa2cd9 RBX: 0000000000000286 RCX: 1ffff1101488b144 RDX: dffffc0000000000 RSI: ffff8880a4458a00 RDI: 0000000000000286 RBP: ffff8880aeb239c0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff888096b68608 R14: 0000000000000000 R15: ffff8880aeb239c0 __mod_timer kernel/time/timer.c:1026 [inline] mod_timer+0x541/0xe70 kernel/time/timer.c:1069 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1279 expire_timers kernel/time/timer.c:1318 [inline] __run_timers kernel/time/timer.c:1636 [inline] __run_timers kernel/time/timer.c:1604 [inline] run_timer_softirq+0x52a/0x1390 kernel/time/timer.c:1649 __do_softirq+0x254/0x9bf kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x15b/0x1a0 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:648 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1102 apic_timer_interrupt+0x8f/0xa0 arch/x86/entry/entry_64.S:792 RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x50 kernel/kcov.c:89 RSP: 0018:ffff88803e7d7dc8 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff10 RAX: 0000000000040000 RBX: ffff88803e7d7eb0 RCX: ffffc9000a841000 RDX: 000000000000214d RSI: ffffffff82fdd965 RDI: ffffffff86e450c0 RBP: ffffffff86e450c0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffffffff86e45080 R14: 000000005e571a2c R15: 0000000000014d22 check_preemption_disabled+0x35/0x240 lib/smp_processor_id.c:52 kvm_clock_read+0xc/0x30 arch/x86/kernel/kvmclock.c:86 tk_clock_read kernel/time/timekeeping.c:144 [inline] timekeeping_get_delta kernel/time/timekeeping.c:238 [inline] timekeeping_get_ns kernel/time/timekeeping.c:344 [inline] ktime_get_ts64+0x17e/0x3a0 kernel/time/timekeeping.c:875 posix_ktime_get_ts+0x11/0x20 kernel/time/posix-timers.c:222 SYSC_clock_gettime kernel/time/posix-timers.c:1073 [inline] SyS_clock_gettime+0xe3/0x180 kernel/time/posix-timers.c:1063 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45f28a RSP: 002b:00007f8bb5530c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e4 RAX: ffffffffffffffda RBX: 000000000076bf28 RCX: 000000000045f28a RDX: 00000000000f4240 RSI: 00007f8bb5530c60 RDI: 0000000000000001 RBP: 000000000076bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000076bf2c R13: 0000000000000b7b R14: 00000000004cd6d1 R15: 000000000076bf2c INFO: rcu_sched detected stalls on CPUs/tasks: 1-...: (1 GPs behind) idle=1ba/140000000000000/0 softirq=55514/55517 fqs=11 (detected by 0, t=10544 jiffies, g=13144, c=13143, q=2) Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 7476 Comm: syz-executor.5 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88808e66a0c0 task.stack: ffff88809d918000 RIP: 0010:rcu_is_watching+0x0/0xb0 kernel/rcu/tree.c:1126 RSP: 0018:ffff88809d91f778 EFLAGS: 00000202 RAX: 0000000000000001 RBX: ffffea00026ee680 RCX: 1ffffffff1027934 RDX: 0000000000000000 RSI: ffffffff86e45080 RDI: ffff88808e66a93c RBP: ffffea00026ee680 R08: 0000000000000000 R09: 0000000000020012 R10: ffff88808e66a968 R11: ffff88808e66a0c0 R12: dead000000000100 R13: dead000000000100 R14: ffffea00026ee6a0 R15: 0000000000000020 FS: 0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0391c04000 CR3: 000000007c8f9000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_lock_held+0x7c/0xc0 kernel/rcu/update.c:328 page_memcg_rcu include/linux/mm.h:1063 [inline] workingset_activation+0x5c/0x2c0 mm/workingset.c:320 mark_page_accessed+0x4a0/0x600 mm/swap.c:394 zap_pte_range mm/memory.c:1339 [inline] zap_pmd_range mm/memory.c:1444 [inline] zap_pud_range mm/memory.c:1473 [inline] zap_p4d_range mm/memory.c:1494 [inline] unmap_page_range+0x977/0x1930 mm/memory.c:1515 unmap_single_vma+0x147/0x2b0 mm/memory.c:1560 unmap_vmas+0x9d/0x160 mm/memory.c:1590 exit_mmap+0x26d/0x4b0 mm/mmap.c:3056 __mmput kernel/fork.c:930 [inline] mmput+0x103/0x420 kernel/fork.c:951 exit_mm kernel/exit.c:545 [inline] do_exit+0x933/0x2b00 kernel/exit.c:845 do_group_exit+0x100/0x310 kernel/exit.c:955 get_signal+0x385/0x1ca0 kernel/signal.c:2418 do_signal+0x7c/0x1690 arch/x86/kernel/signal.c:814 exit_to_usermode_loop+0x159/0x220 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x41628a RSP: 002b:00007ffdc788c5b8 EFLAGS: 00000246 ORIG_RAX: 000000000000003d RAX: fffffffffffffe00 RBX: 0000000000001d39 RCX: 000000000041628a RDX: 0000000040000000 RSI: 00007ffdc788c5c4 RDI: ffffffffffffffff RBP: 00000000000000f8 R08: 0000000000001d34 R09: 0000000002534940 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000417f50 R13: 00007ffdc788c848 R14: 0000000000000000 R15: 0000000000000000 Code: 02 74 06 48 83 c4 08 5b c3 0f 0b 48 83 c4 08 5b c3 48 89 04 24 e8 71 31 38 00 48 8b 04 24 eb cd 90 66 2e 0f 1f 84 00 00 00 00 00 <53> 48 83 ec 08 65 ff 05 64 84 b6 7e e8 ff 71 b2 01 48 c7 c3 40