INFO: task kworker/1:25:11966 blocked for more than 430 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:25 state:D stack:0 pid:11966 tgid:11966 ppid:2 task_flags:0x4208060 flags:0x00000000 Workqueue: events bpf_prog_free_deferred Call trace: [<81a3da3c>] (__schedule) from [<81a3e9d0>] (__schedule_loop kernel/sched/core.c:7043 [inline]) [<81a3da3c>] (__schedule) from [<81a3e9d0>] (schedule+0x2c/0x130 kernel/sched/core.c:7058) r10:dfaadd84 r9:00000002 r8:60000113 r7:82916594 r6:dfaadd8c r5:833f9800 r4:833f9800 [<81a3e9a4>] (schedule) from [<81a3edb8>] (schedule_preempt_disabled+0x18/0x24 kernel/sched/core.c:7115) r5:833f9800 r4:82916590 [<81a3eda0>] (schedule_preempt_disabled) from [<81a41968>] (__mutex_lock_common kernel/locking/mutex.c:676 [inline]) [<81a3eda0>] (schedule_preempt_disabled) from [<81a41968>] (__mutex_lock.constprop.0+0x350/0xa24 kernel/locking/mutex.c:760) [<81a41618>] (__mutex_lock.constprop.0) from [<81a42110>] (__mutex_lock_slowpath+0x14/0x18 kernel/locking/mutex.c:1049) r10:8280c960 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:dfaade08 r4:00000000 [<81a420fc>] (__mutex_lock_slowpath) from [<81a42150>] (mutex_lock+0x3c/0x40 kernel/locking/mutex.c:274) [<81a42114>] (mutex_lock) from [<804e04f8>] (_vm_unmap_aliases+0x68/0x240 mm/vmalloc.c:2912) [<804e0490>] (_vm_unmap_aliases) from [<804e42d8>] (vm_reset_perms mm/vmalloc.c:3343 [inline]) [<804e0490>] (_vm_unmap_aliases) from [<804e42d8>] (vfree+0x16c/0x210 mm/vmalloc.c:3422) r10:83016070 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:85ec0180 r4:00000000 [<804e416c>] (vfree) from [<8054cf90>] (execmem_free+0x30/0x50 mm/execmem.c:506) r9:83018205 r8:833f9800 r7:00000000 r6:83018200 r5:00001000 r4:7f037000 [<8054cf60>] (execmem_free) from [<803c32f0>] (bpf_jit_free_exec+0x10/0x14 kernel/bpf/core.c:1084) r5:00001000 r4:df83d000 [<803c32e0>] (bpf_jit_free_exec) from [<803c36d0>] (bpf_jit_binary_free kernel/bpf/core.c:1130 [inline]) [<803c32e0>] (bpf_jit_free_exec) from [<803c36d0>] (bpf_jit_free+0x68/0xe4 kernel/bpf/core.c:1253) [<803c3668>] (bpf_jit_free) from [<803c4778>] (bpf_prog_free_deferred+0x140/0x158 kernel/bpf/core.c:2925) r5:84df338c r4:84911100 [<803c4638>] (bpf_prog_free_deferred) from [<8027a398>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3236) r7:ddde2d40 r6:83018200 r5:84df338c r4:84911100 [<8027a1e4>] (process_one_work) from [<8027afe0>] (process_scheduled_works kernel/workqueue.c:3319 [inline]) [<8027a1e4>] (process_one_work) from [<8027afe0>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3400) r10:61c88647 r9:833f9800 r8:8491112c r7:82804d40 r6:ddde2d40 r5:ddde2d60 r4:84911100 [<8027ade4>] (worker_thread) from [<80281fcc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:84911100 r8:8027ade4 r7:dfc69e60 r6:84972380 r5:833f9800 r4:00000001 [<80281ea0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdfaadfb0 to 0xdfaadff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281ea0 r4:8497e1c0 INFO: task kworker/1:25:11966 is blocked on a mutex likely owned by task kworker/0:33:14533. task:kworker/0:33 state:R running task stack:0 pid:14533 tgid:14533 ppid:2 task_flags:0x4208060 flags:0x00000000 Workqueue: events bpf_prog_free_deferred Call trace: [<81a3da3c>] (__schedule) from [<81a3ee04>] (preempt_schedule_irq+0x40/0xa8 kernel/sched/core.c:7288) r10:8280c9b4 r9:8386d400 r8:80200c04 r7:dfc89d54 r6:ffffffff r5:8386d400 r4:00000000 [<81a3edc4>] (preempt_schedule_irq) from [<80200c24>] (svc_preempt+0x8/0x18) Exception stack(0xdfc89d20 to 0xdfc89d68) 9d20: ea9da000 eb173000 00000001 80239bb8 7f02b000 00000001 82ac8f44 82ac8320 9d40: 7f02b000 