INFO: task syz-executor.2:23720 blocked for more than 143 seconds.
Not tainted 5.16.0-rc1-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:29592 pid:23720 ppid: 6652 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6385
__mutex_lock_common kernel/locking/mutex.c:680 [inline]
__mutex_lock+0xa32/0x12f0 kernel/locking/mutex.c:740
io_init_wq_offload fs/io_uring.c:8575 [inline]
io_uring_alloc_task_context+0xf9/0x517 fs/io_uring.c:8616
__io_uring_add_tctx_node.cold+0x19/0x188 fs/io_uring.c:9681
io_uring_add_tctx_node fs/io_uring.c:9726 [inline]
__do_sys_io_uring_enter+0x19db/0x1f50 fs/io_uring.c:10035
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f2ff42b1ae9
RSP: 002b:00007f2ff1806188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 00007f2ff43c5020 RCX: 00007f2ff42b1ae9
RDX: 0000000000000000 RSI: 00000000000000b4 RDI: 0000000000000003
RBP: 00007f2ff430bf6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2ff48f8b2f R14: 00007f2ff1806300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8bb83a60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
3 locks held by kworker/u4:3/90:
1 lock held by in:imklog/6214:
#0: ffff8880724d00f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
5 locks held by syz-executor.2/23716:
1 lock held by syz-executor.2/23720:
#0: ffff888076ff30a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_init_wq_offload fs/io_uring.c:8575 [inline]
#0: ffff888076ff30a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_uring_alloc_task_context+0xf9/0x517 fs/io_uring.c:8616
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7882 Comm: kworker/1:6 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:rol32 include/linux/bitops.h:109 [inline]
RIP: 0010:chacha_permute+0x498/0x6e0 lib/crypto/chacha.c:35
Code: 44 31 d2 01 f0 44 31 f9 c1 c2 0c 31 c7 89 44 24 0c c1 c1 0c 41 31 dd 89 f8 8b 7c 24 08 41 01 c8 41 c1 c5 08 45 31 c4 c1 c0 0c <41> c1 c4 08 01 d7 31 fd 41 01 c3 45 01 e7 c1 c5 08 44 31 de 44 31
RSP: 0018:ffffc9000aea79c0 EFLAGS: 00000083
RAX: 00000000f40fb50b RBX: 00000000c010667b RCX: 000000002e0af667
RDX: 00000000a78e49e4 RSI: 000000004a931aeb RDI: 00000000d3a369bb
RBP: 00000000b6c9bbdf R08: 00000000ef31afe2 R09: 00000000f201bc0b
R10: 0000000011a0bdf8 R11: 00000000a6508db2 R12: 00000000eae8f8b3
R13: 000000006744ee2a R14: 00000000c10ca8ee R15: 000000006b6df44c
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00dd6a528 CR3: 000000007c35c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
chacha_block_generic+0x98/0x250 lib/crypto/chacha.c:83
chacha20_block include/crypto/chacha.h:36 [inline]
_extract_crng+0x12f/0x250 drivers/char/random.c:1000
extract_crng drivers/char/random.c:1016 [inline]
_get_random_bytes+0x229/0x670 drivers/char/random.c:1538
eth_random_addr include/linux/etherdevice.h:232 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:752 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:802 [inline]
nsim_dev_trap_report_work+0x33a/0xbc0 drivers/net/netdevsim/dev.c:843
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 44 31 d2 xor %r10d,%edx
3: 01 f0 add %esi,%eax
5: 44 31 f9 xor %r15d,%ecx
8: c1 c2 0c rol $0xc,%edx
b: 31 c7 xor %eax,%edi
d: 89 44 24 0c mov %eax,0xc(%rsp)
11: c1 c1 0c rol $0xc,%ecx
14: 41 31 dd xor %ebx,%r13d
17: 89 f8 mov %edi,%eax
19: 8b 7c 24 08 mov 0x8(%rsp),%edi
1d: 41 01 c8 add %ecx,%r8d
20: 41 c1 c5 08 rol $0x8,%r13d
24: 45 31 c4 xor %r8d,%r12d
27: c1 c0 0c rol $0xc,%eax
* 2a: 41 c1 c4 08 rol $0x8,%r12d <-- trapping instruction
2e: 01 d7 add %edx,%edi
30: 31 fd xor %edi,%ebp
32: 41 01 c3 add %eax,%r11d
35: 45 01 e7 add %r12d,%r15d
38: c1 c5 08 rol $0x8,%ebp
3b: 44 31 de xor %r11d,%esi
3e: 44 rex.R
3f: 31 .byte 0x31