INFO: task syz-executor.4:23578 blocked for more than 143 seconds.
Not tainted 5.17.0-rc1-syzkaller-00339-g169387e2aa29 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:28240 pid:23578 ppid: 31150 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xab2/0x4db0 kernel/sched/core.c:6295
schedule+0xd2/0x260 kernel/sched/core.c:6368
schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x174/0x270 kernel/sched/completion.c:138
__synchronize_srcu+0x1f2/0x290 kernel/rcu/srcutree.c:930
kvm_io_bus_register_dev+0x444/0x6b0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:5156
kvm_vm_ioctl_register_coalesced_mmio+0x202/0x430 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:156
kvm_vm_ioctl+0xfab/0x22c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4522
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7345a1b059
RSP: 002b:00007f734434e168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7345b2e100 RCX: 00007f7345a1b059
RDX: 0000000020000200 RSI: 000000004010ae67 RDI: 0000000000000004
RBP: 00007f7345a7508d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7346061b1f R14: 00007f734434e300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8bb83c20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6460
2 locks held by getty/3279:
#0: ffff88814ac81098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:244
#1: ffffc90002b632e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xcf0/0x1230 drivers/tty/n_tty.c:2077
5 locks held by kworker/0:6/3685:
#0: ffff8880b9c39c58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:489
#1: ffff8880b9c27948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x3e7/0x4e0 kernel/sched/psi.c:891
#2: ffffffff906b1bf0 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_check_no_obj_freed lib/debugobjects.c:980 [inline]
#2: ffffffff906b1bf0 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_check_no_obj_freed+0xc7/0x420 lib/debugobjects.c:1023
#3: ffff8880b9c28498 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x5a/0x1f0 kernel/time/timer.c:946
#4: ffffffff906e7848 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x12e/0x3e0 lib/debugobjects.c:661
3 locks held by kworker/u4:48/16039:
#0: ffff8880b9d39c58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:489
#1: ffff8880b9d27948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x3e7/0x4e0 kernel/sched/psi.c:891
#2: ffff8880b9d28498 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x5a/0x1f0 kernel/time/timer.c:946
2 locks held by kworker/u4:63/16054:
2 locks held by syz-executor.4/23570:
1 lock held by syz-executor.4/23578:
#0: ffffc90010e690a8 (&kvm->slots_lock){+.+.}-{3:3}, at: kvm_vm_ioctl_register_coalesced_mmio+0x15f/0x430 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:155
3 locks held by kworker/1:8/23631:
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.17.0-rc1-syzkaller-00339-g169387e2aa29 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:369
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 23570 Comm: syz-executor.4 Not tainted 5.17.0-rc1-syzkaller-00339-g169387e2aa29 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:lock_release+0x3d3/0x720 kernel/locking/lockdep.c:5662
Code: 0f 85 29 02 00 00 48 c7 c7 a0 5f ac 89 e8 65 d0 f0 07 b8 ff ff ff ff 65 0f c1 05 b8 22 a5 7e 83 f8 01 0f 85 8d 01 00 00 9c 58 c4 02 0f 85 78 01 00 00 48 f7 04 24 00 02 00 00 74 01 fb 48 b8
RSP: 0018:ffffc90010e66fe0 EFLAGS: 00000046
RAX: 0000000000000046 RBX: d6a498ac70d6790f RCX: ffffc90010e67030
RDX: 1ffff1100387a14a RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff920021ccdfe R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000003 R14: ffff88801c3d0a58 R15: ffff88801c3d0000
FS: 00007f7344390700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f24a082c680 CR3: 000000006c31f000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
internal_get_user_pages_fast+0xbd2/0x2510 mm/gup.c:2859
get_user_pages_fast+0x66/0xa0 mm/gup.c:2967
ept_cmpxchg_gpte.constprop.0+0x85/0x580 arch/x86/kvm/mmu/paging_tmpl.h:155
paging64_update_accessed_dirty_bits arch/x86/kvm/mmu/paging_tmpl.h:287 [inline]
paging64_walk_addr_generic+0x10f5/0x1a10 arch/x86/kvm/mmu/paging_tmpl.h:487
paging64_gva_to_gpa+0xa9/0x1c0 arch/x86/kvm/mmu/paging_tmpl.h:1005
kvm_mmu_gva_to_gpa_write arch/x86/kvm/x86.c:6708 [inline]
emulator_cmpxchg_emulated+0x1fe/0x700 arch/x86/kvm/x86.c:7186
__load_segment_descriptor+0xb7c/0x1060 arch/x86/kvm/emulate.c:1657
x86_emulate_insn+0x5e4/0x39c0 arch/x86/kvm/emulate.c:5544
x86_emulate_instruction+0xb2f/0x15c0 arch/x86/kvm/x86.c:8360
kvm_mmu_page_fault+0x3e9/0x1950 arch/x86/kvm/mmu/mmu.c:5347
handle_ept_violation+0x29d/0x6f0 arch/x86/kvm/vmx/vmx.c:5422
__vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6164 [inline]
vmx_handle_exit+0x498/0x1950 arch/x86/kvm/vmx/vmx.c:6181
vcpu_enter_guest+0x295f/0x4370 arch/x86/kvm/x86.c:10157
vcpu_run arch/x86/kvm/x86.c:10239 [inline]
kvm_arch_vcpu_ioctl_run+0x521/0x21a0 arch/x86/kvm/x86.c:10445
kvm_vcpu_ioctl+0x570/0xf30 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3908
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7345a1b059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7344390168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7345b2df60 RCX: 00007f7345a1b059
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007f7345a7508d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7346061b1f R14: 00007f7344390300 R15: 0000000000022000
----------------
Code disassembly (best guess):
0: 0f 85 29 02 00 00 jne 0x22f
6: 48 c7 c7 a0 5f ac 89 mov $0xffffffff89ac5fa0,%rdi
d: e8 65 d0 f0 07 callq 0x7f0d077
12: b8 ff ff ff ff mov $0xffffffff,%eax
17: 65 0f c1 05 b8 22 a5 xadd %eax,%gs:0x7ea522b8(%rip) # 0x7ea522d7
1e: 7e
1f: 83 f8 01 cmp $0x1,%eax
22: 0f 85 8d 01 00 00 jne 0x1b5
28: 9c pushfq
29: 58 pop %rax
* 2a: f6 c4 02 test $0x2,%ah <-- trapping instruction
2d: 0f 85 78 01 00 00 jne 0x1ab
33: 48 f7 04 24 00 02 00 testq $0x200,(%rsp)
3a: 00
3b: 74 01 je 0x3e
3d: fb sti
3e: 48 rex.W
3f: b8 .byte 0xb8