INFO: task syz-executor.2:9077 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:28152 pid: 9077 ppid: 6756 flags:0x00004002
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6382
__mutex_lock_common kernel/locking/mutex.c:680 [inline]
__mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
blkdev_put+0x97/0x9e0 block/bdev.c:914
blkdev_close+0x6a/0x80 block/fops.c:515
__fput+0x286/0x9f0 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xc14/0x2b40 kernel/exit.c:832
do_group_exit+0x125/0x310 kernel/exit.c:929
get_signal+0x47d/0x2220 kernel/signal.c:2830
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ffa8893b72b
RSP: 002b:00007ffa88fcfb90 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000009 RCX: 00007ffa8893b72b
RDX: 0000001b2ce2cf00 RSI: 00007ffa88712bf0 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2ce2c750
R10: 00000000000006a5 R11: 0000000000000293 R12: 00007ffa88a9cb60
R13: 00007ffa88a9cb60 R14: 00007ffa88a9bf60 R15: 0000000000311039
INFO: task syz-executor.4:9093 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:27744 pid: 9093 ppid: 7026 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
blk_mq_freeze_queue_wait+0x112/0x160 block/blk-mq.c:178
loop_change_fd drivers/block/loop.c:602 [inline]
lo_ioctl+0x1201/0x17c0 drivers/block/loop.c:1560
blkdev_ioctl+0x37a/0x800 block/ioctl.c:609
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7ff28901bae9
RSP: 002b:00007ff286591188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff28912ef60 RCX: 00007ff28901bae9
RDX: 0000000000000005 RSI: 0000000000004c06 RDI: 0000000000000004
RBP: 00007ff289075f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff289662b2f R14: 00007ff286591300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8b983b60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
1 lock held by systemd-udevd/2971:
#0: ffff88801a311118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xb50 block/bdev.c:819
1 lock held by in:imklog/6223:
2 locks held by systemd-udevd/10751:
#0: ffff88801a311118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xb50 block/bdev.c:819
#1: ffff88801a2bcb60 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_open+0x75/0x120 drivers/block/loop.c:1733
2 locks held by kworker/u4:2/26130:
#0: ffff8880b9c39a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:478
#1: ffffc9001a35fdb0 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
1 lock held by syz-executor.4/6425:
#0: ffff88801a311118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0x97/0x9e0 block/bdev.c:914
1 lock held by syz-executor.2/9077:
#0: ffff88801a311118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0x97/0x9e0 block/bdev.c:914
1 lock held by syz-executor.4/9093:
#0: ffff88801a2bcb60 (&lo->lo_mutex){+.+.}-{3:3}, at: loop_global_lock_killable drivers/block/loop.c:114 [inline]
#0: ffff88801a2bcb60 (&lo->lo_mutex){+.+.}-{3:3}, at: loop_change_fd drivers/block/loop.c:576 [inline]
#0: ffff88801a2bcb60 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_ioctl+0x5b0/0x17c0 drivers/block/loop.c:1560
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 12781 Comm: kworker/u4:0 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:memset+0x30/0x40 mm/kasan/shadow.c:48
Code: 54 49 89 d4 ba 01 00 00 00 55 48 8b 4c 24 18 4c 89 e6 48 89 fd e8 90 f7 ff ff 84 c0 74 13 4c 89 e2 44 89 ee 48 89 ef 5d 41 5c <41> 5d e9 a9 95 3b 02 5d 31 c0 41 5c 41 5d c3 90 41 55 49 89 fd 41
RSP: 0018:ffffc9000a0ff9f0 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffc9000a0ffa60 RCX: ffffffff83fa3711
RDX: 0000000000000070 RSI: 0000000000000000 RDI: ffffc9000a0ffa60
RBP: 0000000000000002 R08: 0000000000000001 R09: ffffc9000a0ffacf
R10: fffff5200141ff59 R11: 0000000000000000 R12: ffffffff81be43d5
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2191543000 CR3: 000000000b68e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
memset include/linux/fortify-string.h:209 [inline]
insn_init arch/x86/lib/insn.c:70 [inline]
insn_decode+0x2c1/0x4e0 arch/x86/lib/insn.c:743
arch_jump_entry_size+0xa0/0x110 arch/x86/kernel/jump_label.c:24
__jump_label_patch+0x7c/0x1b0 arch/x86/kernel/jump_label.c:45
arch_jump_label_transform_queue+0x63/0x100 arch/x86/kernel/jump_label.c:137
__jump_label_update+0x12e/0x400 kernel/jump_label.c:451
jump_label_update+0x1d5/0x430 kernel/jump_label.c:830
static_key_disable_cpuslocked+0x152/0x1b0 kernel/jump_label.c:207
static_key_disable+0x16/0x20 kernel/jump_label.c:215
toggle_allocation_gate mm/kfence/core.c:746 [inline]
toggle_allocation_gate+0x183/0x390 mm/kfence/core.c:724
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 54 push %rsp
1: 49 89 d4 mov %rdx,%r12
4: ba 01 00 00 00 mov $0x1,%edx
9: 55 push %rbp
a: 48 8b 4c 24 18 mov 0x18(%rsp),%rcx
f: 4c 89 e6 mov %r12,%rsi
12: 48 89 fd mov %rdi,%rbp
15: e8 90 f7 ff ff callq 0xfffff7aa
1a: 84 c0 test %al,%al
1c: 74 13 je 0x31
1e: 4c 89 e2 mov %r12,%rdx
21: 44 89 ee mov %r13d,%esi
24: 48 89 ef mov %rbp,%rdi
27: 5d pop %rbp
28: 41 5c pop %r12
* 2a: 41 5d pop %r13 <-- trapping instruction
2c: e9 a9 95 3b 02 jmpq 0x23b95da
31: 5d pop %rbp
32: 31 c0 xor %eax,%eax
34: 41 5c pop %r12
36: 41 5d pop %r13
38: c3 retq
39: 90 nop
3a: 41 55 push %r13
3c: 49 89 fd mov %rdi,%r13
3f: 41 rex.B