eb173000 8280c9b4 dfc89d9c dfc89da0 dfc89d70 80230af0 80239bd0 9d60: 80000113 ffffffff r5:80000113 r4:80239bd0 [<80230a8c>] (flush_tlb_kernel_range) from [<804e02bc>] (__purge_vmap_area_lazy+0x284/0x458 mm/vmalloc.c:2336) r4:82ac8f64 [<804e0038>] (__purge_vmap_area_lazy) from [<804e0674>] (_vm_unmap_aliases+0x1e4/0x240 mm/vmalloc.c:2951) r10:00000000 r9:00000000 r8:00000000 r7:ffffffff r6:dfc89dc0 r5:dfc89e08 r4:dfc89dc0 [<804e0490>] (_vm_unmap_aliases) from [<804e42d8>] (vm_reset_perms mm/vmalloc.c:3343 [inline]) [<804e0490>] (_vm_unmap_aliases) from [<804e42d8>] (vfree+0x16c/0x210 mm/vmalloc.c:3422) r10:83016070 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:85ea6d40 r4:00000000 [<804e416c>] (vfree) from [<8054cf90>] (execmem_free+0x30/0x50 mm/execmem.c:506) r9:83018005 r8:8386d400 r7:00000000 r6:83018000 r5:00001000 r4:7f041000 [<8054cf60>] (execmem_free) from [<803c32f0>] (bpf_jit_free_exec+0x10/0x14 kernel/bpf/core.c:1084) r5:00001000 r4:df911000 [<803c32e0>] (bpf_jit_free_exec) from [<803c36d0>] (bpf_jit_binary_free kernel/bpf/core.c:1130 [inline]) [<803c32e0>] (bpf_jit_free_exec) from [<803c36d0>] (bpf_jit_free+0x68/0xe4 kernel/bpf/core.c:1253) [<803c3668>] (bpf_jit_free) from [<803c4778>] (bpf_prog_free_deferred+0x140/0x158 kernel/bpf/core.c:2925) r5:85ef238c r4:85940700 [<803c4638>] (bpf_prog_free_deferred) from [<8027a398>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3236) r7:dddced40 r6:83018000 r5:85ef238c r4:85940700 [<8027a1e4>] (process_one_work) from [<8027afe0>] (process_scheduled_works kernel/workqueue.c:3319 [inline]) [<8027a1e4>] (process_one_work) from [<8027afe0>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3400) r10:61c88647 r9:8386d400 r8:8594072c r7:82804d40 r6:dddced40 r5:dddced60 r4:85940700 [<8027ade4>] (worker_thread) from [<80281fcc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:85940700 r8:8027ade4 r7:dfd49e60 r6:85c1d780 r5:8386d400 r4:00000001 [<80281ea0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdfc89fb0 to 0xdfc89ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281ea0 r4:85cf4580 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:00070113 r5:60070193 r4:82260bc4 [<80201b08>] (show_stack) from [<8021fc00>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201b08>] (show_stack) from [<8021fc00>] (dump_stack_lvl+0x70/0x7c lib/dump_stack.c:120) [<8021fb90>] (dump_stack_lvl) from [<8021fc24>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000001 r4:00000001 [<8021fc0c>] (dump_stack) from [<81a27650>] (nmi_cpu_backtrace+0x160/0x17c lib/nmi_backtrace.c:113) [<81a274f0>] (nmi_cpu_backtrace) from [<81a2779c>] (nmi_trigger_cpumask_backtrace+0x130/0x1d8 lib/nmi_backtrace.c:62) r7:00000001 r6:8280c690 r5:8281ac94 r4:ffffffff [<81a2766c>] (nmi_trigger_cpumask_backtrace) from [<802304fc>] (arch_trigger_cpumask_backtrace+0x18/0x1c arch/arm/kernel/smp.c:852) r9:82abd564 r8:82804d40 r7:0003866a r6:0000738a r5:8281b248 r4:8b13af0c [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d990>] (trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]) [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d990>] (check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]) [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d990>] (watchdog+0x4d4/0x81c kernel/hung_task.c:491) [<8037d4bc>] (watchdog) from [<80281fcc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:00000000 r8:8037d4bc r7:83387680 r6:83387680 r5:8321e000 r4:00000001 [<80281ea0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf8e1fb0 to 0xdf8e1ff8) 1fa0: 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281ea0 r4:833889c0 