INFO: task syz.2.12880:6936 blocked for more than 430 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.12880 state:D stack:0 pid:6936 tgid:6933 ppid:6203 task_flags:0x400548 flags:0x00000000 Call trace: [<81a3cbdc>] (__schedule) from [<81a3db70>] (__schedule_loop kernel/sched/core.c:7043 [inline]) [<81a3cbdc>] (__schedule) from [<81a3db70>] (schedule+0x2c/0x130 kernel/sched/core.c:7058) r10:dfb59d4c r9:00000002 r8:60000013 r7:857fe844 r6:dfb59d54 r5:832ebc00 r4:832ebc00 [<81a3db44>] (schedule) from [<81a3df58>] (schedule_preempt_disabled+0x18/0x24 kernel/sched/core.c:7115) r5:832ebc00 r4:857fe840 [<81a3df40>] (schedule_preempt_disabled) from [<81a40b08>] (__mutex_lock_common kernel/locking/mutex.c:676 [inline]) [<81a3df40>] (schedule_preempt_disabled) from [<81a40b08>] (__mutex_lock.constprop.0+0x350/0xa24 kernel/locking/mutex.c:760) [<81a407b8>] (__mutex_lock.constprop.0) from [<81a412b0>] (__mutex_lock_slowpath+0x14/0x18 kernel/locking/mutex.c:1049) r10:85c8db68 r9:82a05555 r8:00000000 r7:85cdb600 r6:832ebc00 r5:85c8db00 r4:846aef00 [<81a4129c>] (__mutex_lock_slowpath) from [<81a412f0>] (mutex_lock+0x3c/0x40 kernel/locking/mutex.c:274) [<81a412b4>] (mutex_lock) from [<8020b328>] (io_uring_del_tctx_node+0xb4/0x108 io_uring/tctx.c:179) [<8020b274>] (io_uring_del_tctx_node) from [<8020b3d8>] (io_uring_clean_tctx+0x5c/0xb0 io_uring/tctx.c:195) r7:85cdb600 r6:85c8db50 r5:85c8db00 r4:846aef00 [<8020b37c>] (io_uring_clean_tctx) from [<8020ae78>] (io_uring_cancel_generic+0x2e4/0x334 io_uring/io_uring.c:3273) r7:9d45e100 r6:85c8db00 r5:832ebc00 r4:00000000 [<8020ab94>] (io_uring_cancel_generic) from [<8088f2f8>] (__io_uring_cancel+0x20/0x24 io_uring/io_uring.c:3288) r10:85448fc0 r9:85448fc0 r8:dfb59e90 r7:9d45e100 r6:00000000 r5:832ebc00 r4:00000000 [<8088f2d8>] (__io_uring_cancel) from [<8025b618>] (io_uring_files_cancel include/linux/io_uring.h:19 [inline]) [<8088f2d8>] (__io_uring_cancel) from [<8025b618>] (do_exit+0xbc/0xaac kernel/exit.c:907) r5:832ebc00 r4:00000000 [<8025b55c>] (do_exit) from [<8025c1cc>] (do_group_exit+0x40/0x8c kernel/exit.c:1102) r7:00132280 [<8025c18c>] (do_group_exit) from [<8026ccd0>] (get_signal+0xa14/0xa38 kernel/signal.c:3034) r7:00132280 r4:832ebc00 [<8026c2bc>] (get_signal) from [<8022ba20>] (do_signal arch/arm/kernel/signal.c:578 [inline]) [<8026c2bc>] (get_signal) from [<8022ba20>] (do_work_pending+0x248/0x4f8 arch/arm/kernel/signal.c:618) r10:000000f0 r9:fffffe00 r8:0013227c r7:00132280 r6:00000001 r5:dfb59fb0 r4:832ebc00 [<8022b7d8>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) Exception stack(0xdfb59fb0 to 0xdfb59ff8) 9fa0: 002f6378 00000080 00000000 00000000 9fc0: 00000000 ffffffff 00000000 000000f0 002e0000 00000000 00006364 76ee40bc 9fe0: 76ee3f58 76ee3f48 0001dac0 0013227c 60000010 002f6378 r10:000000f0 r9:832ebc00 r8:8020029c r7:000000f0 r6:00000000 r5:ffffffff r4:00000000 INFO: task syz.2.12880:6936 is blocked on a mutex likely owned by task syz.2.12880:6934. task:syz.2.12880 state:R running task stack:0 pid:6934 tgid:6933 ppid:6203 task_flags:0x400140 flags:0x00000005 Call trace: [<81a3cbdc>] (__schedule) from [<81a3dd08>] (preempt_schedule_common kernel/sched/core.c:7145 [inline]) [<81a3cbdc>] (__schedule) from [<81a3dd08>] (preempt_schedule+0x4c/0xb4 kernel/sched/core.c:7169) r10:82adbcdc r9:8078c930 r8:82adbcd8 r7:8078d1c0 r6:00000001 r5:85fba400 r4:81a46bcc [<81a3dcbc>] (preempt_schedule) from [<81a46bcc>] (__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]) [<81a3dcbc>] (preempt_schedule) from [<81a46bcc>] (_raw_spin_unlock_irqrestore+0x50/0x54 kernel/locking/spinlock.c:194) r7:000002cd r6:82adb004 r5:00000000 r4:82adbcd4 [<81a46b7c>] (_raw_spin_unlock_irqrestore) from [<8078d1c0>] (spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]) [<81a46b7c>] (_raw_spin_unlock_irqrestore) from [<8078d1c0>] (avc_reclaim_node security/selinux/avc.c:488 [inline]) [<81a46b7c>] (_raw_spin_unlock_irqrestore) from [<8078d1c0>] (avc_alloc_node+0x19c/0x1cc security/selinux/avc.c:507) [<8078d024>] (avc_alloc_node) from [<8078d4ac>] (avc_update_node security/selinux/avc.c:841 [inline]) [<8078d024>] (avc_alloc_node) from [<8078d4ac>] (avc_denied+0x74/0x248 security/selinux/avc.c:1007) r10:0000005f r9:00000001 r8:00000004 r7:00000004 r6:00000001 r5:0000005f r4:00000010 [<8078d438>] (avc_denied) from [<8078d73c>] (avc_perm_nonode+0xbc/0xc4 security/selinux/avc.c:1120) r10:85fba400 r9:dfa29d04 r8:dfa29cb8 r7:00000004 r6:00000001 r5:0000005f r4:00000010 [<8078d680>] (avc_perm_nonode) from [<8078e5c4>] (avc_has_perm_noaudit+0x120/0x158 security/selinux/avc.c:1160) r8:00000004 r7:00000001 r6:00000010 r5:dfa29cb8 r4:0000005f [<8078e4a4>] (avc_has_perm_noaudit) from [<8078e654>] (avc_has_perm+0x58/0xe8 security/selinux/avc.c:1195) r9:dfa29d04 r8:00000004 r7:00000001 r6:0000005f r5:00000001 r4:00000010 [<8078e5fc>] (avc_has_perm) from [<80793104>] (selinux_kernel_module_request+0x6c/0x90 security/selinux/hooks.c:4239) r9:858749c0 r8:828f5404 r7:85fba400 r6:81542b0c r5:00000001 r4:dfa29d58 [<80793098>] (selinux_kernel_module_request) from [<80781b70>] (security_kernel_module_request+0x188/0x194 security/security.c:3366) [<807819e8>] (security_kernel_module_request) from [<8031d49c>] (__request_module+0x88/0x2c0 kernel/module/kmod.c:154) r5:85fba400 r4:858749c0 [<8031d414>] (__request_module) from [<81542b0c>] (__sock_create+0x144/0x228 net/socket.c:1570) r3:00000000 r2:00000006 r1:82428990 r8:85334a00 r7:00000000 r6:8280ed78 r5:00000000 r4:00000006 [<815429c8>] (__sock_create) from [<815452c8>] (sock_create net/socket.c:1647 [inline]) [<815429c8>] (__sock_create) from [<815452c8>] (__sys_socket_create net/socket.c:1684 [inline]) [<815429c8>] (__sock_create) from [<815452c8>] (__sys_socket_file+0x84/0xa8 net/socket.c:1696) r10:85fba400 r9:80000011 r8:00000000 r7:00000000 r6:80000011 r5:85daa348 r4:00000000 [<81545244>] (__sys_socket_file) from [<808ac1fc>] (io_socket+0x40/0xfc io_uring/net.c:1746) r5:00000003 r4:858a6300 [<808ac1bc>] (io_socket) from [<80889624>] (__io_issue_sqe+0x4c/0x1c0 io_uring/io_uring.c:1773) r6:00000000 r5:81cf19c0 r4:858a6300 [<808895d8>] (__io_issue_sqe) from [<8088de7c>] (io_issue_sqe+0x48/0x59c io_uring/io_uring.c:1796) r9:00000000 r8:00000000 r7:81cf17a4 r6:0000002d