INFO: task syz-executor.3:7966 blocked for more than 143 seconds. Not tainted 5.14.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:26512 pid: 7966 ppid: 8442 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4681 [inline] __schedule+0xc07/0x11f0 kernel/sched/core.c:5938 schedule+0x14b/0x210 kernel/sched/core.c:6017 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6076 __mutex_lock_common+0x116f/0x3770 kernel/locking/mutex.c:1036 __mutex_lock kernel/locking/mutex.c:1104 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1119 io_uring_del_tctx_node+0xe4/0x2b0 fs/io_uring.c:9105 io_uring_clean_tctx fs/io_uring.c:9121 [inline] io_uring_cancel_generic+0x79d/0xa60 fs/io_uring.c:9204 io_uring_files_cancel include/linux/io_uring.h:16 [inline] do_exit+0x2a7/0x2510 kernel/exit.c:780 do_group_exit+0x168/0x2d0 kernel/exit.c:922 get_signal+0x16b0/0x2080 kernel/signal.c:2808 arch_do_signal_or_restart+0x8e/0x6d0 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:302 do_syscall_64+0x4c/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 RSP: 002b:00007f861ad1d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000056bf88 RCX: 00000000004665f9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88 RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c R13: 00007fff1eb5ea7f R14: 00007f861ad1d300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1648: #0: ffffffff8c717ec0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 arch/x86/pci/mmconfig_64.c:151 1 lock held by kswapd0/2148: #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:460 [inline] #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1307 [inline] #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1610 [inline] #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x150/0x11f0 kernel/sched/core.c:5852 1 lock held by in:imklog/8146: #0: ffff88802a1465f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:974 2 locks held by kworker/0:6/9696: 2 locks held by kworker/u4:6/25509: #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:460 [inline] #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1307 [inline] #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1610 [inline] #0: ffff8880b9d51558 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x150/0x11f0 kernel/sched/core.c:5852 #1: ffff8880b9d1f888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x50b/0x820 kernel/sched/psi.c:880 1 lock held by syz-executor.3/7966: #0: ffff8880a24f20a8 (&ctx->uring_lock){+.+.}-{3:3}, at: io_uring_del_tctx_node+0xe4/0x2b0 fs/io_uring.c:9105 3 locks held by syz-executor.3/7974: 2 locks held by syz-executor.3/8028: ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1648 Comm: khungtaskd Not tainted 5.14.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1d3/0x29f lib/dump_stack.c:105 nmi_cpu_backtrace+0x16c/0x190 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x191/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xd06/0xd50 kernel/hung_task.c:295 kthread+0x453/0x480 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4860 Comm: systemd-journal Not tainted 5.14.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kasan_quarantine_put+0x12/0x210 mm/kasan/quarantine.c:182 Code: c7 18 bd 7d 8c e8 5e a6 12 08 31 c0 48 83 c4 08 5b 41 5e c3 cc cc cc cc 41 57 41 56 41 55 41 54 53 50 49 89 fe e8 0e cf ff ff <48> 85 c0 74 57 48 89 c3 9c 8f 04 24 4c 8b 3c 24 fa 41 f7 c7 00 02 RSP: 0018:ffffc900011ffb58 EFLAGS: 00000293 RAX: ffff8880b28cb300 RBX: ffff8880b28cb300 RCX: 0000000000000000 RDX: ffff8880b28cb300 RSI: ffff8880b28cb300 RDI: ffff888140007500 RBP: ffffc900011ffbf0 R08: 0000000000000003 R09: ffffffff89e00dd0 R10: ffffffff8a000000 R11: ffffffff8a000783 R12: 0000000000000000 R13: ffff888140007500 R14: ffff888140007500 R15: 0000000000000246 FS: 00007f6cddaf58c0(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6cdb0ff000 CR3: 0000000027a61000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1628 [inline] slab_free_freelist_hook+0x1e8/0x2a0 mm/slub.c:1653 slab_free mm/slub.c:3213 [inline] kmem_cache_free+0x85/0x170 mm/slub.c:3229 putname fs/namei.c:259 [inline] filename_lookup+0x4fc/0x750 fs/namei.c:2477 user_path_at include/linux/namei.h:57 [inline] do_faccessat+0x403/0x910 fs/open.c:425 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f6cdcdb09c7 Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffee1f73628 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffee1f76650 RCX: 00007f6cdcdb09c7 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000562345b8c9a3 RBP: 00007ffee1f73770 R08: 0000562345b823e5 R09: 0000000000000018 R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00005623471cb8a0 R15: 00007ffee1f73c60 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 18 bd 7d 8c e8 5e sbb %bh,0x5ee88c7d(%rbp) 6: a6 cmpsb %es:(%rdi),%ds:(%rsi) 7: 12 08 adc (%rax),%cl 9: 31 c0 xor %eax,%eax b: 48 83 c4 08 add $0x8,%rsp f: 5b pop %rbx 10: 41 5e pop %r14 12: c3 retq 13: cc int3 14: cc int3 15: cc int3 16: cc int3 17: 41 57 push %r15 19: 41 56 push %r14 1b: 41 55 push %r13 1d: 41 54 push %r12 1f: 53 push %rbx 20: 50 push %rax 21: 49 89 fe mov %rdi,%r14 24: e8 0e cf ff ff callq 0xffffcf37 * 29: 48 85 c0 test %rax,%rax <-- trapping instruction 2c: 74 57 je 0x85 2e: 48 89 c3 mov %rax,%rbx 31: 9c pushfq 32: 8f 04 24 popq (%rsp) 35: 4c 8b 3c 24 mov (%rsp),%r15 39: fa cli 3a: 41 rex.B 3b: f7 .byte 0xf7 3c: c7 .byte 0xc7 3d: 00 02 add %al,(%rdx)