INFO: task syz-executor.4:6375 blocked for more than 143 seconds.
Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:28464 pid: 6375 ppid: 6519 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
__down_read_common kernel/locking/rwsem.c:1223 [inline]
__down_read kernel/locking/rwsem.c:1232 [inline]
down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
mmap_read_lock include/linux/mmap_lock.h:117 [inline]
exit_mm kernel/exit.c:483 [inline]
do_exit+0xa0a/0x2b40 kernel/exit.c:819
do_group_exit+0x125/0x310 kernel/exit.c:929
get_signal+0x47d/0x2220 kernel/signal.c:2852
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f29c4b9db19
RSP: 002b:00007f29c3b13188 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
RAX: 0000000000000001 RBX: 00007f29c4cb0f60 RCX: 00007f29c4b9db19
RDX: 0000000000000800 RSI: 0000000000000001 RDI: 0000000020000000
RBP: 00007f29c4bf7f9f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc3172eb0f R14: 00007f29c3b13300 R15: 0000000000022000
INFO: task syz-executor.4:6441 blocked for more than 145 seconds.
Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:29592 pid: 6441 ppid: 6519 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
__down_read_common kernel/locking/rwsem.c:1223 [inline]
__down_read kernel/locking/rwsem.c:1232 [inline]
down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
mmap_read_lock include/linux/mmap_lock.h:117 [inline]
exit_mm kernel/exit.c:483 [inline]
do_exit+0xa0a/0x2b40 kernel/exit.c:819
do_group_exit+0x125/0x310 kernel/exit.c:929
get_signal+0x47d/0x2220 kernel/signal.c:2852
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f29c4b9db19
RSP: 002b:00007f29c3af2218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f29c4cb1028 RCX: 00007f29c4b9db19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f29c4cb1028
RBP: 00007f29c4cb1020 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f29c4cb102c
R13: 00007ffc3172eb0f R14: 00007f29c3af2300 R15: 0000000000022000
INFO: task syz-executor.4:6442 blocked for more than 147 seconds.
Not tainted 5.16.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:29616 pid: 6442 ppid: 6519 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
rwsem_down_read_slowpath+0x589/0xa70 kernel/locking/rwsem.c:1041
__down_read_common kernel/locking/rwsem.c:1223 [inline]
__down_read kernel/locking/rwsem.c:1232 [inline]
down_read+0xe2/0x440 kernel/locking/rwsem.c:1472
mmap_read_lock include/linux/mmap_lock.h:117 [inline]
exit_mm kernel/exit.c:483 [inline]
do_exit+0xa0a/0x2b40 kernel/exit.c:819
do_group_exit+0x125/0x310 kernel/exit.c:929
get_signal+0x47d/0x2220 kernel/signal.c:2852
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
RIP: 0033:0x7f29c4b9ef41
RSP: 002b:00007f29c3ad12f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: 0000000000000000 RBX: 00007f29c3ad1700 RCX: 00007f29c4b9ef41
RDX: 00007f29c3ad19d0 RSI: 00007f29c3ad12f0 RDI: 00000000003d0f00
RBP: 00007ffc3172ec90 R08: 00007f29c3ad1700 R09: 00007f29c3ad1700
R10: 00007f29c3ad19d0 R11: 0000000000000206 R12: 00007ffc3172eb0e
R13: 00007ffc3172eb0f R14: 00007f29c3ad1300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8bb83b60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
1 lock held by systemd-udevd/2972:
1 lock held by in:imklog/6212:
#0: ffff888071c06d70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
2 locks held by agetty/6434:
#0: ffff88807c2a1098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252
#1: ffffc90001cc92e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2113
3 locks held by systemd-udevd/11329:
#0: ffff8880b9c39a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
#1: ffff8880b9c39a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
#2: ffff88801e2f7558 (&ep->lock){.-.-}-{2:2}, at: ep_poll_callback+0x75/0xf90 fs/eventpoll.c:1136
1 lock held by systemd-udevd/13359:
#0: ffff8880b9c39a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
1 lock held by syz-executor.4/6359:
1 lock held by syz-executor.4/6375:
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: exit_mm kernel/exit.c:483 [inline]
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: do_exit+0xa0a/0x2b40 kernel/exit.c:819
1 lock held by syz-executor.4/6441:
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: exit_mm kernel/exit.c:483 [inline]
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: do_exit+0xa0a/0x2b40 kernel/exit.c:819
1 lock held by syz-executor.4/6442:
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: exit_mm kernel/exit.c:483 [inline]
#0: ffff88806bd26328 (&mm->mmap_lock#2){++++}-{3:3}, at: do_exit+0xa0a/0x2b40 kernel/exit.c:819
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 2425 Comm: kworker/u4:5 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy8 ieee80211_iface_work
RIP: 0010:unwind_next_frame+0x847/0x1ce0 arch/x86/kernel/unwind_orc.c:466
Code: ff 80 3d 41 a6 48 0c 00 0f 85 f3 fb ff ff e9 7c 60 cc 07 48 b8 00 00 00 00 00 fc ff df 48 8b 54 24 08 48 c1 ea 03 80 3c 02 00 <0f> 85 2a 0f 00 00 4c 89 c0 49 8b 56 38 48 be 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000a5ff7a0 EFLAGS: 00000046
RAX: dffffc0000000000 RBX: 1ffff920014bfefc RCX: ffffffff8e995c77
RDX: 1ffff920014bff16 RSI: 0000000000000001 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffff8e995c72 R09: 0000000000000001
R10: fffff520014bff1a R11: 000000000008808a R12: ffffc9000a5ff8c0
R13: ffffc9000a5ff8ad R14: ffffc9000a5ff878 R15: ffffffff8e995c76
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efcfc032560 CR3: 000000000b88e000 CR4: 0000000000350ee0
Call Trace:
arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
metadata_update_state+0xb9/0x2b0 mm/kfence/core.c:288
kfence_guarded_free+0x108/0x930 mm/kfence/core.c:490
__kfence_free+0x70/0x150 mm/kfence/core.c:947
do_slab_free mm/slub.c:3501 [inline]
slab_free mm/slub.c:3514 [inline]
kfree+0x47f/0x560 mm/slub.c:4561
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1611 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1b1e/0x3130 net/mac80211/ibss.c:1639
ieee80211_iface_process_skb net/mac80211/iface.c:1468 [inline]
ieee80211_iface_work+0xa65/0xd00 net/mac80211/iface.c:1522
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: ff 80 3d 41 a6 48 incl 0x48a6413d(%rax)
6: 0c 00 or $0x0,%al
8: 0f 85 f3 fb ff ff jne 0xfffffc01
e: e9 7c 60 cc 07 jmpq 0x7cc608f
13: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1a: fc ff df
1d: 48 8b 54 24 08 mov 0x8(%rsp),%rdx
22: 48 c1 ea 03 shr $0x3,%rdx
26: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
* 2a: 0f 85 2a 0f 00 00 jne 0xf5a <-- trapping instruction
30: 4c 89 c0 mov %r8,%rax
33: 49 8b 56 38 mov 0x38(%r14),%rdx
37: 48 rex.W
38: be 00 00 00 00 mov $0x0,%esi
3d: 00 fc add %bh,%ah
3f: ff .byte 0xff