INFO: task kworker/u4:14:21398 blocked for more than 143 seconds.
Not tainted 5.16.0-rc1-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:14 state:D stack:20888 pid:21398 ppid: 2 flags:0x00004000
Workqueue: nbd-del nbd_dev_remove_work
Call Trace:
context_switch kernel/sched/core.c:4972 [inline]
__schedule+0xb72/0x1460 kernel/sched/core.c:6253
schedule+0x12b/0x1f0 kernel/sched/core.c:6326
blk_mq_freeze_queue_wait+0x105/0x190 block/blk-mq.c:178
del_gendisk+0x6d0/0x790 block/genhd.c:623
nbd_dev_remove drivers/block/nbd.c:252 [inline]
nbd_dev_remove_work+0x47/0xe0 drivers/block/nbd.c:269
process_one_work+0x853/0x1140 kernel/workqueue.c:2298
worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8cd1dc00 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
1 lock held by in:imklog/6192:
2 locks held by rs:main Q:Reg/6193:
2 locks held by kworker/1:8/14113:
#0: ffff888011866538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7ca/0x1140
#1: ffffc9000445fd20 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x808/0x1140 kernel/workqueue.c:2273
2 locks held by kworker/u4:14/21398:
#0: ffff8881470f8138 ((wq_completion)nbd-del){+.+.}-{0:0}, at: process_one_work+0x7ca/0x1140
#1: ffffc90002dcfd20 ((work_completion)(&nbd->remove_work)){+.+.}-{0:0}, at: process_one_work+0x808/0x1140 kernel/workqueue.c:2273
2 locks held by syz-executor.4/24859:
#0: ffff88807a9c00e0 (&type->s_umount_key#61){+.+.}-{3:3}, at: deactivate_super+0x96/0xd0 fs/super.c:365
#1: ffffffff8cd22468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
#1: ffffffff8cd22468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x277/0x740 kernel/rcu/tree_exp.h:836
5 locks held by syz-executor.0/5299:
3 locks held by syz-executor.1/5297:
1 lock held by syz-executor.1/5338:
2 locks held by syz-executor.3/5319:
2 locks held by syz-executor.2/5333:
#0: ffff8880129a4120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1645 [inline]
#0: ffff8880129a4120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2a/0xce0 net/packet/af_packet.c:3173
#1: ffffffff8cd22468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
#1: ffffffff8cd22468 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x356/0x740 kernel/rcu/tree_exp.h:836
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc82/0xcd0 kernel/hung_task.c:295
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 9451 Comm: kworker/u4:6 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy61 ieee80211_iface_work
RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:49 [inline]
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:173 [inline]
RIP: 0010:unwind_next_frame+0x532/0x1fc0 arch/x86/kernel/unwind_orc.c:443
Code: 00 00 fc ff df 0f b6 04 08 84 c0 75 27 48 63 03 48 01 d8 48 8d 4b 04 4c 39 e0 4c 0f 46 f9 48 8d 43 fc 4c 0f 47 e8 48 0f 46 eb <4d> 39 ef 76 a9 e9 2d fd ff ff 89 d9 80 e1 07 80 c1 03 38 c1 7c cd
RSP: 0018:ffffc9000556f2f8 EFLAGS: 00000293
RAX: ffffffff8e2b7d2c RBX: ffffffff8e2b7d30 RCX: ffffffff8e2b7d34
RDX: ffffffff8e943100 RSI: 0000000000000001 RDI: ffffffff813aa429
RBP: ffffffff8e2b7d30 R08: 0000000000000005 R09: ffffc9000556f470
R10: fffff52000aade90 R11: 0000000000000000 R12: ffffffff8131cdeb
R13: ffffffff8e2b7d30 R14: ffffffff8e2b7d20 R15: ffffffff8e2b7d34
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff3a1e71010 CR3: 000000007a776000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__unwind_start+0x60b/0x750 arch/x86/kernel/unwind_orc.c:712
unwind_start arch/x86/include/asm/unwind.h:64 [inline]
arch_stack_walk+0xdc/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:513
kasan_kmalloc include/linux/kasan.h:269 [inline]
__kmalloc+0x253/0x380 mm/slub.c:4423
kmalloc include/linux/slab.h:595 [inline]
ieee802_11_parse_elems_crc+0x132/0x1040 net/mac80211/util.c:1477
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2208 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1605 [inline]
ieee80211_ibss_rx_queued_mgmt+0x389/0x2b30 net/mac80211/ibss.c:1639
ieee80211_iface_process_skb net/mac80211/iface.c:1466 [inline]
ieee80211_iface_work+0x709/0xc90 net/mac80211/iface.c:1520
process_one_work+0x853/0x1140 kernel/workqueue.c:2298
worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
kthread+0x468/0x490 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
----------------
Code disassembly (best guess), 4 bytes skipped:
0: df 0f fisttps (%rdi)
2: b6 04 mov $0x4,%dh
4: 08 84 c0 75 27 48 63 or %al,0x63482775(%rax,%rax,8)
b: 03 48 01 add 0x1(%rax),%ecx
e: d8 48 8d fmuls -0x73(%rax)
11: 4b 04 4c rex.WXB add $0x4c,%al
14: 39 e0 cmp %esp,%eax
16: 4c 0f 46 f9 cmovbe %rcx,%r15
1a: 48 8d 43 fc lea -0x4(%rbx),%rax
1e: 4c 0f 47 e8 cmova %rax,%r13
22: 48 0f 46 eb cmovbe %rbx,%rbp
* 26: 4d 39 ef cmp %r13,%r15 <-- trapping instruction
29: 76 a9 jbe 0xffffffd4
2b: e9 2d fd ff ff jmpq 0xfffffd5d
30: 89 d9 mov %ebx,%ecx
32: 80 e1 07 and $0x7,%cl
35: 80 c1 03 add $0x3,%cl
38: 38 c1 cmp %al,%cl
3a: 7c cd jl 0x9