INFO: task syz.4.2219:18948 blocked for more than 143 seconds. Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.2219 state:D stack:27424 pid:18948 tgid:18923 ppid:16060 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5315 [inline] __schedule+0xef5/0x5750 kernel/sched/core.c:6675 __schedule_loop kernel/sched/core.c:6752 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6767 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6824 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 remove_inode_hugepages+0x30a/0xeb0 fs/hugetlbfs/inode.c:665 hugetlbfs_evict_inode+0x22/0x70 fs/hugetlbfs/inode.c:690 evict+0x409/0x970 fs/inode.c:723 iput_final fs/inode.c:1875 [inline] iput fs/inode.c:1901 [inline] iput+0x530/0x890 fs/inode.c:1887 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:412 __dentry_kill+0x1d0/0x600 fs/dcache.c:615 dput.part.0+0x4b1/0x9b0 fs/dcache.c:857 dput+0x1f/0x30 fs/dcache.c:847 __fput+0x513/0xb60 fs/file_table.c:439 task_work_run+0x14e/0x250 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xadd/0x2d70 kernel/exit.c:939 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088 get_signal+0x25fb/0x2770 kernel/signal.c:2917 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f433f57dff9 RSP: 002b:00007f433f3b70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f433f736138 RCX: 00007f433f57dff9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f433f736138 RBP: 00007f433f736130 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f433f73613c R13: 0000000000000000 R14: 00007fff1594c940 R15: 00007fff1594ca28 INFO: task syz.0.2224:18945 blocked for more than 143 seconds. Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2224 state:D stack:25824 pid:18945 tgid:18945 ppid:16817 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5315 [inline] __schedule+0xef5/0x5750 kernel/sched/core.c:6675 __schedule_loop kernel/sched/core.c:6752 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6767 io_schedule+0xbf/0x130 kernel/sched/core.c:7552 folio_wait_bit_common+0x3d8/0x9b0 mm/filemap.c:1309 __folio_lock mm/filemap.c:1647 [inline] folio_lock include/linux/pagemap.h:1148 [inline] folio_lock include/linux/pagemap.h:1144 [inline] __filemap_get_folio+0x6a4/0xaf0 mm/filemap.c:1900 filemap_lock_folio include/linux/pagemap.h:788 [inline] filemap_lock_hugetlb_folio include/linux/hugetlb.h:795 [inline] hugetlb_fault+0x16ff/0x2fa0 mm/hugetlb.c:6406 handle_mm_fault+0x930/0xaa0 mm/memory.c:6060 do_user_addr_fault+0x60d/0x13f0 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7fd234851629 RSP: 002b:00007ffd146a5690 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffffff7fffff RDX: a0310b5cf546156a RSI: 0000000020800000 RDI: 0000555594ebd3c8 RBP: 00007fd234b37a80 R08: 00007fd234800000 R09: 0000000000000008 R10: 0000000000000000 R11: 0000000000000003 R12: 00000000002287a9 R13: 00007ffd146a5790 R14: 0000000000000032 R15: fffffffffffffffe INFO: task syz.0.2224:18946 blocked for more than 144 seconds. Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2224 state:D stack:26560 pid:18946 tgid:18945 ppid:16817 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5315 [inline] __schedule+0xef5/0x5750 kernel/sched/core.c:6675 __schedule_loop kernel/sched/core.c:6752 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6767 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6824 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlb_wp+0x1b4a/0x3320 mm/hugetlb.c:5894 hugetlb_fault+0x2248/0x2fa0 mm/hugetlb.c:6454 handle_mm_fault+0x930/0xaa0 mm/memory.c:6060 do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1389 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58 Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb RSP: 0018:ffffc9000913fc48 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 RDX: fffff52001227f98 RSI: ffffc9000913fcb8 RDI: 000000002001e588 RBP: 000000002001e588 R08: 0000000000000000 R09: fffff52001227f97 R10: ffffc9000913fcbf R11: 0000000000000000 R12: ffffc9000913fcb8 R13: 000000002001e590 R14: 0000000000000000 R15: 0000000020019680 copy_user_generic arch/x86/include/asm/uaccess_64.h:121 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:142 [inline] _inline_copy_to_user include/linux/uaccess.h:188 [inline] _copy_to_user+0xac/0xc0 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:216 [inline] msr_read+0x14f/0x250 arch/x86/kernel/msr.c:69 vfs_read+0x1ce/0xbd0 fs/read_write.c:567 ksys_read+0x12f/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd23497dff9 RSP: 002b:00007fd2356cf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fd234b35f80 RCX: 00007fd23497dff9 RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000004 RBP: 00007fd2349f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd234b35f80 R15: 00007ffd146a5528 Showing all locks held in the system: 1 lock held by rcu_exp_gp_kthr/19: 1 lock held by khungtaskd/30: #0: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6720 2 locks held by getty/4977: #0: ffff88814bd090a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211 3 locks held by kworker/1:6/5285: 3 locks held by kworker/u8:13/5455: 2 locks held by kworker/u8:20/6612: 1 lock held by syz.4.2219/18948: #0: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: remove_inode_hugepages+0x30a/0xeb0 fs/hugetlbfs/inode.c:665 3 locks held by syz.0.2224/18945: #0: ffff8880533f6730 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:704 [inline] #0: ffff8880533f6730 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6228 #1: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 #2: ffff888056f2a4e8 (&resv_map->rw_sema){++++}-{3:3}, at: hugetlb_vma_lock_read mm/hugetlb.c:276 [inline] #2: