INFO: task syz-executor.0:12403 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:29224 pid:12403 ppid: 12380 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
rwsem_down_write_slowpath+0x761/0x1130 kernel/locking/rwsem.c:1117
__down_write_common kernel/locking/rwsem.c:1272 [inline]
__down_write_common kernel/locking/rwsem.c:1269 [inline]
__down_write kernel/locking/rwsem.c:1281 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1528
inode_lock include/linux/fs.h:783 [inline]
vfs_setxattr+0x11c/0x330 fs/xattr.c:300
setxattr+0x218/0x2b0 fs/xattr.c:575
path_setxattr+0x197/0x1c0 fs/xattr.c:595
__do_sys_setxattr fs/xattr.c:611 [inline]
__se_sys_setxattr fs/xattr.c:607 [inline]
__x64_sys_setxattr+0xc0/0x160 fs/xattr.c:607
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f6748bf8ae9
RSP: 002b:00007f674612c188 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f6748d0c0e0 RCX: 00007f6748bf8ae9
RDX: 0000000020000340 RSI: 0000000020000180 RDI: 0000000020000080
RBP: 00007f6748c52f25 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000006000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdb25da16f R14: 00007f674612c300 R15: 0000000000022000
INFO: task syz-executor.3:12455 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:28112 pid:12455 ppid: 10967 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
rwsem_down_write_slowpath+0x761/0x1130 kernel/locking/rwsem.c:1117
__down_write_common kernel/locking/rwsem.c:1272 [inline]
__down_write_common kernel/locking/rwsem.c:1269 [inline]
__down_write kernel/locking/rwsem.c:1281 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1528
inode_lock include/linux/fs.h:783 [inline]
lock_mount+0x8a/0x2e0 fs/namespace.c:2242
do_new_mount_fc fs/namespace.c:2931 [inline]
do_new_mount fs/namespace.c:2990 [inline]
path_mount+0x14c6/0x1fa0 fs/namespace.c:3318
do_mount fs/namespace.c:3331 [inline]
__do_sys_mount fs/namespace.c:3539 [inline]
__se_sys_mount fs/namespace.c:3516 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3516
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3f6780fae9
RSP: 002b:00007f3f64d43188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f3f679230e0 RCX: 00007f3f6780fae9
RDX: 0000000020000140 RSI: 0000000020000200 RDI: 0000000000000000
RBP: 00007f3f67869f25 R08: 0000000020000580 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc332ce33f R14: 00007f3f64d43300 R15: 0000000000022000
INFO: task syz-executor.3:12456 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:29328 pid:12456 ppid: 10967 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
rwsem_down_write_slowpath+0x761/0x1130 kernel/locking/rwsem.c:1117
__down_write_common kernel/locking/rwsem.c:1272 [inline]
__down_write_common kernel/locking/rwsem.c:1269 [inline]
__down_write kernel/locking/rwsem.c:1281 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1528
inode_lock include/linux/fs.h:783 [inline]
vfs_setxattr+0x11c/0x330 fs/xattr.c:300
setxattr+0x218/0x2b0 fs/xattr.c:575
path_setxattr+0x197/0x1c0 fs/xattr.c:595
__do_sys_setxattr fs/xattr.c:611 [inline]
__se_sys_setxattr fs/xattr.c:607 [inline]
__x64_sys_setxattr+0xc0/0x160 fs/xattr.c:607
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f3f6780fae9
RSP: 002b:00007f3f64d22188 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f3f679231a0 RCX: 00007f3f6780fae9
RDX: 0000000020000340 RSI: 0000000020000180 RDI: 0000000020000080
RBP: 00007f3f67869f25 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000006000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc332ce33f R14: 00007f3f64d22300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8b983a20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6461
2 locks held by kworker/0:3/6168:
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
#1: ffffc9000c467db0 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
2 locks held by kworker/1:17/25929:
