INFO: task kworker/u4:3:165 blocked for more than 143 seconds. Not tainted 5.15.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:3 state:D stack:24176 pid: 165 ppid: 2 flags:0x00004000 Workqueue: events_unbound flush_to_ldisc Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x947/0x22b0 kernel/sched/core.c:6287 schedule+0xcf/0x270 kernel/sched/core.c:6366 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857 __down_common+0x2e0/0x420 kernel/locking/semaphore.c:224 down+0x72/0xa0 kernel/locking/semaphore.c:62 console_lock+0x2a/0x80 kernel/printk/printk.c:2523 do_con_write+0x10f/0x1e40 drivers/tty/vt/vt.c:2908 con_put_char+0x70/0xa0 drivers/tty/vt/vt.c:3303 tty_put_char+0xb7/0x150 drivers/tty/tty_io.c:3173 __process_echoes+0x577/0x9f0 drivers/tty/n_tty.c:725 flush_echoes drivers/tty/n_tty.c:826 [inline] __receive_buf drivers/tty/n_tty.c:1579 [inline] n_tty_receive_buf_common+0x1699/0x4780 drivers/tty/n_tty.c:1674 tty_ldisc_receive_buf+0xa3/0x190 drivers/tty/tty_buffer.c:471 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:39 receive_buf drivers/tty/tty_buffer.c:491 [inline] flush_to_ldisc+0x20d/0x380 drivers/tty/tty_buffer.c:543 process_one_work+0x9bf/0x1620 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3c2/0x4a0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor.4:3405 blocked for more than 144 seconds. Not tainted 5.15.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:24440 pid: 3405 ppid: 3345 flags:0x00000000 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x947/0x22b0 kernel/sched/core.c:6287 schedule+0xcf/0x270 kernel/sched/core.c:6366 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline] synchronize_rcu_expedited+0x5d2/0x640 kernel/rcu/tree_exp.h:837 Showing all locks held in the system: 6 locks held by kworker/0:0/5: 1 lock held by khungtaskd/24: #0: ffffffff87681ea0 ( rcu_read_lock){....}-{1:2} , at: debug_show_all_locks+0x53/0x269 kernel/locking/lockdep.c:6446 4 locks held by kworker/u4:2/67: #0: ffff8881085a2938 ((wq_completion)netns ){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] ){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] ){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] ){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] ){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] ){+.+.}-{0:0}, at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc90000937db0 (net_cleanup_work){+.+.}-{0:0} , at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 #2: ffffffff8860add0 (pernet_ops_rwsem){++++}-{3:3} , at: cleanup_net+0x9b/0xb00 net/core/net_namespace.c:553 #3: ffffffff876889e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #3: ffffffff876889e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2fb/0x640 kernel/rcu/tree_exp.h:837 6 locks held by kworker/u4:3/165: #0: ffff888100069138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888100069138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888100069138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888100069138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888100069138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888100069138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc90000fcfdb0 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 #2: ffff888115e6c0b8 (&buf->lock){+.+.}-{3:3} , at: flush_to_ldisc+0x3e/0x380 drivers/tty/tty_buffer.c:515 #3: ffff8881447a0098 ( &tty->ldisc_sem ){++++}-{0:0}, at: tty_ldisc_ref+0x1d/0x80 drivers/tty/tty_ldisc.c:273 #4: ffff8881447a02e8 (&tty->termios_rwsem){++++}-{3:3}, at: n_tty_receive_buf_common+0x84/0x4780 drivers/tty/n_tty.c:1637 #5: ffffc900011a3378 (&ldata->output_lock){+.+.}-{3:3} , at: flush_echoes drivers/tty/n_tty.c:824 [inline] , at: __receive_buf drivers/tty/n_tty.c:1579 [inline] , at: n_tty_receive_buf_common+0x1663/0x4780 drivers/tty/n_tty.c:1674 1 lock held by in:imklog/2810: #0: ffff88810f346ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 2 locks held by agetty/2819: #0: ffff888113d46098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252 #1: ffffc90000f832e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2113 1 lock held by syz-fuzzer/2912: 1 lock held by syz-executor.3/3193: 2 locks held by kworker/0:4/5892: #0: ffff888100064d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc9000fef7db0 (free_ipc_work){+.+.}-{0:0} , at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 6 locks held by kworker/0:5/5978: 6 locks held by kworker/0:6/6335: #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc90010cc7db0 ((work_completion)(&hub->events) ){+.+.}-{0:0}, at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 #2: ffff88810cea0220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff88810cea0220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662 #3: ffff88813e3b8220 ( &dev->mutex){....}-{3:3} , at: device_lock include/linux/device.h:760 [inline] , at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944 #4: ffff88810dd8e1a8 (&dev->mutex){....}-{3:3} , at: device_lock include/linux/device.h:760 [inline] , at: __device_attach+0x7a/0x4a0 drivers/base/dd.c:944 #5: ffff888113a2cce0 (&dev->phy_mutex){+.+.