binder: send failed reply for transaction 499, target dead binder: send failed reply for transaction 505, target dead binder: send failed reply for transaction 509, target dead binder: send failed reply for transaction 513, target dead binder: send failed reply for transaction 516, target dead INFO: task syz-executor.4:26159 blocked for more than 140 seconds. Not tainted 4.9.168+ #39 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28976 26159 2136 0x80000000 ffff8801c6482f80 ffff8801d2b5c200 ffff8801db621000 ffff8801a17ddf00 ffff8801db621018 ffff8801b30d7ba0 ffffffff8280028e ffffffff8280c69c ffff8801cb0672c8 00ff8801b30d7af0 ffff8801db6218f0 1ffff1003661af63 Call Trace: [<00000000514f972b>] schedule+0x92/0x1c0 kernel/sched/core.c:3546 [<00000000aef631be>] rwsem_down_read_failed+0x258/0x3e0 kernel/locking/rwsem-xadd.c:267 [<00000000d7518682>] call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94 [<00000000d6f0c19c>] __down_read arch/x86/include/asm/rwsem.h:65 [inline] [<00000000d6f0c19c>] down_read+0x52/0xb0 kernel/locking/rwsem.c:24 [<000000009d66f3d5>] exit_mm kernel/exit.c:480 [inline] [<000000009d66f3d5>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828 [<000000004fa1f303>] do_group_exit+0x111/0x300 kernel/exit.c:945 [<000000004488a6b7>] SYSC_exit_group kernel/exit.c:956 [inline] [<000000004488a6b7>] SyS_exit_group+0x1d/0x20 kernel/exit.c:954 [<00000000801297af>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285 [<00000000921f0b8d>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Showing all locks held in the system: 2 locks held by khungtaskd/24: #0: (rcu_read_lock){......}, at: [<00000000ea1dbbf9>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline] #0: (rcu_read_lock){......}, at: [<00000000ea1dbbf9>] watchdog+0x13c/0xae0 kernel/hung_task.c:239 #1: (tasklist_lock){.+.?..}, at: [<000000005b162610>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4339 2 locks held by getty/2032: #0: (&tty->ldisc_sem){++++++}, at: [<00000000981f815f>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377 #1: (&ldata->atomic_read_lock){+.+...}, at: [<0000000038b9161f>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156 1 lock held by syz-executor.4/26159: #0: (&mm->mmap_sem){++++++}, at: [<000000009d66f3d5>] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [<000000009d66f3d5>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828 1 lock held by syz-executor.4/26163: #0: (&mm->mmap_sem){++++++}, at: [<000000009d66f3d5>] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [<000000009d66f3d5>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828 1 lock held by syz-executor.4/26165: #0: (&mm->mmap_sem){++++++}, at: [<000000009d66f3d5>] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [<000000009d66f3d5>] do_exit+0x3b7/0x2aa0 kernel/exit.c:828 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 24 Comm: khungtaskd Not tainted 4.9.168+ #39 ffff8801d98d7cc8 ffffffff81b4f5d1 0000000000000000 0000000000000000 0000000000000000 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00 ffffffff81b5a86c 0000000000000000 0000000000000000 0000000000000000 Call Trace: [<00000000b4481137>] __dump_stack lib/dump_stack.c:15 [inline] [<00000000b4481137>] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [<00000000494ba435>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99 [<000000006007f7d2>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60 [<00000000d4ec3f97>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [<00000000c09fcd28>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [<00000000c09fcd28>] check_hung_task kernel/hung_task.c:125 [inline] [<00000000c09fcd28>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [<00000000c09fcd28>] watchdog+0x661/0xae0 kernel/hung_task.c:239 [<00000000969f67f1>] kthread+0x278/0x310 kernel/kthread.c:211 [<00000000a6a14374>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 26175 Comm: syz-executor.4 Not tainted 4.9.168+ #39 task: 000000004310c083 task.stack: 00000000e264da56 RIP: 0010:[] c [<000000009425685e>] mark_lock+0x16/0x12e0 kernel/locking/lockdep.c:3032 RSP: 0018:ffff8801a4e57aa8 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000006 RDX: 0000000000000006 RSI: ffff8801cabc2098 RDI: ffff8801cabc17c0 RBP: ffff8801a4e57ab0 R08: 0000000000000000 R09: ffff8801cabc20b8 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cabc2070 R13: 0000000000000006 R14: ffff8801cabc17c0 R15: dffffc0000000000 FS: 00007fb466115700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa28a579000 CR3: 00000001d31b0000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: dffffc0000000000c ffff8801a4e57af8c ffffffff81207931c 0000000000000000c 00000007813dbee9c ffff8801cabc17c0c ffffffff82804797c ffff8801d86579e0c ffff8801cabc17c0c ffffffff841f18c0c ffff8801a4e57b18c ffffffff81207d05c Call Trace: [<00000000951a5d20>] mark_held_locks+0xb1/0x100 kernel/locking/lockdep.c:2660 [<0000000083f09d83>] __trace_hardirqs_on_caller kernel/locking/lockdep.c:2689 [inline] [<0000000083f09d83>] trace_hardirqs_on_caller+0x385/0x5a0 kernel/locking/lockdep.c:2736 [<00000000e3179368>] trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743 [<000000001700887f>] __mutex_lock_common kernel/locking/mutex.c:603 [inline] [<000000001700887f>] mutex_lock_nested+0x6c7/0x920 kernel/locking/mutex.c:621 [<0000000007e45f08>] perf_mmap+0x4d9/0x1580 kernel/events/core.c:5278 [<000000004c52d38a>] mmap_region+0x7e7/0xfa0 mm/mmap.c:1726 [<00000000d44ca373>] do_mmap+0x539/0xbc0 mm/mmap.c:1505 [<000000000b52bdc2>] do_mmap_pgoff include/linux/mm.h:2034 [inline] [<000000000b52bdc2>] vm_mmap_pgoff+0x179/0x1c0 mm/util.c:329 [<000000002acb22fc>] SYSC_mmap_pgoff mm/mmap.c:1555 [inline] [<000000002acb22fc>] SyS_mmap_pgoff+0xfa/0x1b0 mm/mmap.c:1513 [<000000000828c612>] SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] [<000000000828c612>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87 [<00000000801297af>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285 [<00000000921f0b8d>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: c41 c5e c41 c5f c5d cc3 c4c c89 cff ce8 c37 c26 c2f c00 ceb cd7 c0f c1f c44 c00 c00 c55 c4c c8d c4e c20 c89 cd1 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c48 c89 ce5 c41 c57 c<49> c89 cff c41 c56 c41 c89 cd6 c4c c89 cca c41 c55 c48 cc1 cea c03 c41 cbd c01 c00 c