INFO: task syz-executor.2:4301 blocked for more than 143 seconds.
Not tainted 5.17.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:29720 pid: 4301 ppid: 3736 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xab2/0x4db0 kernel/sched/core.c:6295
schedule+0xd2/0x260 kernel/sched/core.c:6368
rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1142
__down_write_common kernel/locking/rwsem.c:1259 [inline]
__down_write_common kernel/locking/rwsem.c:1256 [inline]
__down_write kernel/locking/rwsem.c:1268 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1515
inode_lock include/linux/fs.h:777 [inline]
chown_common+0x41c/0x6c0 fs/open.c:677
do_fchownat+0x126/0x1e0 fs/open.c:711
__do_sys_chown fs/open.c:731 [inline]
__se_sys_chown fs/open.c:729 [inline]
__x64_sys_chown+0x77/0xb0 fs/open.c:729
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fab64fd4059
RSP: 002b:00007fab63928168 EFLAGS: 00000246 ORIG_RAX: 000000000000005c
RAX: ffffffffffffffda RBX: 00007fab650e7030 RCX: 00007fab64fd4059
RDX: 000000000000ee00 RSI: 000000000000ee00 RDI: 0000000020000040
RBP: 00007fab6502e08d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc4c9b7ddf R14: 00007fab63928300 R15: 0000000000022000
INFO: task syz-executor.0:4302 blocked for more than 144 seconds.
Not tainted 5.17.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:29720 pid: 4302 ppid: 3606 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xab2/0x4db0 kernel/sched/core.c:6295
schedule+0xd2/0x260 kernel/sched/core.c:6368
rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1142
__down_write_common kernel/locking/rwsem.c:1259 [inline]
__down_write_common kernel/locking/rwsem.c:1256 [inline]
__down_write kernel/locking/rwsem.c:1268 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1515
inode_lock include/linux/fs.h:777 [inline]
chown_common+0x41c/0x6c0 fs/open.c:677
do_fchownat+0x126/0x1e0 fs/open.c:711
__do_sys_chown fs/open.c:731 [inline]
__se_sys_chown fs/open.c:729 [inline]
__x64_sys_chown+0x77/0xb0 fs/open.c:729
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbab5352059
RSP: 002b:00007fbab3ca6168 EFLAGS: 00000246 ORIG_RAX: 000000000000005c
RAX: ffffffffffffffda RBX: 00007fbab5465030 RCX: 00007fbab5352059
RDX: 000000000000ee00 RSI: 000000000000ee00 RDI: 0000000020000040
RBP: 00007fbab53ac08d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffa172bcbf R14: 00007fbab3ca6300 R15: 0000000000022000
INFO: task syz-executor.1:4317 blocked for more than 144 seconds.
Not tainted 5.17.0-rc3-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:29880 pid: 4317 ppid: 3607 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xab2/0x4db0 kernel/sched/core.c:6295
schedule+0xd2/0x260 kernel/sched/core.c:6368
rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1142
__down_write_common kernel/locking/rwsem.c:1259 [inline]
__down_write_common kernel/locking/rwsem.c:1256 [inline]
__down_write kernel/locking/rwsem.c:1268 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1515
inode_lock include/linux/fs.h:777 [inline]
chown_common+0x41c/0x6c0 fs/open.c:677
do_fchownat+0x126/0x1e0 fs/open.c:711
__do_sys_chown fs/open.c:731 [inline]
__se_sys_chown fs/open.c:729 [inline]
__x64_sys_chown+0x77/0xb0 fs/open.c:729
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f91dfba0059
RSP: 002b:00007f91de4f4168 EFLAGS: 00000246 ORIG_RAX: 000000000000005c
RAX: ffffffffffffffda RBX: 00007f91dfcb3030 RCX: 00007f91dfba0059
RDX: 000000000000ee00 RSI: 000000000000ee00 RDI: 0000000020000040
RBP: 00007f91dfbfa08d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff44bc42af R14: 00007f91de4f4300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by ksoftirqd/1/19:
1 lock held by khungtaskd/27:
#0: ffffffff8bb81120 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6460
2 locks held by getty/3281:
#0: ffff88814ae1a098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:244
#1: ffffc90002b5e2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2077
2 locks held by syz-executor.2/4297:
#0: ffff88801c7288b0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:1034
#1: ffff8880562cf8d0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: iterate_dir+0xcd/0x700 fs/readdir.c:55
2 locks held by syz-executor.2/4301:
#0: ffff8880754ce460 (sb_writers#14){.+.+}-{0:0}, at: do_fchownat+0x101/0x1e0 fs/open.c:708
#1: ffff8880562cf8d0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline]
#1: ffff8880562cf8d0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: chown_common+0x41c/0x6c0 fs/open.c:677
2 locks held by syz-executor.0/4299:
#0: ffff888019511630 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:1034
#1: ffff888056b18850 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: iterate_dir+0xcd/0x700 fs/readdir.c:55
2 locks held by syz-executor.0/4302:
#0: ffff8880757ca460 (sb_writers#14){.+.+}-{0:0}, at: do_fchownat+0x101/0x1e0 fs/open.c:708
#1: ffff888056b18850 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline]
#1: ffff888056b18850 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: chown_common+0x41c/0x6c0 fs/open.c:677