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 23798 Comm: modprobe Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at kmap_local_sched_in kernel/sched/core.c:5131 [inline] PC is at finish_task_switch+0x8c/0x284 kernel/sched/core.c:5233 LR is at __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] LR is at _raw_spin_unlock+0x2c/0x50 kernel/locking/spinlock.c:186 pc : [<8029159c>] lr : [<81a47918>] psr: 200f0113 sp : ec4ddbf0 ip : ec4ddbe0 fp : ec4ddc34 r10: 00000000 r9 : 88d8c800 r8 : 89553c00 r7 : 89f7c9c0 r6 : 81a3df40 r5 : dddcf080 r4 : 00000000 r3 : 88d8c800 r2 : 00000001 r1 : 82260bc4 r0 : 00000001 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8ae12800 DAC: fffffffd Call trace: [<80291510>] (finish_task_switch) from [<81a3df40>] (context_switch kernel/sched/core.c:5360 [inline]) [<80291510>] (finish_task_switch) from [<81a3df40>] (__schedule+0x504/0xf68 kernel/sched/core.c:6961) r10:88d8c800 r9:00000000 r8:a40b19a0 r7:89f7c9c0 r6:88d8c800 r5:dddcf080 r4:89f2d400 [<81a3da3c>] (__schedule) from [<81a3e9d0>] (__schedule_loop kernel/sched/core.c:7043 [inline]) [<81a3da3c>] (__schedule) from [<81a3e9d0>] (schedule+0x2c/0x130 kernel/sched/core.c:7058) r10:ec4ddcf0 r9:835820c8 r8:00000000 r7:835820d4 r6:00000002 r5:88d8c800 r4:88d8c800 [<81a3e9a4>] (schedule) from [<81a3edb8>] (schedule_preempt_disabled+0x18/0x24 kernel/sched/core.c:7115) r5:88d8c800 r4:82804d40 [<81a3eda0>] (schedule_preempt_disabled) from [<81a4365c>] (rwsem_down_write_slowpath+0x234/0x948 kernel/locking/rwsem.c:1185) [<81a43428>] (rwsem_down_write_slowpath) from [<81a43df4>] (__down_write_common kernel/locking/rwsem.c:1317 [inline]) [<81a43428>] (rwsem_down_write_slowpath) from [<81a43df4>] (__down_write kernel/locking/rwsem.c:1326 [inline]) [<81a43428>] (rwsem_down_write_slowpath) from [<81a43df4>] (down_write+0x84/0x88 kernel/locking/rwsem.c:1591) r10:76ca2000 r9:00000000 r8:ec4ddef0 r7:76ca2000 r6:00000000 r5:88d8c800 r4:835820c8 [<81a43d70>] (down_write) from [<804e5ed0>] (i_mmap_lock_write include/linux/fs.h:548 [inline]) [<81a43d70>] (down_write) from [<804e5ed0>] (vma_prepare+0x48/0x190 mm/vma.c:295) r5:ec4ddd80 r4:8aa17380 [<804e5e88>] (vma_prepare) from [<804e71a4>] (__split_vma+0x224/0x438 mm/vma.c:550) r7:76ca2000 r6:00000000 r5:898fe900 r4:8aa17380 [<804e6f80>] (__split_vma) from [<804e7b70>] (split_vma mm/vma.c:598 [inline]) [<804e6f80>] (__split_vma) from [<804e7b70>] (vma_modify+0x3b4/0x8a8 mm/vma.c:1631) r10:00000001 r9:00000000 r8:ec4ddeec r7:76ca1000 r6:8aa17280 r5:8aa17380 r4:ec4dde20 [<804e77bc>] (vma_modify) from [<804e90f8>] (vma_modify_flags+0xb4/0xd8 mm/vma.c:1649) r10:00000001 r9:89f7c9c0 r8:ec4ddeec r7:ec4ddef0 r6:8aa17280 r5:00000000 r4:8aa17380 [<804e9044>] (vma_modify_flags) from [<804d3900>] (mprotect_fixup+0x7c/0x2d0 mm/mprotect.c:816) r7:00100073 r6:00000000 r5:00100071 r4:8aa17380 [<804d3884>] (mprotect_fixup) from [<804d3d68>] (do_mprotect_pkey.constprop.0+0x214/0x3f0 mm/mprotect.c:990) r10:00000001 r9:88d8c800 r8:00100071 r7:76ca2000 r6:76ca1000 r5:8aa17380 r4:00000000 [<804d3b54>] (do_mprotect_pkey.constprop.0) from [<804d3f54>] (__do_sys_mprotect mm/mprotect.c:1011 [inline]) [<804d3b54>] (do_mprotect_pkey.constprop.0) from [<804d3f54>] (sys_mprotect+0x10/0x14 mm/mprotect.c:1008) r10:0000007d r9:88d8c800 r8:8020029c r7:0000007d r6:76f2ccd8 r5:76f2da28 r4:76f03bd0 [<804d3f44>] (sys_mprotect) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xec4ddfa8 to 0xec4ddff0) dfa0: 76f03bd0 76f2da28 76ca1000 00001000 00000001 fffff000 dfc0: 76f03bd0 76f2da28 76f2ccd8 0000007d 76f2d6d8 00000000 76f03bd0 7ed50cec dfe0: 76c9e3d0 7ed50adc 76f11b08 76f2345c