r5:80000011 r4:858a6300 [<8088de34>] (io_issue_sqe) from [<8088e9a0>] (io_queue_sqe io_uring/io_uring.c:2025 [inline]) [<8088de34>] (io_issue_sqe) from [<8088e9a0>] (io_submit_sqe io_uring/io_uring.c:2285 [inline]) [<8088de34>] (io_issue_sqe) from [<8088e9a0>] (io_submit_sqes+0x214/0x92c io_uring/io_uring.c:2398) r10:85fba400 r9:00000000 r8:00000000 r7:84400000 r6:858a6300 r5:858a636c r4:857fe800 [<8088e78c>] (io_submit_sqes) from [<8088f434>] (__do_sys_io_uring_enter io_uring/io_uring.c:3465 [inline]) [<8088e78c>] (io_submit_sqes) from [<8088f434>] (sys_io_uring_enter+0x138/0x780 io_uring/io_uring.c:3399) r10:00000000 r9:85fba400 r8:00000000 r7:9d7b5540 r6:000047bc r5:857fe800 r4:00000000 [<8088f2fc>] (sys_io_uring_enter) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfa29fa8 to 0xdfa29ff0) 9fa0: 00000000 00000000 00000005 000047bc 0000fac7 00000000 9fc0: 00000000 00000000 002f6314 000001aa 002e0000 00000000 00006364 76f050bc 9fe0: 76f04ec0 76f04eb0 0001946c 00132280 r10:000001aa r9:85fba400 r8:8020029c r7:000001aa r6:002f6314 r5:00000000 r4:00000000 NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:00070113 r5:60070193 r4:8226064c [<80201b08>] (show_stack) from [<8021fb90>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201b08>] (show_stack) from [<8021fb90>] (dump_stack_lvl+0x70/0x7c lib/dump_stack.c:120) [<8021fb20>] (dump_stack_lvl) from [<8021fbb4>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000000 r4:00000001 [<8021fb9c>] (dump_stack) from [<81a267f0>] (nmi_cpu_backtrace+0x160/0x17c lib/nmi_backtrace.c:113) [<81a26690>] (nmi_cpu_backtrace) from [<81a2693c>] (nmi_trigger_cpumask_backtrace+0x130/0x1d8 lib/nmi_backtrace.c:62) r7:00000000 r6:8280c690 r5:8281ac94 r4:ffffffff [<81a2680c>] (nmi_trigger_cpumask_backtrace) from [<802304fc>] (arch_trigger_cpumask_backtrace+0x18/0x1c arch/arm/kernel/smp.c:852) r9:82abd564 r8:82804d40 r7:00084630 r6:00007ea1 r5:8281b248 r4:857dc50c [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d8dc>] (trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]) [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d8dc>] (check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]) [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d8dc>] (watchdog+0x4d4/0x81c kernel/hung_task.c:491) [<8037d408>] (watchdog) from [<80281fcc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:00000000 r8:8037d408 r7:8334c800 r6:8334c800 r5:83391800 r4:00000001 [<80281ea0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf8e1fb0 to 0xdf8e1ff8) 1fa0: 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281ea0 r4:8334acc0 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 11295 Comm: modprobe Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at avtab_node_cmp security/selinux/ss/avtab.c:110 [inline] PC is at avtab_search_node+0xd8/0x134 security/selinux/ss/avtab.c:189 LR is at 0x2fd pc : [<807a2568>] lr : [<000002fd>] psr: 20030013 sp : ec779a5c ip : 00000707 fp : ec779a7c r10: 84141f68 r9 : ec779c68 r8 : 1b873593 r7 : 183d117a r6 : e6546b64 r5 : 85ebca6b r4 : 00000004 r3 : 00000153 r2 : 000003ee r1 : ec779af4 r0 : 