INFO: task syz-executor.3:24877 blocked for more than 140 seconds. Not tainted 4.9.141+ #23 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D29608 24877 31384 0x20020000 ffff880169444740 ffff8800b418d800 ffff8800b805e300 ffff8801abb6af80 ffff8801db621018 ffff8800b19cfb50 ffffffff828075c2 ffff880000000001 ffffffff00000000 fffffbfff08489a8 00b3a93a00000001 ffff8801db6218f0 Call Trace: [] schedule+0x7f/0x1b0 kernel/sched/core.c:3553 [] schedule_timeout+0x735/0xe20 kernel/time/timer.c:1771 [] down_read_failed drivers/tty/tty_ldsem.c:241 [inline] [] __ldsem_down_read_nested+0x33c/0x610 drivers/tty/tty_ldsem.c:332 [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 [] tty_ldisc_ref_wait+0x25/0x80 drivers/tty/tty_ldisc.c:275 [] tty_compat_ioctl+0x12d/0x270 drivers/tty/tty_io.c:3039 [] C_SYSC_ioctl fs/compat_ioctl.c:1602 [inline] [] compat_SyS_ioctl+0x12d/0x1fd0 fs/compat_ioctl.c:1549 [] do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline] [] do_fast_syscall_32+0x2f1/0xa10 arch/x86/entry/common.c:390 [] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 Showing all locks held in the system: 2 locks held by khungtaskd/24: #0: (rcu_read_lock){......}, at: [] rcu_read_unlock include/linux/rcupdate.h:927 [inline] #0: (rcu_read_lock){......}, at: [] rcu_lock_break kernel/hung_task.c:143 [inline] #0: (rcu_read_lock){......}, at: [] check_hung_uninterruptible_tasks kernel/hung_task.c:177 [inline] #0: (rcu_read_lock){......}, at: [] watchdog+0x310/0xa20 kernel/hung_task.c:239 #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336 2 locks held by getty/2025: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 #1: (&ldata->atomic_read_lock){+.+.+.}, at: [] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142 2 locks held by syz-executor.3/24873: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 #1: (&ldata->atomic_read_lock){+.+.+.}, at: [] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142 1 lock held by syz-executor.3/24877: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 3 locks held by kworker/u4:16/26814: #0: ("%s""netns"){.+.+.+}, at: [] process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085 #1: (net_cleanup_work){+.+.+.}, at: [] process_one_work+0x774/0x15f0 kernel/workqueue.c:2089 #2: (net_mutex){+.+.+.}, at: [] cleanup_net+0x13f/0x8b0 net/core/net_namespace.c:439 1 lock held by syz-executor.0/29234: #0: (net_mutex){+.+.+.}, at: [] copy_net_ns+0x155/0x330 net/core/net_namespace.c:406 ============================================= audit_printk_skb: 1173 callbacks suppressed audit: type=1400 audit(1569537087.828:12355): avc: denied { sys_admin } for pid=2095 comm="syz-executor.5" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.878:12356): avc: denied { sys_admin } for pid=29247 comm="syz-executor.3" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.888:12357): avc: denied { net_admin } for pid=29248 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.888:12358): avc: denied { net_admin } for pid=29248 comm="syz-executor.1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.918:12359): avc: denied { dac_override } for pid=29248 comm="syz-executor.1" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.938:12360): avc: denied { sys_admin } for pid=2097 comm="syz-executor.4" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.938:12361): avc: denied { net_admin } for pid=2097 comm="syz-executor.4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.938:12362): avc: denied { net_admin } for pid=2097 comm="syz-executor.4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.938:12363): avc: denied { net_admin } for pid=2097 comm="syz-executor.4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1569537087.938:12364): avc: denied { net_admin } for pid=2097 comm="syz-executor.4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 tmpfs: No value for mount option '_4/Xnzزq6In)ԾGrW|v[öI8zK̟ \|a22KLDTֹN goካ&ۆ' NMI backtrace for cpu 1 CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #23 ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40 ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000003 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99 [] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60 [] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [] check_hung_task kernel/hung_task.c:125 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [] watchdog+0x6ad/0xa20 kernel/hung_task.c:239 [] kthread+0x26d/0x300 kernel/kthread.c:211 [] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 2094 Comm: syz-executor.0 Not tainted 4.9.141+ #23 task: ffff8801cea04740 task.stack: ffff8801ac6d0000 RIP: 0010:[] c [] __read_once_size include/linux/compiler.h:243 [inline] RIP: 0010:[] c [] task_has_perm+0x112/0x330 security/selinux/hooks.c:1613 RSP: 0018:ffff8801ac6d79b8 EFLAGS: 00000246 RAX: 0000000000000007 RBX: 0000000000000004 RCX: ffffed0039d409fd RDX: 0000000000000000 RSI: ffffffff819f7de2 RDI: ffff8801cea04e30 RBP: ffff8801ac6d79d8 R08: ffff8801cea04ff0 R09: d8a1064c1ba25689 R10: ffff8801cea04740 R11: 0000000000000001 R12: 00000000000000cf R13: ffff8801cea04740 R14: ffff8801ac6d7c9c R15: ffff8801ac6d7c98 FS: 0000000000000000(0000) GS:ffff8801db600000(0063) knlGS:000000000953c900 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002e221000 CR3: 00000001ac52b000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff819f7d30c ffff8801d3328000c dffffc0000000000c ffff8801d3328000c ffff8801ac6d79f0c ffffffff819f8083c ffffffff831cc760c ffff8801ac6d7a20c ffffffff819e6e73c 00000000ac6d7bc0c 0000000040000005c 0000000000000000c Call Trace: [] selinux_task_wait+0x23/0x30 security/selinux/hooks.c:3954 [] security_task_wait+0x73/0xb0 security/security.c:1032 [] wait_consider_task+0x2a1/0x3620 kernel/exit.c:1377 [] do_wait_thread kernel/exit.c:1490 [inline] [] do_wait+0x423/0x950 kernel/exit.c:1561 [] SYSC_wait4 kernel/exit.c:1693 [inline] [] SyS_wait4+0x12b/0x1f0 kernel/exit.c:1658 [] C_SYSC_wait4 kernel/compat.c:543 [inline] [] compat_SyS_wait4+0x254/0x290 kernel/compat.c:536 [] sys32_waitpid+0x25/0x30 arch/x86/ia32/sys_ia32.c:172 [] do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline] [] do_fast_syscall_32+0x2f1/0xa10 arch/x86/entry/common.c:390 [] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 Code: c89 cfa c48 cc1 cea c03 c0f cb6 c14 c02 c48 c89 cf8 c83 ce0 c07 c83 cc0 c03 c38 cd0 c7c c08 c84 cd2 c0f c85 cf0 c01 c00 c00 c49 c8d cbd cf0 c06 c00 c00 c45 c8b c64 c24 c04 c<48> cb8 c00 c00 c00 c00 c00 cfc cff cdf c48 c89 cfa c48 cc1 cea c03 c80 c3c c02 c00 c