netlink: 20 bytes leftover after parsing attributes in process `syz-executor4'.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor4'.
INFO: task syz-executor2:11417 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc1-next-20181109+ #110
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D20184 11417   6121 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xef/0x370 kernel/sched/core.c:3516
 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
 rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
 call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
 __down_read arch/x86/include/asm/rwsem.h:83 [inline]
 down_read+0x9b/0x120 kernel/locking/rwsem.c:26
 do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 __do_page_fault+0xbb0/0xe40 arch/x86/mm/fault.c:1489
 do_page_fault+0xed/0x7d1 arch/x86/mm/fault.c:1520
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1139
RIP: 0033:0x40052d
Code: 8a 4c 24 10 d3 e0 09 f0 48 8b 74 24 08 66 89 06 e9 fe 00 00 00 48 8b 44 24 10 48 0b 44 24 28 75 10 48 8b 44 24 08 8b 54 24 20 <89> 10 e9 e2 00 00 00 8a 4c 24 28 b8 01 00 00 00 48 8b 74 24 08 48
RSP: 002b:00007fff6a0074b0 EFLAGS: 00010246
RAX: 00000000200016c0 RBX: 000000000072c900 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001b6c848
RBP: fffffffffffffffe R08: 0000000000000000 R09: 0000000000000000
R10: 00007fff6a0075b0 R11: 0000000000000246 R12: 000000000072c04c
R13: 00000000000003e8 R14: 000000000005c47c R15: 000000000005c44f
INFO: task syz-executor2:11426 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc1-next-20181109+ #110
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D20568 11426   6121 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xef/0x370 kernel/sched/core.c:3516
 __rwsem_down_write_failed_common+0xc9a/0x15e0 kernel/locking/rwsem-xadd.c:577
 rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:606
 call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
 __down_write arch/x86/include/asm/rwsem.h:142 [inline]
 down_write+0xa5/0x130 kernel/locking/rwsem.c:72
 do_mmu_notifier_register+0x4f0/0x730 mm/mmu_notifier.c:265
 mmu_notifier_register+0x22/0x30 mm/mmu_notifier.c:316
 kvm_init_mmu_notifier arch/x86/kvm/../../../virt/kvm/kvm_main.c:512 [inline]
 kvm_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:680 [inline]
 kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:3197 [inline]
 kvm_dev_ioctl+0x1283/0x1ae0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3249
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x1de/0x1790 fs/ioctl.c:696
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: Bad RIP value.
RSP: 002b:00007f3ceeea2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 000000000000000e
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3ceeea36d4
R13: 00000000004bff27 R14: 00000000004d08f8 R15: 00000000ffffffff
INFO: task syz-executor2:11466 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc1-next-20181109+ #110
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D19456 11466   6121 0x80000004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xef/0x370 kernel/sched/core.c:3516
 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:280 [inline]
 rwsem_down_read_failed+0x371/0x710 kernel/locking/rwsem-xadd.c:297
 call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94
 __down_read arch/x86/include/asm/rwsem.h:83 [inline]
 down_read+0x9b/0x120 kernel/locking/rwsem.c:26
 exit_mm kernel/exit.c:511 [inline]
 do_exit+0x588/0x2620 kernel/exit.c:854
 do_group_exit+0x177/0x440 kernel/exit.c:970
 get_signal+0x8a8/0x1970 kernel/signal.c:2517
 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: Bad RIP value.