}-{3:3}, at: asix_mdio_read+0x86/0x220 drivers/net/usb/asix_common.c:495 6 locks held by kworker/0:7/6942: 2 locks held by kworker/0:2/30851: #0: ffff888100066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888100066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888100066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888100066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888100066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888100066538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc90012ce7db0 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 7 locks held by kworker/0:3/5122: #0: ffff8881037a0138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc90011617db0 ((work_completion)(&hub->events)){+.+.}-{0:0} , at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 #2: ffff88810bb62220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] ffff88810bb62220 (&dev->mutex){....}-{3:3}, at: hub_event+0x1c1/0x4330 drivers/usb/core/hub.c:5662 #3: ffff88813dbb4220 ( &dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] &dev->mutex){....}-{3:3}, at: usb_disconnect.cold+0x43/0x78e drivers/usb/core/hub.c:2216 #4: ffff88811da481a8 ( &dev->mutex ){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] ){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1032 [inline] ){....}-{3:3}, at: device_release_driver_internal drivers/base/dd.c:1233 [inline] ){....}-{3:3}, at: device_release_driver+0x1c/0x40 drivers/base/dd.c:1259 #5: ffff888107999ab0 (&dev->mutex ){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] ){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1032 [inline] ){....}-{3:3}, at: device_release_driver_internal drivers/base/dd.c:1233 [inline] ){....}-{3:3}, at: device_release_driver+0x1c/0x40 drivers/base/dd.c:1259 #6: ffffffff88138048 (input_mutex){+.+.}-{3:3}, at: __input_unregister_device+0x16d/0x470 drivers/input/input.c:2186 2 locks held by agetty/11279: #0: ffff8881447a0098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:252 #1: ffffc900011a32e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2113 1 lock held by syz-executor.3/16663: #0: ffffffff876889e8 (rcu_state.exp_mutex){+.+.}-{3:3} , at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] , at: synchronize_rcu_expedited+0x2fb/0x640 kernel/rcu/tree_exp.h:837 2 locks held by kworker/0:1/16673: #0: ffff888100064d38 ((wq_completion)events){+.+.}-{0:0} , at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] , at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] , at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] , at: set_work_data kernel/workqueue.c:634 [inline] , at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] , at: process_one_work+0x8a3/0x1620 kernel/workqueue.c:2268 #1: ffffc9000346fdb0 (console_work){+.+.}-{0:0} , at: process_one_work+0x8d7/0x1620 kernel/workqueue.c:2272 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 24 Comm: khungtaskd Not tainted 5.15.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x49/0x148 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1d5/0x1f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc0f/0xf20 kernel/hung_task.c:295 kthread+0x3c2/0x4a0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 2922 Comm: syz-executor.0 Not tainted 5.15.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:wp_page_copy+0x2c/0x1ed0 mm/memory.c:2985 Code: 41 56 41 55 41 54 55 48 bd 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 ec f0 00 00 00 48 c7 44 24 50 b3 8a b5 41 48 8d 44 24 50 <48> c7 44 24 58 0d 6b 20 87 48 c1 e8 03 48 89 44 24 10 48 01 e8 48 RSP: 0000:ffffc900009e7bc0 EFLAGS: 00000286 RAX: ffffc900009e7c10 RBX: ffffc900009e7d88 RCX: ffffffff8128dab0 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc900009e7d88 RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff88810a953903 R10: ffffed102152a720 R11: 0000000000000000 R12: ffffea0004bd9080 R13: 0000000000000081 R14: ffffc900009e7dd0 R15: ffffc900009e7da0 FS: 0000000001e91400(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001e913bc CR3: 0000000131dc7000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_wp_page+0x282/0x14c0 mm/memory.c:3313 handle_pte_fault mm/memory.c:4576 [inline] __handle_mm_fault+0xe97/0x28a0 mm/memory.c:4693 handle_mm_fault+0x1c8/0x790 mm/memory.c:4791 do_user_addr_fault+0x48b/0x11c0 arch/x86/mm/fault.c:1390 handle_page_fault arch/x86/mm/fault.c:1475 [inline] exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1531 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568 RIP: 0033:0x420879 Code: ff ff e9 5d ff ff ff e8 65 77 04 00 0f 1f 44 00 00 b8 3e 00 00 00 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 <64> 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 RSP: 002b:00007ffcc6c7b788 EFLAGS: 00010217 RAX: 0000000000000003 RBX: 000000000000061f RCX: ffffffffffffffbc RDX: 000000000018120c RSI: 0000000000000009 RDI: 00000000fffff9e1 RBP: 00007ffcc6c7b7fc R08: 0000000000000629 R09: 00007ffcc6d78080 R10: 00007ffcc6d78090 R11: 0000000000000297 R12: 0000000000000064 R13: 000000000017b131 R14: 0000000000000000 R15: 00007ffcc6c7b860 ---------------- Code disassembly (best guess): 0: 41 56 push %r14 2: 41 55 push %r13 4: 41 54 push %r12 6: 55 push %rbp 7: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp e: fc ff df 11: 53 push %rbx 12: 48 89 fb mov %rdi,%rbx 15: 48 81 ec f0 00 00 00 sub $0xf0,%rsp 1c: 48 c7 44 24 50 b3 8a movq $0x41b58ab3,0x50(%rsp) 23: b5 41 25: 48 8d 44 24 50 lea 0x50(%rsp),%rax * 2a: 48 c7 44 24 58 0d 6b movq $0xffffffff87206b0d,0x58(%rsp) <-- trapping instruction 31: 20 87 33: 48 c1 e8 03 shr $0x3,%rax 37: 48 89 44 24 10 mov %rax,0x10(%rsp) 3c: 48 01 e8 add %rbp,%rax 3f: 48 rex.W