854e7760 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 8434acc0 DAC: 00000000 Call trace: [<807a2490>] (avtab_search_node) from [<807b06a0>] (cond_compute_av+0x48/0x114 security/selinux/ss/conditional.c:578) r8:ec779bc8 r7:ec779c68 r6:85523b80 r5:ec779bc8 r4:ec779af4 [<807b0658>] (cond_compute_av) from [<807ab524>] (context_struct_compute_av+0x26c/0x4b4 security/selinux/ss/services.c:679) r10:84141f68 r9:85523b84 r8:ec779bc8 r7:ec779c68 r6:85523b80 r5:000002fd r4:00000000 [<807ab2b8>] (context_struct_compute_av) from [<807ac278>] (security_compute_av+0x170/0x2e8 security/selinux/ss/services.c:1177) r10:841848c0 r9:832f1000 r8:840eeb6c r7:00000000 r6:00000005 r5:840eea00 r4:ec779c68 [<807ac108>] (security_compute_av) from [<8078d284>] (avc_compute_av+0x40/0x1f4 security/selinux/avc.c:992) r10:ec779c68 r9:ec779bc8 r8:00000005 r7:0000003f r6:82adacd4 r5:0000003f r4:00200000 [<8078d244>] (avc_compute_av) from [<8078d6e0>] (avc_perm_nonode+0x60/0xc4 security/selinux/avc.c:1117) r10:ec779f18 r9:84985d40 r8:ec779c68 r7:00000005 r6:0000003f r5:0000003f r4:00200000 [<8078d680>] (avc_perm_nonode) from [<8078e5c4>] (avc_has_perm_noaudit+0x120/0x158 security/selinux/avc.c:1160) r8:00000005 r7:0000003f r6:00200000 r5:ec779c68 r4:0000003f [<8078e4a4>] (avc_has_perm_noaudit) from [<807918cc>] (cred_has_capability security/selinux/hooks.c:1655 [inline]) [<8078e4a4>] (avc_has_perm_noaudit) from [<807918cc>] (selinux_vm_enough_memory+0x6c/0x90 security/selinux/hooks.c:2229) r9:84985d40 r8:00000000 r7:824672b8 r6:0000000a r5:84985d40 r4:824672c8 [<80791860>] (selinux_vm_enough_memory) from [<807782a8>] (security_vm_enough_memory_mm+0x44/0x7c security/security.c:1230) [<80778264>] (security_vm_enough_memory_mm) from [<804e9f58>] (__mmap_prepare mm/vma.c:2381 [inline]) [<80778264>] (security_vm_enough_memory_mm) from [<804e9f58>] (__mmap_region+0x9c0/0xd7c mm/vma.c:2651) r7:00000001 r6:76e33000 r5:ec779cc8 r4:85982c80 [<804e9598>] (__mmap_region) from [<804eaf64>] (mmap_region+0x88/0x160 mm/vma.c:2739) r10:00000000 r9:84985d40 r8:8449a400 r7:0000a000 r6:76e33000 r5:00000000 r4:00000073 [<804eaedc>] (mmap_region) from [<804cf9e8>] (do_mmap+0x368/0x538 mm/mmap.c:558) r8:76e33000 r7:8449a400 r6:00000003 r5:00000032 r4:0000a000 [<804cf680>] (do_mmap) from [<8049cbe0>] (vm_mmap_pgoff+0x13c/0x204 mm/util.c:580) r10:84985d40 r9:76e33000 r8:00009254 r7:ec779f18 r6:00000000 r5:00000003 r4:00000000 [<8049caa4>] (vm_mmap_pgoff) from [<804ceb98>] (ksys_mmap_pgoff+0x48/0xec mm/mmap.c:604) r10:000000c0 r9:8449a400 r8:8020029c r7:76e33000 r6:00009254 r5:00000003 r4:00000032 [<804ceb50>] (ksys_mmap_pgoff) from [<804cec58>] (__do_sys_mmap_pgoff mm/mmap.c:615 [inline]) [<804ceb50>] (ksys_mmap_pgoff) from [<804cec58>] (sys_mmap_pgoff+0x1c/0x24 mm/mmap.c:611) r8:8020029c r7:000000c0 r6:00000002 r5:00000000 r4:ffffffff [<804cec3c>] (sys_mmap_pgoff) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xec779fa8 to 0xec779ff0) 9fa0: ffffffff 00000000 76e33000 00009254 00000003 00000032 9fc0: ffffffff 00000000 00000002 000000c0 00000002 76e3c254 00000010 7ec0e1fc 9fe0: 00000000 7ec0dfb4 76f20d0c 76f383ec