INFO: task syz-executor.2:18338 blocked for more than 143 seconds.
Not tainted 5.19.0-rc1-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:29512 pid:18338 ppid: 17168 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5116 [inline]
__schedule+0xa00/0x4b30 kernel/sched/core.c:6428
schedule+0xd2/0x1f0 kernel/sched/core.c:6500
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6559
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0xa70/0x1350 kernel/locking/mutex.c:747
evdev_release+0x79/0x410 drivers/input/evdev.c:441
__fput+0x277/0x9d0 fs/file_table.c:317
task_work_run+0xdd/0x1a0 kernel/task_work.c:177
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:169 [inline]
exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f76eec89109
RSP: 002b:00007f76efe84168 EFLAGS: 00000246 ORIG_RAX: 0000000000000021
RAX: 0000000000000003 RBX: 00007f76eed9c030 RCX: 00007f76eec89109
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 00007f76eece308d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f76ef2cfb1f R14: 00007f76efe84300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8bd866e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6491
3 locks held by kworker/u4:4/56:
1 lock held by hwrng/754:
#0: ffffffff8c832908 (reading_mutex){+.+.}-{3:3}, at: hwrng_fillfn+0x141/0x370 drivers/char/hw_random/core.c:503
2 locks held by getty/3290:
#0: ffff888026836098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:244
#1: ffffc90002cce2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xe50/0x13c0 drivers/tty/n_tty.c:2124
1 lock held by syz-executor.2/18309:
1 lock held by syz-executor.2/18338:
#0: ffff888020c27110 (&evdev->mutex){+.+.}-{3:3}, at: evdev_release+0x79/0x410 drivers/input/evdev.c:441
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted 5.19.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1e6/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xc22/0xf90 kernel/hung_task.c:378
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 56 Comm: kworker/u4:4 Not tainted 5.19.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:121 [inline]
RIP: 0010:lock_is_held_type+0x4a/0x140 kernel/locking/lockdep.c:5701
Code: 00 00 65 8b 05 bf 72 8b 76 85 c0 0f 85 ca 00 00 00 65 4c 8b 24 25 80 6f 02 00 41 8b 94 24 5c 0a 00 00 85 d2 0f 85 b1 00 00 00 <48> 89 fd 41 89 f6 9c 8f 04 24 fa 48 c7 c7 80 7b cc 89 31 db e8 dd
RSP: 0018:ffffc900001f0a30 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8bd86620
RBP: ffff8880b9b39fc0 R08: 0000000000000000 R09: ffffffff8dbb7457
R10: fffffbfff1b76e8a R11: 0000000000000001 R12: ffff888017d91d80
R13: 00000000ffffffff R14: ffff8880b9b3a05c R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efe861abc68 CR3: 000000000ba8e000 CR4: 00000000003506e0
Call Trace:
lock_is_held include/linux/lockdep.h:279 [inline]
rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125
trace_pelt_cfs_tp include/trace/events/sched.h:694 [inline]
__update_load_avg_cfs_rq+0x614/0x920 kernel/sched/pelt.c:328
update_cfs_rq_load_avg kernel/sched/fair.c:3798 [inline]
update_load_avg+0x1bd/0x1c80 kernel/sched/fair.c:3913
enqueue_entity+0xbd/0x1730 kernel/sched/fair.c:4356
enqueue_task_fair+0x1ba/0x1b60 kernel/sched/fair.c:5685
enqueue_task+0xad/0x3c0 kernel/sched/core.c:2072
activate_task kernel/sched/core.c:2097 [inline]
ttwu_do_activate+0x157/0x330 kernel/sched/core.c:3676
ttwu_queue kernel/sched/core.c:3872 [inline]
try_to_wake_up+0x557/0x1800 kernel/sched/core.c:4195
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:csd_lock_wait kernel/smp.c:414 [inline]
RIP: 0010:smp_call_function_many_cond+0x4ae/0x1110 kernel/smp.c:988
Code: 07 49 c1 ec 03 48 89 c5 4d 01 fc 83 c5 03 e8 39 98 0a 00 f3 90 41 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 21 0a 00 00 8b 43 08 <31> ff 83 e0 01 41 89 c6 89 c6 e8 53 94 0a 00 45 85 f6 75 d0 e8 09
RSP: 0018:ffffc900013e7950 EFLAGS: 00000246
RAX: 0000000000000011 RBX: ffff8880b9a42600 RCX: 0000000000000000
RDX: ffff888017d91d80 RSI: ffffffff816fde57 RDI: 0000000000000005
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffed10173484c1
R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000
on_each_cpu_cond_mask+0x56/0xa0 kernel/smp.c:1154
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:1231 [inline]
text_poke_bp_batch+0x233/0x6c0 arch/x86/kernel/alternative.c:1419
text_poke_flush arch/x86/kernel/alternative.c:1589 [inline]
text_poke_flush arch/x86/kernel/alternative.c:1586 [inline]
text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1596
arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
jump_label_update+0x32f/0x410 kernel/jump_label.c:830
static_key_enable_cpuslocked+0x1b1/0x260 kernel/jump_label.c:177
static_key_enable+0x16/0x20 kernel/jump_label.c:190
toggle_allocation_gate mm/kfence/core.c:808 [inline]
toggle_allocation_gate+0x100/0x390 mm/kfence/core.c:800
process_one_work+0x996/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e9/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 65 8b 05 bf 72 8b 76 mov %gs:0x768b72bf(%rip),%eax # 0x768b72c8
9: 85 c0 test %eax,%eax
b: 0f 85 ca 00 00 00 jne 0xdb
11: 65 4c 8b 24 25 80 6f mov %gs:0x26f80,%r12
18: 02 00
1a: 41 8b 94 24 5c 0a 00 mov 0xa5c(%r12),%edx
21: 00
22: 85 d2 test %edx,%edx
24: 0f 85 b1 00 00 00 jne 0xdb
* 2a: 48 89 fd mov %rdi,%rbp <-- trapping instruction
2d: 41 89 f6 mov %esi,%r14d
30: 9c pushfq
31: 8f 04 24 popq (%rsp)
34: fa cli
35: 48 c7 c7 80 7b cc 89 mov $0xffffffff89cc7b80,%rdi
3c: 31 db xor %ebx,%ebx
3e: e8 .byte 0xe8
3f: dd .byte 0xdd