ieee802154 phy1 wpan1: encryption failed: -22 Bluetooth: hci1: command 0x0406 tx timeout ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 Bluetooth: hci2: command 0x0406 tx timeout INFO: task syz-executor.4:13787 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29728 13787 13481 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x5f0/0x1190 kernel/locking/mutex.c:1078 blk_trace_startstop+0x21/0x40 kernel/trace/blktrace.c:714 sg_ioctl+0x201d/0x2720 drivers/scsi/sg.c:1126 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc89b1df0e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc899b33168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc89b2f2030 RCX: 00007fc89b1df0e9 RDX: 0000000000000000 RSI: 0000000000001274 RDI: 0000000000000004 RBP: 00007fc89b23908d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffee69affcf R14: 00007fc899b33300 R15: 0000000000022000 INFO: task syz-executor.4:13792 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29704 13792 13481 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x5f0/0x1190 kernel/locking/mutex.c:1078 blk_trace_setup+0x2f/0x60 kernel/trace/blktrace.c:626 sg_ioctl+0x270/0x2720 drivers/scsi/sg.c:1121 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc89b1df0e9 Code: Bad RIP value. RSP: 002b:00007fc899aaf168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc89b2f2370 RCX: 00007fc89b1df0e9 RDX: 00000000200000c0 RSI: 00000000c0481273 RDI: 0000000000000004 RBP: 00007fc89b23908d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffee69affcf R14: 00007fc899aaf300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1570: #0: 0000000035f7d19e (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441 3 locks held by kworker/u4:4/2888: 1 lock held by in:imklog/13372: #0: 00000000a83d6427 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767 5 locks held by syz-executor.4/13767: 1 lock held by syz-executor.4/13787: #0: 00000000cbed20cf (&q->blk_trace_mutex){+.+.}, at: blk_trace_startstop+0x21/0x40 kernel/trace/blktrace.c:714 1 lock held by syz-executor.4/13792: #0: 00000000cbed20cf (&q->blk_trace_mutex){+.+.}, at: blk_trace_setup+0x2f/0x60 kernel/trace/blktrace.c:626 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x991/0xe60 kernel/hung_task.c:287 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 13767 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__lock_release kernel/locking/lockdep.c:3665 [inline] RIP: 0010:lock_release+0x1c6/0x8b0 kernel/locking/lockdep.c:3927 Code: 8b 34 25 c0 df 01 00 38 d0 7c 08 84 d2 0f 85 1b 06 00 00 44 8b 0d ba a5 fa 08 45 85 c9 0f 84 f3 01 00 00 49 8d 86 80 08 00 00 <48> 89 c2 48 89 44 24 08 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 RSP: 0018:ffff8880ba106fd0 EFLAGS: 00000002 RAX: ffff88804b0bab80 RBX: ffff88804b0ba300 RCX: 1ffffffff148be2c RDX: 0000000000000004 RSI: 0000000000000002 RDI: ffff88804b0bab84 RBP: ffffffff89f85fa0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: ffffffff8c66505b R12: 1ffff11017420dfd R13: ffffffff8179861a R14: ffff88804b0ba300 R15: ffff8880ba1070a0 FS: 00007fc899b54700(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fed99f94aa0 CR3: 000000003c2eb000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_lock_release include/linux/rcupdate.h:247 [inline] rcu_read_unlock include/linux/rcupdate.h:681 [inline] __perf_event_output kernel/events/core.c:6626 [inline] perf_event_output_forward+0x191/0x270 kernel/events/core.c:6634 __perf_event_overflow+0x13c/0x370 kernel/events/core.c:7907 perf_swevent_hrtimer+0x272/0x3e0 kernel/events/core.c:9261 __run_hrtimer kernel/time/hrtimer.c:1465 [inline] __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1527 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline] smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:preempt_count_add+0x64/0x190 