RSP: 002b:00007f3ceee81cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000072c048 RCX: 0000000000457569
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072c048
RBP: 000000000072c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072c04c
R13: 00007fff6a00746f R14: 00007f3ceee829c0 R15: 0000000000000002

Showing all locks held in the system:
1 lock held by khungtaskd/1010:
 #0: 000000004c5381bb (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379
1 lock held by rsyslogd/5966:
 #0: 00000000d57d98e0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 fs/file.c:766
2 locks held by getty/6056:
 #0: 000000002b07ce57 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000f5a67727 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6057:
 #0: 000000008adbedfa (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000cf9607b3 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6058:
 #0: 00000000940e47bb (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 000000002baf9b81 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6059:
 #0: 0000000099922562 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000a2f134eb (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6060:
 #0: 00000000b8fd3f5d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000b7bf50a3 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6061:
 #0: 0000000075982f04 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000078252b43 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/6062:
 #0: 00000000636bc02b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000039a68c44 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
1 lock held by syz-executor2/11417:
 #0: 00000000fc43af5c (&mm->mmap_sem){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 #0: 00000000fc43af5c (&mm->mmap_sem){++++}, at: __do_page_fault+0xbb0/0xe40 arch/x86/mm/fault.c:1489
1 lock held by syz-executor2/11419:
1 lock held by syz-executor2/11426:
 #0: 00000000fc43af5c (&mm->mmap_sem){++++}, at: do_mmu_notifier_register+0x4f0/0x730 mm/mmu_notifier.c:265
1 lock held by syz-executor2/11466:
 #0: 00000000fc43af5c (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:511 [inline]
 #0: 00000000fc43af5c (&mm->mmap_sem){++++}, at: do_exit+0x588/0x2620 kernel/exit.c:854

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1010 Comm: khungtaskd Not tainted 4.20.0-rc1-next-20181109+ #110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0xb4c/0x1060 kernel/hung_task.c:289
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 11419 Comm: syz-executor2 Not tainted 4.20.0-rc1-next-20181109+ #110
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.766 msecs
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__sanitizer_cov_trace_pc+0x1/0x50 kernel/kcov.c:94
Code: dd 28 00 00 00 4d 39 d0 72 1b 49 83 c1 01 4a 89 7c 10 e0 4a 89 74 10 e8 4a 89 54 10 f0 4a 89 4c d8 20 4c 89 08 5d c3 66 90 55 <48> 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 08 45 82
RSP: 0018:ffff8801daf077b0 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff8801b0c86ad8 RCX: 1ffff1003b5e0efd
RDX: 1ffff1003b5e4bc2 RSI: ffffffff8195ee6f RDI: ffff8801daf25e10
RBP: ffff8801daf078b0 R08: ffff880178e10080 R09: ffffed003b5e5b67
R10: 0000000000000002 R11: ffff8801daf2db3b R12: 1ffff1003b5e0f20
R13: 0000000000002710 R14: ffff8801daf07888 R15: 0000000000000001
FS:  00007f3ceeec4700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000445828 CR3: 00000001c2817000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 hrtimer_forward_now include/linux/hrtimer.h:473 [inline]
 perf_swevent_hrtimer+0x405/0x510 kernel/events/core.c:9160
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x412/0x10c0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x313/0x780 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1034 [inline]
 smp_apic_timer_interrupt+0x1a1/0x760 arch/x86/kernel/apic/apic.c:1059
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:804
 </IRQ>
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:771 [inline]
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x56/0x80 kernel/locking/spinlock.c:192
Code: 51 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 32 48 83 3d 93 05 83 01 00 74 1f fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 60 ac 86 f9 65 8b 05 89 f7 32 78 85 c0 74 05 5b
RSP: 0018:ffff8801cc47ddc8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff8801d5527a60 RCX: 1ffff1002f1c2124
RDX: 1ffffffff12a3f78 RSI: 0000000000000000 RDI: ffffffff8951fbc0
RBP: ffff8801cc47ddd0 R08: ffff880178e10920 R09: 0000000000000007
R10: 0000000000000000 R11: ffff880178e10080 R12: ffff8801d5527a58
R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000
 spin_unlock_irq include/linux/spinlock.h:379 [inline]
 __add_to_page_cache_locked+0xaca/0x1840 mm/filemap.c:842
 add_to_page_cache_lru+0x355/0xdb0 mm/filemap.c:886
 mpage_readpages+0x4e9/0x950 fs/mpage.c:399
 blkdev_readpages+0x2c/0x40 fs/block_dev.c:580
 read_pages+0x133/0x670 mm/readahead.c:123
 __do_page_cache_readahead+0x499/0x810 mm/readahead.c:209
 ra_submit mm/internal.h:66 [inline]
 do_sync_mmap_readahead mm/filemap.c:2371 [inline]
 filemap_fault+0xf4e/0x25f0 mm/filemap.c:2447
 __do_fault+0x100/0x6b0 mm/memory.c:2996
 do_read_fault mm/memory.c:3408 [inline]
 do_fault mm/memory.c:3534 [inline]
 handle_pte_fault mm/memory.c:3765 [inline]
 __handle_mm_fault+0x3ea0/0x5be0 mm/memory.c:3889
 handle_mm_fault+0x54f/0xc70 mm/memory.c:3926
 do_user_addr_fault arch/x86/mm/fault.c:1423 [inline]
 __do_page_fault+0x5d6/0xe40 arch/x86/mm/fault.c:1489
 do_page_fault+0xed/0x7d1 arch/x86/mm/fault.c:1520
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1139
RIP: 0010:fault_in_pages_readable include/linux/pagemap.h:609 [inline]
RIP: 0010:iov_iter_fault_in_readable+0x363/0x450 lib/iov_iter.c:424
Code: 00 31 ff 44 89 ee 88 55 98 e8 79 3e f0 fd 45 85 ed 74 c2 e9 7d fe ff ff e8 5a 3d f0 fd 0f 1f 00 0f ae e8 48 8b 85 28 ff ff ff <8a> 00 0f 1f 00 31 ff 
Lost 55 message(s)!