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
#1: ffffc9000571fdb0 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
2 locks held by syz-executor.0/12364:
#0: ffff88803a7fe460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593
#1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline]
#1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300
2 locks held by syz-executor.0/12403:
#0: ffff88803a7fe460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593
#1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline]
#1: ffff88806c3ee1c0 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300
2 locks held by syz-executor.3/12450:
#0: ffff88807f3d4460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593
#1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline]
#1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300
1 lock held by syz-executor.3/12455:
#0: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline]
#0: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: lock_mount+0x8a/0x2e0 fs/namespace.c:2242
2 locks held by syz-executor.3/12456:
#0: ffff88807f3d4460 (sb_writers#20){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:593
#1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:783 [inline]
#1: ffff88806c3ef4c8 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: vfs_setxattr+0x11c/0x330 fs/xattr.c:300
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 9871 Comm: kworker/u4:13 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:inat_get_opcode_attribute+0x1/0x50 arch/x86/lib/inat.c:14
Code: 10 31 c0 0f 01 ca c3 66 90 0f 01 cb 0f ae e8 48 8b 10 31 c0 0f 01 ca c3 90 0f 01 ca 31 d2 48 c7 c0 f2 ff ff ff c3 cc cc cc 53 <89> fb e8 98 c3 7f fd 0f b6 db 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc90004e8f8f0 EFLAGS: 00000246
RAX: ffffffff81be121e RBX: 0000000000000001 RCX: 0000000000000006
RDX: 1ffffffff037c243 RSI: ffffffff83f85eed RDI: 00000000000000e9
RBP: dffffc0000000000 R08: 0000000000000001 R09: 000000000000000f
R10: ffffffff83f85e6b R11: 00000000000000e9 R12: 0000000000000000
R13: 00000000000000e9 R14: dffffc0000000000 R15: 00000000000000e9
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f81e14ed080 CR3: 000000000b68e000 CR4: 0000000000350ee0
Call Trace:
insn_get_prefixes.part.0+0x293/0x1200 arch/x86/lib/insn.c:139
insn_get_prefixes arch/x86/lib/insn.c:131 [inline]
insn_get_opcode arch/x86/lib/insn.c:272 [inline]
insn_get_modrm+0x646/0x7c0 arch/x86/lib/insn.c:343
insn_get_sib+0x29c/0x330 arch/x86/lib/insn.c:421
insn_get_displacement+0x346/0x6c0 arch/x86/lib/insn.c:464
insn_get_immediate arch/x86/lib/insn.c:632 [inline]
insn_get_length arch/x86/lib/insn.c:707 [inline]
insn_decode+0x473/0x4e0 arch/x86/lib/insn.c:747
arch_jump_entry_size+0xa0/0x110 arch/x86/kernel/jump_label.c:24
__jump_label_patch+0x7c/0x1b0 arch/x86/kernel/jump_label.c:45
arch_jump_label_transform_queue+0x63/0x100 arch/x86/kernel/jump_label.c:137
__jump_label_update+0x12e/0x400 kernel/jump_label.c:451
jump_label_update+0x1d5/0x430 kernel/jump_label.c:830
static_key_disable_cpuslocked+0x152/0x1b0 kernel/jump_label.c:207
static_key_disable+0x16/0x20 kernel/jump_label.c:215
toggle_allocation_gate mm/kfence/core.c:746 [inline]
toggle_allocation_gate+0x183/0x390 mm/kfence/core.c:724
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 10 31 adc %dh,(%rcx)
2: c0 0f 01 rorb $0x1,(%rdi)
5: ca c3 66 lret $0x66c3
8: 90 nop
9: 0f 01 cb stac
c: 0f ae e8 lfence
f: 48 8b 10 mov (%rax),%rdx
12: 31 c0 xor %eax,%eax
14: 0f 01 ca clac
17: c3 retq
18: 90 nop
19: 0f 01 ca clac
1c: 31 d2 xor %edx,%edx
1e: 48 c7 c0 f2 ff ff ff mov $0xfffffffffffffff2,%rax
25: c3 retq
26: cc int3
27: cc int3
28: cc int3
29: 53 push %rbx
* 2a: 89 fb mov %edi,%ebx <-- trapping instruction
2c: e8 98 c3 7f fd callq 0xfd7fc3c9
31: 0f b6 db movzbl %bl,%ebx
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8d .byte 0x8d