binder: undelivered TRANSACTION_ERROR: 29201 INFO: task syz-executor2:7390 blocked for more than 140 seconds. Not tainted 4.9.131+ #50 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor2 D29256 7390 2111 0x80000000 ffff8801a11bc740 ffff8801a07c1600 ffff8801d3ca1080 ffff8801a0fdaf80 ffff8801db721018 ffff8801c8f07b10 ffffffff827f3542 ffff8801c8f07ae8 ffffffff81206b77 0000000000000000 00ff8801a11bcfe8 ffff8801db7218f0 Call Trace: [] schedule+0x7f/0x1b0 kernel/sched/core.c:3553 [] rwsem_down_read_failed+0x26c/0x400 kernel/locking/rwsem-xadd.c:260 [] call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94 [] __down_read arch/x86/include/asm/rwsem.h:65 [inline] [] down_read+0x52/0xb0 kernel/locking/rwsem.c:24 [] exit_mm kernel/exit.c:480 [inline] [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 [] do_group_exit+0x111/0x300 kernel/exit.c:937 [] SYSC_exit_group kernel/exit.c:948 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:946 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Showing all locks held in the system: 2 locks held by khungtaskd/24: #0: (rcu_read_lock){......}, at: [] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 kernel/hung_task.c:239 #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336 2 locks held by getty/2022: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 #1: (&ldata->atomic_read_lock){+.+.+.}, at: [] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142 1 lock held by syz-executor2/7390: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor2/7393: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor2/7414: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor2/7455: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.131+ #50 ffff8801d9907d08 ffffffff81b37029 0000000000000000 0000000000000000 0000000000000000 0000000000000001 ffffffff81098450 ffff8801d9907d40 ffffffff81b42139 0000000000000000 0000000000000000 0000000000000003 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99 [] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60 [] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [] check_hung_task kernel/hung_task.c:125 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [] watchdog+0x6ad/0xa20 kernel/hung_task.c:239 [] kthread+0x26d/0x300 kernel/kthread.c:211 [] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 7457 Comm: syz-executor2 Not tainted 4.9.131+ #50 task: ffff8801d4945f00 task.stack: ffff8801a1420000 RIP: 0010:[] c [] mark_held_locks+0x1b/0x130 kernel/locking/lockdep.c:2643 RSP: 0000:ffff8801a1427b30 EFLAGS: 00000806 RAX: ffff8801d49467a8 RBX: ffff8801d4945f00 RCX: 0000000000000000 RDX: 1ffff1003a928cf5 RSI: 0000000000000000 RDI: ffff8801d4945f00 RBP: ffff8801a1427b48 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff827fc20b R13: 1ffff10034284f72 R14: ffff8801d4945f00 R15: ffff8801a1427bb0 FS: 00007fbc273a8700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000faa308 CR3: 00000001c75ed000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 1ffff10034284f72c 0000000000000246c ffff8801a1427bb0c ffff8801a1427b68c ffffffff81206e46c ffff8801a08302e0c ffff8801a0830320c ffff8801a1427b78c ffffffff8120717dc ffff8801a1427c18c ffffffff827fc20bc ffff8801a08302e8c Call Trace: [] __trace_hardirqs_on_caller kernel/locking/lockdep.c:2681 [inline] [] trace_hardirqs_on_caller+0x266/0x590 kernel/locking/lockdep.c:2736 [] trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743 [] __mutex_unlock_common_slowpath kernel/locking/mutex.c:753 [inline] [] __mutex_unlock_slowpath+0x25b/0x3c0 kernel/locking/mutex.c:765 [] mutex_unlock+0x9/0x10 kernel/locking/mutex.c:437 [] perf_mmap+0x64a/0x1430 kernel/events/core.c:5278 [] mmap_region+0x80c/0xf90 mm/mmap.c:1726 [] do_mmap+0x53d/0xbb0 mm/mmap.c:1505 [] do_mmap_pgoff include/linux/mm.h:2032 [inline] [] vm_mmap_pgoff+0x168/0x1b0 mm/util.c:329 [] SYSC_mmap_pgoff mm/mmap.c:1555 [inline] [] SyS_mmap_pgoff+0xfe/0x1b0 mm/mmap.c:1513 [] SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] [] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: ce8 c4b cc6 c2e c00 c4c c8b c45 cc0 ce9 ca5 cf9 cff cff c66 c90 c55 c48 c8d c87 ca8 c08 c00 c00 c48 c89 ce5 c48 c89 cc2 c41 c57 c41 c56 c48 cc1 cea c03 c49 c89 cfe c41 c55 c<41> c54 c53 c48 c83 cec c18 c48 c89 c45 cc8 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c