INFO: task syz-executor.4:18779 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27184 18779 8122 0x00000004 Cannot find del_set index 0 as target Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 schedule_timeout+0x92d/0xfe0 kernel/time/timer.c:1794 IPVS: sync thread started: state = MASTER, mcast_ifn = macvlan1, syncid = 3, id = 0 Cannot find del_set index 0 as target do_wait_for_common kernel/sched/completion.c:83 [inline] __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common+0x29c/0x470 kernel/sched/completion.c:115 usb_start_wait_urb+0x14b/0x4c0 drivers/usb/core/message.c:62 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:253 proc_bulk+0x3de/0x860 drivers/usb/core/devio.c:1211 usbdev_do_ioctl+0x696/0x3030 drivers/usb/core/devio.c:2435 MTD: Attempt to mount non-MTD device "/dev/loop2" romfs: Mounting image 'rom 5f663c08' through the block layer Cannot find del_set index 0 as target usbdev_ioctl+0x21/0x30 drivers/usb/core/devio.c:2585 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f76ba8c15f9 Code: Bad RIP value. RSP: 002b:00007f76b9234168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f76ba9e1f80 RCX: 00007f76ba8c15f9 RDX: 0000000020000180 RSI: 00000000c0185502 RDI: 0000000000000003 RBP: 00007f76ba91c7b0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd2e7e9b3f R14: 00007f76b9234300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1569: #0: 00000000e1cbc232 (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441 3 locks held by kworker/u4:3/2886: 1 lock held by in:imklog/7791: #0: 00000000a87135f4 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767 2 locks held by kworker/u4:14/16303: 1 lock held by syz-executor.3/26643: #0: 00000000d4244529 (rtnl_mutex){+.+.}, at: wext_ioctl_dispatch net/wireless/wext-core.c:987 [inline] #0: 00000000d4244529 (rtnl_mutex){+.+.}, at: wext_ioctl_dispatch net/wireless/wext-core.c:976 [inline] #0: 00000000d4244529 (rtnl_mutex){+.+.}, at: wext_handle_ioctl+0x248/0x280 net/wireless/wext-core.c:1049 2 locks held by syz-executor.0/26649: #0: 00000000d4244529 (rtnl_mutex){+.+.}, at: ip_mroute_setsockopt+0xab/0xe60 net/ipv4/ipmr.c:1384 #1: 00000000400fa49a (rcu_preempt_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline] #1: 00000000400fa49a (rcu_preempt_state.exp_mutex){+.+.}, at: _synchronize_rcu_expedited+0x256/0x6f0 kernel/rcu/tree_exp.h:667 5 locks held by syz-executor.2/26680: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1569 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x991/0xe60 kernel/hung_task.c:287 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 26680 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 RIP: 0010:apic_timer_interrupt+0x0/0x20 arch/x86/entry/entry_64.S:894 Code: 31 ff fc e8 b8 28 e0 f8 48 89 e7 e8 0a 68 e0 f8 e8 8f 28 e0 f8 e9 85 f5 ff ff c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <68> 13 ff ff ff e8 46 f4 ff ff e8 01 2a 00 00 e9 2b f5 ff ff 66 66 RSP: 0000:fffffe0000033fd8 EFLAGS: 00000046 RAX: 0000000000000002 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000008 RSI: 00007fc3335921f0 RDI: 00007fc33359214c RBP: 00007fc333592160 R08: 0000000000000000 R09: 0000000000000000 R10: 001c81a4e694d439 R11: 0000000000000001 R12: 00007ffcc0d25080 R13: 00000000000150cc R14: 00007fc333592300 R15: 0000000000022000 FS: 00007fc333592700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a0ebf608b8 CR3: 00000000b529b000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: RIP: 0033:0x7ffcc0d28936 Code: 00 00 00 00 0f ae e8 0f 31 48 c1 e2 20 48 09 d0 48 8b 15 65 c7 ff ff 48 39 c2 77 01 c3 48 89 d0 c3 0f 1f 00 8b 15 ca d6 ff ff <4c> 8d 05 c3 d6 ff ff 89 d6 83 e6 fe f6 05 d4 d6 ff ff 01 74 61 0f RSP: 002b:00007fc333592138 EFLAGS: 00000246