INFO: task syz-executor.0:12403 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:29224 pid:12403 ppid: 12380 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6250 schedule+0xd2/0x260 kernel/sched/core.c:6323 rwsem_down_write_slowpath+0x761/0x1130 kernel/locking/rwsem.c:1117 __down_write_common kernel/locking/rwsem.c:1272 [inline] __down_write_common kernel/locking/rwsem.c:1269 [inline] __down_write kernel/locking/rwsem.c:1281 [inline] down_write+0x135/0x150 kernel/locking/rwsem.c:1528 inode_lock include/linux/fs.h:783 [inline] vfs_setxattr+0x11c/0x330 fs/xattr.c:300 setxattr+0x218/0x2b0 fs/xattr.c:575 path_setxattr+0x197/0x1c0 fs/xattr.c:595 __do_sys_setxattr fs/xattr.c:611 [inline] __se_sys_setxattr fs/xattr.c:607 [inline] __x64_sys_setxattr+0xc0/0x160 fs/xattr.c:607 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f6748bf8ae9 RSP: 002b:00007f674612c188 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc RAX: ffffffffffffffda RBX: 00007f6748d0c0e0 RCX: 00007f6748bf8ae9 RDX: 0000000020000340 RSI: 0000000020000180 RDI: 0000000020000080 RBP: 00007f6748c52f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000006000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdb25da16f R14: 00007f674612c300 R15: 0000000000022000 INFO: task syz-executor.3:12455 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:28112 pid:12455 ppid: 10967 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6250 schedule+0xd2/0x260 kernel/sched/core.c:6323 rwsem_down_write_slowpath+0x761/0x1130 kernel/locking/rwsem.c:1117 __down_write_common kernel/locking/rwsem.c:1272 [inline] __down_write_common kernel/locking/rwsem.c:1269 [inline] __down_write kernel/locking/rwsem.c:1281 [inline] down_write+0x135/0x150 kernel/locking/rwsem.c:1528 inode_lock include/linux/fs.h:783 [inline] lock_mount+0x8a/0x2e0 fs/namespace.c:2242 do_new_mount_fc fs/namespace.c:2931 [inline] do_new_mount fs/namespace.c:2990 [inline] path_mount+0x14c6/0x1fa0 fs/namespace.c:3318 do_mount fs/namespace.c:3331 [inline] __do_sys_mount fs/namespace.c:3539 [inline] __se_sys_mount fs/namespace.c:3516 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3516 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3f6780fae9 RSP: 002b:00007f3f64d43188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f3f679230e0 RCX: 00007f3f6780fae9 RDX: 0000000020000140 RSI: 0000000020000200 RDI: 0000000000000000 RBP: 00007f3f67869f25 R08: 0000000020000580 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc332ce33f R14: 00007f3f64d43300 R15: 0000000000022000 INFO: task syz-executor.3:12456 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:29328 pid:12456 ppid: 10967 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6250 schedule+0xd2/0x260 kernel/sched/core.c:6323 rwsem_down_write_slowpath+0x761/0x1130 kernel/locking/rwsem.c:1117 __down_write_common kernel/locking/rwsem.c:1272 [inline] __down_write_common kernel/locking/rwsem.c:1269 [inline] __down_write kernel/locking/rwsem.c:1281 [inline] down_write+0x135/0x150 kernel/locking/rwsem.c:1528 inode_lock include/linux/fs.h:783 [inline] vfs_setxattr+0x11c/0x330 fs/xattr.c:300 setxattr+0x218/0x2b0 fs/xattr.c:575 path_setxattr+0x197/0x1c0 fs/xattr.c:595 __do_sys_setxattr fs/xattr.c:611 [inline] __se_sys_setxattr fs/xattr.c:607 [inline] __x64_sys_setxattr+0xc0/0x160 fs/xattr.c:607 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3f6780fae9 RSP: 002b:00007f3f64d22188 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc RAX: ffffffffffffffda RBX: 00007f3f679231a0 RCX: 00007f3f6780fae9 RDX: 0000000020000340 RSI: 0000000020000180 RDI: 0000000020000080 RBP: 00007f3f67869f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000006000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc332ce33f R14: 00007f3f64d22300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8b983a20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6461 2 locks held by kworker/0:3/6168: #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269 #1: ffffc9000c467db0 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273 2 locks held by kworker/1:17/25929: #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269 #1: ffffc9000571fdb0 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273 2 locks held by syz-executor.0/12364: #0: ffff88803a7fe460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593 #1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline] #1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300 2 locks held by syz-executor.0/12403: #0: ffff88803a7fe460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593 #1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline] #1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300 2 locks held by syz-executor.3/12450: #0: ffff88807f3d4460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593 #1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline] #1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300 1 lock held by syz-executor.3/12455: #0: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline] #0: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: lock_mount+0x8a/0x2e0 fs/namespace.c:2242 2 locks held by syz-executor.3/12456: #0: ffff88807f3d4460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593 #1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline] #1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc1d/0xf50 kernel/hung_task.c:295 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9871 Comm: kworker/u4:13 Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:inat_get_opcode_attribute+0x1/0x50 arch/x86/lib/inat.c:14 Code: 10 31 c0 0f 01 ca c3 66 90 0f 01 cb 0f ae e8 48 8b 10 31 c0 0f 01 ca c3 90 0f 01 ca 31 d2 48 c7 c0 f2 ff ff ff c3 cc cc cc 53 <89> fb e8 98 c3 7f fd 0f b6 db 48 b8 00 00 00 00 00 fc ff df 48 8d RSP: 0018:ffffc90004e8f8f0 EFLAGS: 00000246 RAX: ffffffff81be121e RBX: 0000000000000001 RCX: 0000000000000006 RDX: 1ffffffff037c243 RSI: ffffffff83f85eed RDI: 00000000000000e9 RBP: dffffc0000000000 R08: 0000000000000001 R09: 000000000000000f R10: ffffffff83f85e6b R11: 00000000000000e9 R12: 0000000000000000 R13: 00000000000000e9 R14: dffffc0000000000 R15: 00000000000000e9 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f81e14ed080 CR3: 000000000b68e000 CR4: 0000000000350ee0 Call Trace: insn_get_prefixes.part.0+0x293/0x1200 arch/x86/lib/insn.c:139 insn_get_prefixes arch/x86/lib/insn.c:131 [inline] insn_get_opcode arch/x86/lib/insn.c:272 [inline] insn_get_modrm+0x646/0x7c0 arch/x86/lib/insn.c:343 insn_get_sib+0x29c/0x330 arch/x86/lib/insn.c:421 insn_get_displacement+0x346/0x6c0 arch/x86/lib/insn.c:464 insn_get_immediate arch/x86/lib/insn.c:632 [inline] insn_get_length arch/x86/lib/insn.c:707 [inline] insn_decode+0x473/0x4e0 arch/x86/lib/insn.c:747 arch_jump_entry_size+0xa0/0x110 arch/x86/kernel/jump_label.c:24 __jump_label_patch+0x7c/0x1b0 arch/x86/kernel/jump_label.c:45 arch_jump_label_transform_queue+0x63/0x100 arch/x86/kernel/jump_label.c:137 __jump_label_update+0x12e/0x400 kernel/jump_label.c:451 jump_label_update+0x1d5/0x430 kernel/jump_label.c:830 static_key_disable_cpuslocked+0x152/0x1b0 kernel/jump_label.c:207 static_key_disable+0x16/0x20 kernel/jump_label.c:215 toggle_allocation_gate mm/kfence/core.c:746 [inline] toggle_allocation_gate+0x183/0x390 mm/kfence/core.c:724 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 10 31 adc %dh,(%rcx) 2: c0 0f 01 rorb $0x1,(%rdi) 5: ca c3 66 lret $0x66c3 8: 90 nop 9: 0f 01 cb stac c: 0f ae e8 lfence f: 48 8b 10 mov (%rax),%rdx 12: 31 c0 xor %eax,%eax 14: 0f 01 ca clac 17: c3 retq 18: 90 nop 19: 0f 01 ca clac 1c: 31 d2 xor %edx,%edx 1e: 48 c7 c0 f2 ff ff ff mov $0xfffffffffffffff2,%rax 25: c3 retq 26: cc int3 27: cc int3 28: cc int3 29: 53 push %rbx * 2a: 89 fb mov %edi,%ebx <-- trapping instruction 2c: e8 98 c3 7f fd callq 0xfd7fc3c9 31: 0f b6 db movzbl %bl,%ebx 34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 3b: fc ff df 3e: 48 rex.W 3f: 8d .byte 0x8d