INFO: task syz-executor.0:7955 blocked for more than 143 seconds. Not tainted 5.4.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28072 7955 7872 0x00004004 Call Trace: context_switch kernel/sched/core.c:3385 [inline] __schedule+0x8e1/0x1f30 kernel/sched/core.c:4081 schedule+0xdc/0x2b0 kernel/sched/core.c:4155 schedule_timeout+0x717/0xc50 kernel/time/timer.c:1871 do_wait_for_common kernel/sched/completion.c:83 [inline] __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common kernel/sched/completion.c:115 [inline] wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136 __wait_rcu_gp+0x225/0x2f0 kernel/rcu/update.c:374 synchronize_rcu.part.0+0xcf/0xe0 kernel/rcu/tree.c:2768 synchronize_rcu+0x27/0xa0 kernel/rcu/tree.c:2769 tracepoint_synchronize_unregister include/linux/tracepoint.h:83 [inline] perf_trace_event_unreg.isra.0+0xcb/0x220 kernel/trace/trace_event_perf.c:168 perf_trace_destroy+0xbc/0x100 kernel/trace/trace_event_perf.c:243 tp_perf_event_destroy+0x16/0x20 kernel/events/core.c:8995 _free_event+0x35c/0x1410 kernel/events/core.c:4615 put_event+0x47/0x60 kernel/events/core.c:4709 perf_event_release_kernel+0x772/0xef0 kernel/events/core.c:4824 perf_release+0x37/0x50 kernel/events/core.c:4834 __fput+0x2ff/0x890 fs/file_table.c:280 ____fput+0x16/0x20 fs/file_table.c:313 task_work_run+0x145/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x316/0x380 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x676/0x790 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413d81 Code: 89 44 24 10 e8 40 c1 04 00 48 8b 6c 24 18 48 83 c4 20 c3 48 8b 4c 24 30 48 89 0c 24 48 8b 4c 24 38 48 89 4c 24 08 48 89 44 24 <10> e8 99 0c 00 00 48 8b 44 24 40 eb b5 48 8b 44 24 40 eb ae 48 8b RSP: 002b:00007ffcbd8ad910 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413d81 RDX: 0000001b2fb20000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000071c980 R08: ffffffff8133dbdf R09: 000000006ccbe139 R10: 00007ffcbd8ada40 R11: 0000000000000293 R12: 0000000000000001 R13: 0000000000721320 R14: 0000000000721328 R15: 00007ffcbd8ada20 Showing all locks held in the system: 1 lock held by khungtaskd/1103: #0: ffffffff891a4080 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 kernel/locking/lockdep.c:5334 2 locks held by getty/7816: #0: ffff8880203a4090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc9000400a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 2 locks held by getty/7817: #0: ffff888029a5e090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc900040022e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 2 locks held by getty/7818: #0: ffff88802bef7090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc9000401a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 2 locks held by getty/7819: #0: ffff88802a731090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc900040222e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 2 locks held by getty/7820: #0: ffff8880254cc090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc900040162e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 2 locks held by getty/7821: #0: ffff88802b2ad090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc9000401e2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 2 locks held by getty/7822: #0: ffff88802af57090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:340 #1: ffffc900026f22e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10 drivers/tty/n_tty.c:2156 1 lock held by syz-executor.1/7945: 1 lock held by syz-executor.0/7955: #0: ffffffff891e8e40 (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:241 ============================================= NMI backtrace for cpu 2 CPU: 2 PID: 1103 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x70/0xb2 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x23b/0x28b lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xb11/0x10c0 kernel/hung_task.c:289 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 2 to CPUs 0-1,3: NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 NMI backtrace for cpu 3 CPU: 3 PID: 7885 Comm: kworker/u16:3 Not tainted 5.4.