kernel/sched/core.c:3238 Code: 0b 85 c9 75 07 65 8b 05 ea 70 c0 7e 48 b8 00 00 00 00 00 fc ff df 48 89 da 83 e3 07 48 c1 ea 03 83 c3 03 65 01 2d cc 70 c0 7e <0f> b6 04 02 38 c3 7c 08 84 c0 0f 85 da 00 00 00 8b 15 c6 c8 e2 0b RSP: 0018:ffff8880ba107718 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 1ffffffff1a486ec RSI: ffff8880ba1076c0 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001 R10: ffff8880ba1078bf R11: 0000000000074071 R12: ffff8880ba1078a8 R13: 0000000000000000 R14: ffff8880ba107860 R15: 0000000000000200 unwind_next_frame+0x135/0x1400 arch/x86/kernel/unwind_orc.c:407 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slab.c:3340 [inline] kmem_cache_alloc_node_trace+0x13c/0x3b0 mm/slab.c:3666 __do_kmalloc_node mm/slab.c:3688 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3703 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0xae/0x560 net/core/skbuff.c:205 skb_copy+0x139/0x2f0 net/core/skbuff.c:1358 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb8a/0x1330 drivers/net/wireless/mac80211_hwsim.c:1353 mac80211_hwsim_tx_frame+0x12b/0x210 drivers/net/wireless/mac80211_hwsim.c:1556 mac80211_hwsim_beacon_tx+0x3f8/0x680 drivers/net/wireless/mac80211_hwsim.c:1595 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline] RIP: 0010:read_seqcount_begin include/linux/seqlock.h:164 [inline] RIP: 0010:read_seqbegin include/linux/seqlock.h:440 [inline] RIP: 0010:zone_span_seqbegin include/linux/memory_hotplug.h:65 [inline] RIP: 0010:page_outside_zone_boundaries mm/page_alloc.c:491 [inline] RIP: 0010:bad_range+0x288/0x3c0 mm/page_alloc.c:520 Code: e9 ff 48 c7 c0 88 82 f1 89 48 c1 e8 03 80 3c 28 00 0f 85 29 01 00 00 48 83 3d 9b 0f 73 08 00 0f 84 80 00 00 00 4c 89 ff 57 9d <0f> 1f 44 00 00 e9 82 fe ff ff 0f 0b 0f 0b 4c 89 f9 4c 89 fa 48 c1 RSP: 0018:ffff8880aa28f520 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff13e3051 RBX: ffff88823fff8d80 RCX: 1ffff1100961757a RDX: 0000000000000000 RSI: ffff88804b0babb0 RDI: 0000000000000286 RBP: dffffc0000000000 R08: ffffffff8cd37af0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff13e3050 R13: 0000000000000000 R14: 1ffffffff13e3052 R15: 0000000000000286 rmqueue mm/page_alloc.c:3047 [inline] get_page_from_freelist+0x1d60/0x4170 mm/page_alloc.c:3373 __alloc_pages_nodemask+0x387/0x2890 mm/page_alloc.c:4399 alloc_pages_current+0x193/0x2a0 mm/mempolicy.c:2197 alloc_pages include/linux/gfp.h:532 [inline] relay_alloc_buf kernel/relay.c:136 [inline] relay_create_buf kernel/relay.c:177 [inline] relay_open_buf.part.0+0x2a8/0xb80 kernel/relay.c:453 relay_open_buf kernel/relay.c:450 [inline] relay_open kernel/relay.c:605 [inline] relay_open+0x537/0x9f0 kernel/relay.c:564 do_blk_trace_setup+0x4f6/0xb40 kernel/trace/blktrace.c:566 __blk_trace_setup+0xca/0x180 kernel/trace/blktrace.c:609 blk_trace_setup+0x43/0x60 kernel/trace/blktrace.c:627 sg_ioctl+0x270/0x2720 drivers/scsi/sg.c:1121 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc89b1df0e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc899b54168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc89b2f1f60 RCX: 00007fc89b1df0e9 RDX: 0000000020000140 RSI: 00000000c0481273 RDI: 0000000000000005 RBP: 00007fc89b23908d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffee69affcf R14: 00007fc899b54300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 8b 34 25 c0 df 01 00 mov 0x1dfc0,%esi 7: 38 d0 cmp %dl,%al 9: 7c 08 jl 0x13 b: 84 d2 test %dl,%dl d: 0f 85 1b 06 00 00 jne 0x62e 13: 44 8b 0d ba a5 fa 08 mov 0x8faa5ba(%rip),%r9d # 0x8faa5d4 1a: 45 85 c9 test %r9d,%r9d 1d: 0f 84 f3 01 00 00 je 0x216 23: 49 8d 86 80 08 00 00 lea 0x880(%r14),%rax * 2a: 48 89 c2 mov %rax,%rdx <-- trapping instruction 2d: 48 89 44 24 08 mov %rax,0x8(%rsp) 32: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 39: fc ff df 3c: 48 c1 ea 03 shr $0x3,%rdx