2 locks held by syz-executor.1/4314:
2 locks held by syz-executor.1/4317:
#0: ffff88807c406460 (sb_writers#14){.+.+}-{0:0}, at: do_fchownat+0x101/0x1e0 fs/open.c:708
#1: ffff88801e589348 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline]
#1: ffff88801e589348 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: chown_common+0x41c/0x6c0 fs/open.c:677
2 locks held by syz-executor.3/4522:
2 locks held by syz-executor.3/4524:
#0: ffff888070180460 (sb_writers#14){.+.+}-{0:0}, at: do_fchownat+0x101/0x1e0 fs/open.c:708
#1: ffff8880562cf308 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline]
#1: ffff8880562cf308 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: chown_common+0x41c/0x6c0 fs/open.c:677
2 locks held by syz-executor.4/4540:
#0: ffff8880782ff3b0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:1034
#1: ffff88807108b950 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: iterate_dir+0xcd/0x700 fs/readdir.c:55
2 locks held by syz-executor.4/4542:
#0: ffff888015188460 (sb_writers#14){.+.+}-{0:0}, at: do_fchownat+0x101/0x1e0 fs/open.c:708
#1: ffff88807108b950 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline]
#1: ffff88807108b950 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: chown_common+0x41c/0x6c0 fs/open.c:677
2 locks held by syz-executor.5/4629:
2 locks held by syz-executor.5/4631:
#0: ffff888073fb0460 (sb_writers#14){.+.+}-{0:0}, at: do_fchownat+0x101/0x1e0 fs/open.c:708
#1: ffff88807108b388 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: inode_lock include/linux/fs.h:777 [inline]
#1: ffff88807108b388 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: chown_common+0x41c/0x6c0 fs/open.c:677
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.17.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:369
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4297 Comm: syz-executor.2 Not tainted 5.17.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49
Code: 48 89 47 18 48 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d9 90 c3 0f 1f 80 00 00 00 00 b9 00 10 00 00 31 c0 aa c3 cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55 53 48 89 fb
RSP: 0018:ffffc90002887490 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000f80
RDX: ffffea000195cc40 RSI: ffff888000000000 RDI: ffff888065731080
RBP: ffffea000195c000 R08: 0000160000000000 R09: ffffea000195d000
R10: fffff9400032b806 R11: 0000000000000001 R12: 0000000000000006
R13: 0000000000342040 R14: 0000000000000040 R15: 0000000000000006
FS: 00007fab63949700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7c0c267128 CR3: 0000000019fd2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
clear_page arch/x86/include/asm/page_64.h:50 [inline]
clear_highpage include/linux/highmem.h:217 [inline]
kernel_init_free_pages mm/page_alloc.c:1289 [inline]
kernel_init_free_pages mm/page_alloc.c:1274 [inline]
post_alloc_hook+0x1ba/0x230 mm/page_alloc.c:2423
prep_new_page mm/page_alloc.c:2434 [inline]
get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389
__alloc_pages_node include/linux/gfp.h:572 [inline]
kmem_getpages mm/slab.c:1378 [inline]
cache_grow_begin+0x75/0x350 mm/slab.c:2584
cache_alloc_refill+0x27f/0x380 mm/slab.c:2957
____cache_alloc mm/slab.c:3040 [inline]
____cache_alloc mm/slab.c:3023 [inline]
__do_cache_alloc mm/slab.c:3267 [inline]
slab_alloc mm/slab.c:3308 [inline]
kmem_cache_alloc+0x450/0x560 mm/slab.c:3499
p9_fcall_init+0x142/0x210 net/9p/client.c:225
p9_tag_alloc net/9p/client.c:275 [inline]
p9_client_prepare_req.part.0+0xf0/0xc20 net/9p/client.c:697
p9_client_prepare_req net/9p/client.c:802 [inline]
p9_client_rpc+0x21c/0x1260 net/9p/client.c:734
p9_client_read_once+0x23b/0x600 net/9p/client.c:1602
p9_client_read+0x13b/0x1a0 net/9p/client.c:1561
v9fs_dir_readdir+0x4ac/0x6d0 fs/9p/vfs_dir.c:113
iterate_dir+0x576/0x700 fs/readdir.c:65
__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64 fs/readdir.c:354 [inline]
__x64_sys_getdents64+0x13a/0x2c0 fs/readdir.c:354
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fab64fd4059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fab63949168 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007fab650e6f60 RCX: 00007fab64fd4059
RDX: 0000000000000034 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 00007fab6502e08d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc4c9b7ddf R14: 00007fab63949300 R15: 0000000000022000
----------------
Code disassembly (best guess):
0: 48 89 47 18 mov %rax,0x18(%rdi)
4: 48 89 47 20 mov %rax,0x20(%rdi)
8: 48 89 47 28 mov %rax,0x28(%rdi)
c: 48 89 47 30 mov %rax,0x30(%rdi)
10: 48 89 47 38 mov %rax,0x38(%rdi)
14: 48 8d 7f 40 lea 0x40(%rdi),%rdi
18: 75 d9 jne 0xfffffff3
1a: 90 nop
1b: c3 retq
1c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
23: b9 00 10 00 00 mov $0x1000,%ecx
28: 31 c0 xor %eax,%eax
* 2a: f3 aa rep stos %al,%es:(%rdi) <-- trapping instruction
2c: c3 retq
2d: cc int3
2e: cc int3
2f: cc int3
30: cc int3
31: cc int3
32: cc int3
33: 41 57 push %r15
35: 41 56 push %r14
37: 41 55 push %r13
39: 41 54 push %r12
3b: 55 push %rbp
3c: 53 push %rbx
3d: 48 89 fb mov %rdi,%rbx