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Workqueue: bat_events batadv_nc_worker RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0x6/0xb0 kernel/rcu/tree.c:298 Code: 00 00 00 00 55 48 89 e5 e8 97 ac ff ff 65 48 8b 3c 25 c0 1e 02 00 e8 39 bd ff ff 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 41 54 <53> 48 c7 c3 40 81 03 00 48 83 ec 08 e8 e9 ba f0 01 48 ba 00 00 00 RSP: 0018:ffff88806de87cb8 EFLAGS: 00000283 RAX: ffff888029c90000 RBX: ffff8880292bfc00 RCX: ffffffff875ed2f5 RDX: 0000000000000000 RSI: ffffffff875ed673 RDI: 0000000000000001 RBP: ffff88806de87cc0 R08: ffff888029c90000 R09: fffffbfff153779d R10: ffff888029c908e8 R11: ffff888029c90000 R12: 0000000000000000 R13: 000000000000018e R14: ffff8880292dcc70 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff88802d500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 0000000026a8a000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:922 rcu_read_lock include/linux/rcupdate.h:618 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:407 [inline] batadv_nc_worker+0x4c8/0x760 net/batman-adv/network-coding.c:718 process_one_work+0x9af/0x1740 kernel/workqueue.c:2264 worker_thread+0x98/0xe40 kernel/workqueue.c:2410 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 NMI backtrace for cpu 0 CPU: 0 PID: 7945 Comm: syz-executor.1 Not tainted 5.4.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:preempt_schedule_irq+0xab/0x160 kernel/sched/core.c:4338 Code: 00 00 e8 d8 d8 d4 f9 e8 43 b5 fe f9 4c 89 f0 48 c1 e8 03 80 3c 18 00 75 7d 48 83 3d 96 81 97 01 00 74 6f fb 66 0f 1f 44 00 00 01 00 00 00 e8 0b d2 ff ff 48 c7 c0 60 34 13 89 48 c1 e8 03 80 RSP: 0018:ffff88806da3f588 EFLAGS: 00000286 RAX: 1ffffffff122668d RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff88800bc04c14 RBP: ffff88806da3f5a8 R08: ffff88800bc04380 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffed1001780870 R13: ffff88800bc04380 R14: ffffffff89133468 R15: 0000000000000000 FS: 00007fceb7778700(0000) GS:ffff88802d200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000000906d000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: retint_kernel+0x1b/0x2b RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline] RIP: 0010:compound_head include/linux/page-flags.h:174 [inline] RIP: 0010:PageSwapBacked include/linux/page-flags.h:340 [inline] RIP: 0010:PageSwapCache include/linux/page-flags.h:385 [inline] RIP: 0010:free_swap_cache mm/swap_state.c:267 [inline] RIP: 0010:free_pages_and_swap_cache+0x147/0x3f0 mm/swap_state.c:295 Code: 3c 18 00 0f 85 8d 02 00 00 4d 8b 36 48 c7 c7 ff ff ff ff 4c 89 f6 e8 f8 e9 c9 ff 49 83 fe ff 0f 84 90 01 00 00 e8 49 e8 c9 ff <48> 8b 45 c8 48 c1 e8 03 80 3c 18 00 0f 85 4c 02 00 00 49 8b 44 24 RSP: 0018:ffff88806da3f668 EFLAGS: 00010293 ORIG_RAX: ffffffffffffff13 RAX: ffff88800bc04380 RBX: dffffc0000000000 RCX: ffffffff81aaf5c8 RDX: 0000000000000000 RSI: ffffffff81aaf5d7 RDI: 0000000000000007 RBP: ffff88806da3f6c8 R08: ffff88800bc04380 R09: fffff94000069ca9 R10: fffff94000069ca8 R11: ffffea000034e547 R12: ffffea000034e580 R13: ffffea000034e580 R14: 00fffe0000000008 R15: 000000000000002a tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:184 [inline] tlb_flush_mmu+0x89/0x630 mm/mmu_gather.c:191 zap_pte_range mm/memory.c:1140 [inline] zap_pmd_range mm/memory.c:1178 [inline] zap_pud_range mm/memory.c:1207 [inline] zap_p4d_range mm/memory.c:1228 [inline] unmap_page_range+0x1c61/0x2ac0 mm/memory.c:1249 unmap_single_vma+0x19d/0x300 mm/memory.c:1294 unmap_vmas+0x184/0x2f0 mm/memory.c:1326 exit_mmap+0x2ba/0x530 mm/mmap.c:3161 __mmput kernel/fork.c:1079 [inline] mmput+0x179/0x4d0 kernel/fork.c:1100 exit_mm kernel/exit.c:485 [inline] do_exit+0x806/0x2ef0 kernel/exit.c:784 do_group_exit+0x135/0x360 kernel/exit.c:895 get_signal+0x47c/0x24f0 kernel/signal.c:2734 do_signal+0x87/0x1700 arch/x86/kernel/signal.c:815 exit_to_usermode_loop+0x286/0x380 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x676/0x790 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a759 Code: Bad RIP value. RSP: 002b:00007fceb7777c88 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: 0000000000000007 RBX: 000000000071c0f8 RCX: 000000000045a759 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002001d000 RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fceb77786d4 R13: 00000000004aec17 R14: 00000000006f1cb0 R15: 00000000ffffffff