ffff888056f2a4e8 (&resv_map->rw_sema){++++}-{3:3}, at: hugetlb_vma_lock_read+0x105/0x140 mm/hugetlb.c:267 2 locks held by syz.0.2224/18946: #0: ffff888043c37398 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline] #0: ffff888043c37398 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6108 [inline] #0: ffff888043c37398 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x3a9/0x6a0 mm/memory.c:6159 #1: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_wp+0x1b4a/0x3320 mm/hugetlb.c:5894 2 locks held by syz.4.2272/19271: #0: ffff88806b622b68 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:704 [inline] #0: ffff88806b622b68 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6228 #1: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 2 locks held by syz.0.2279/19291: #0: ffff88807e91bb68 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:704 [inline] #0: ffff88807e91bb68 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6228 #1: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 1 lock held by syz-executor/19411: 3 locks held by syz.3.2306/19441: #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88804b6b0148 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88804b6b0148 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz.1.2316/19483: #0: ffff88806209ec40 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:704 [inline] #0: ffff88806209ec40 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6228 #1: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.4.2325/19543: #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff88801b1ba420 (sb_writers#17){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88806e1f8b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88806e1f8b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141af2608 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz-executor/19619: #0: ffff88805a428d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481 #1: ffff88805a428078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x346/0x1110 net/bluetooth/hci_sync.c:5183 #2: ffffffff90149928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1972 [inline] #2: ffffffff90149928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xc4/0x260 net/bluetooth/hci_conn.c:2589 1 lock held by syz.1.2431/20046: #0: ffffc90013fd70a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_set_memory_region virt/kvm/kvm_main.c:2112 [inline] #0: ffffc90013fd70a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl_set_memory_region virt/kvm/kvm_main.c:2125 [inline] #0: ffffc90013fd70a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl+0x150b/0x3de0 virt/kvm/kvm_main.c:5209 3 locks held by syz.2.2432/20051: #0: ffff88806e8f0d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481 #1: ffff88806e8f0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x346/0x1110 net/bluetooth/hci_sync.c:5183 #2: ffffffff90149928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1972 [inline] #2: ffffffff90149928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xc4/0x260 net/bluetooth/hci_conn.c:2589 1 lock held by rm/20062: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xf0c/0x1240 kernel/hung_task.c:379 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 20031 Comm: syz.3.2430 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:hlock_class+0x1d/0x130 kernel/locking/lockdep.c:223 Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 48 b8 00 00 00 00 00 fc ff df 53 48 89 fb 48 83 c7 20 48 89 fa 48 c1 ea 03 0f b6 04 02 <84> c0 74 08 3c 03 0f 8e da 00 00 00 0f b7 5b 20 66 81 e3 ff 1f 0f RSP: 0018:ffffc90012f2f350 EFLAGS: 00000806 RAX: 0000000000000000 RBX: ffff888027d6e508 RCX: 0000000000000002 RDX: 1ffff11004fadca5 RSI: ffff888027d6e508 RDI: ffff888027d6e528 RBP: ffffc90012f2f498 R08: 0000000000000000 R09: 0000000000000006 R10: ffffffff96e26c47 R11: 0000000000000002 R12: ffff888027d6da00 R13: 0000000000000200 R14: 0000000000000009 R15: 1ffff920025e5e72 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdb6bc653b0 CR3: 000000000df7c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mark_lock+0xb5/0xc60 kernel/locking/lockdep.c:4703 mark_usage kernel/locking/lockdep.c:4646 [inline] __lock_acquire+0x906/0x3ce0 kernel/locking/lockdep.c:5156 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] is_bpf_text_address+0x36/0x1a0 kernel/bpf/core.c:767 kernel_text_address kernel/extable.c:125 [inline] kernel_text_address+0x8d/0x100 kernel/extable.c:94 __kernel_text_address+0xd/0x40 kernel/extable.c:79 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:369 arch_stack_walk+0xa7/0x100 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 save_stack+0x162/0x1f0 mm/page_owner.c:156 __reset_page_owner+0x8d/0x400 mm/page_owner.c:297 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x5f4/0xdc0 mm/page_alloc.c:2638 vfree+0x17a/0x890 mm/vmalloc.c:3361 kcov_put kernel/kcov.c:439 [inline] kcov_put+0x2a/0x40 kernel/kcov.c:435 kcov_close+0xd/0x20 kernel/kcov.c:535 __fput+0x3f6/0xb60 fs/file_table.c:431 task_work_run+0x14e/0x250 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xadd/0x2d70 kernel/exit.c:939 do_group_exit+0xd3/0x2a0 kernel/exit.c:1088 get_signal+0x25fb/0x2770 kernel/signal.c:2917 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc71557dff9 Code: Unable to access opcode bytes at 0x7fc71557dfcf. RSP: 002b:00007fc7162ed0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fc715735f88 RCX: 00007fc71557dff9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc715735f88 RBP: 00007fc715735f80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc715735f8c R13: 0000000000000000 R14: 00007ffed59e9370 R15: 00007ffed59e9458