INFO: task syz-executor.3:608 blocked for more than 143 seconds.
Not tainted 5.16.0-rc8-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:27424 pid: 608 ppid: 3757 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xa9a/0x4900 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x174/0x270 kernel/sched/completion.c:138
__synchronize_srcu+0x1f2/0x290 kernel/rcu/srcutree.c:930
install_new_memslots+0x312/0x570 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1471
kvm_set_memslot+0xd76/0x1e50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1624
__kvm_set_memory_region+0xca8/0x1300 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1779
kvm_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1800 [inline]
kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1812 [inline]
kvm_vm_ioctl+0x512/0x23d0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f5cff0dac57
RSP: 002b:00007f5cfda4e5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 00007f5cff0dac57
RDX: 00007f5cfda4ed10 RSI: 000000004020ae46 RDI: 0000000000000014
RBP: 0000000000000014 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000014 R11: 0000000000000246 R12: 00000000fec00000
R13: 00007f5cfda4ed10 R14: 0000000000000016 R15: 0000000020015000
Showing all locks held in the system:
1 lock held by khungtaskd/26:
#0: ffffffff8bb83da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
2 locks held by getty/3283:
#0: ffff888024003098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
#1: ffffc90002b962e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2113
2 locks held by kworker/1:3/3655:
1 lock held by syz-executor.3/608:
#0: ffffc900046290a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1799 [inline]
#0: ffffc900046290a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1812 [inline]
#0: ffffc900046290a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl+0x507/0x23d0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4311
3 locks held by syz-executor.3/619:
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 26 Comm: khungtaskd Not tainted 5.16.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 619 Comm: syz-executor.3 Not tainted 5.16.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:paging64_update_accessed_dirty_bits arch/x86/kvm/mmu/paging_tmpl.h:250 [inline]
RIP: 0010:paging64_walk_addr_generic+0x115d/0x1a40 arch/x86/kvm/mmu/paging_tmpl.h:488
Code: 89 43 30 48 8b 44 24 08 0f b6 00 84 c0 74 08 3c 03 0f 8e 6d 08 00 00 45 8b 37 e8 ce 44 5c 00 44 89 f6 44 89 ef e8 c3 47 5c 00 <45> 39 f5 0f 82 77 fc ff ff e8 b5 44 5c 00 41 8d 6d ff 83 fd 04 44
RSP: 0018:ffffc900045cf2f0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc900045cf3e0 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffff88807db81d00 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000003 R09: 0000000000000000
R10: ffffffff811b537d R11: 0000000000000000 R12: 0000000000003027
R13: 0000000000000003 R14: 0000000000000002 R15: ffffc900045cf3c8
FS: 00007f5cfda2f700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c016ddeaf8 CR3: 0000000084aa4000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
paging64_walk_addr arch/x86/kvm/mmu/paging_tmpl.h:546 [inline]
paging64_gva_to_gpa+0xbb/0x1e0 arch/x86/kvm/mmu/paging_tmpl.h:1010
kvm_mmu_gva_to_gpa_write arch/x86/kvm/x86.c:6540 [inline]
emulator_cmpxchg_emulated+0x1f7/0x700 arch/x86/kvm/x86.c:7008
__load_segment_descriptor+0xb7c/0x1060 arch/x86/kvm/emulate.c:1663
x86_emulate_insn+0x5e4/0x39c0 arch/x86/kvm/emulate.c:5545
x86_emulate_instruction+0x714/0x1460 arch/x86/kvm/x86.c:8167
kvm_mmu_page_fault+0x3e9/0x1950 arch/x86/kvm/mmu/mmu.c:5353
handle_ept_violation+0x29c/0x6e0 arch/x86/kvm/vmx/vmx.c:5303
__vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6028 [inline]
vmx_handle_exit+0x577/0x1910 arch/x86/kvm/vmx/vmx.c:6045
vcpu_enter_guest+0x2992/0x4370 arch/x86/kvm/x86.c:9981
vcpu_run arch/x86/kvm/x86.c:10048 [inline]
kvm_arch_vcpu_ioctl_run+0x4fa/0x20e0 arch/x86/kvm/x86.c:10243
kvm_vcpu_ioctl+0x570/0xf30 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3727
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f5cff0dae99
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5cfda2f168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5cff1ee030 RCX: 00007f5cff0dae99
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000015
RBP: 00007f5cff134ff1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5cff721b1f R14: 00007f5cfda2f300 R15: 0000000000022000
----------------
Code disassembly (best guess):
0: 89 43 30 mov %eax,0x30(%rbx)
3: 48 8b 44 24 08 mov 0x8(%rsp),%rax
8: 0f b6 00 movzbl (%rax),%eax
b: 84 c0 test %al,%al
d: 74 08 je 0x17
f: 3c 03 cmp $0x3,%al
11: 0f 8e 6d 08 00 00 jle 0x884
17: 45 8b 37 mov (%r15),%r14d
1a: e8 ce 44 5c 00 callq 0x5c44ed
1f: 44 89 f6 mov %r14d,%esi
22: 44 89 ef mov %r13d,%edi
25: e8 c3 47 5c 00 callq 0x5c47ed
* 2a: 45 39 f5 cmp %r14d,%r13d <-- trapping instruction
2d: 0f 82 77 fc ff ff jb 0xfffffcaa
33: e8 b5 44 5c 00 callq 0x5c44ed
38: 41 8d 6d ff lea -0x1(%r13),%ebp
3c: 83 fd 04 cmp $0x4,%ebp
3f: 44 rex.R