INFO: task syz-executor.2:22560 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.2 state:D stack:28008 pid:22560 ppid: 17843 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6250 schedule+0xd2/0x260 kernel/sched/core.c:6323 blk_mq_freeze_queue_wait+0x112/0x160 block/blk-mq.c:178 loop_set_status+0x17d/0x930 drivers/block/loop.c:1264 loop_set_status_old+0x148/0x1b0 drivers/block/loop.c:1396 lo_ioctl+0x3e9/0x17c0 drivers/block/loop.c:1566 blkdev_ioctl+0x37a/0x800 block/ioctl.c:609 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f6c683acae9 RSP: 002b:00007f6c65922188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f6c684bff60 RCX: 00007f6c683acae9 RDX: 0000000020000780 RSI: 0000000000004c02 RDI: 0000000000000004 RBP: 00007f6c68406f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff9c2915af R14: 00007f6c65922300 R15: 0000000000022000 INFO: task syz-executor.2:22566 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.2 state:D stack:26160 pid:22566 ppid: 17843 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xa9a/0x4940 kernel/sched/core.c:6250 schedule+0xd2/0x260 kernel/sched/core.c:6323 __bio_queue_enter+0x3c5/0x6a0 block/blk-core.c:441 bio_queue_enter block/blk.h:91 [inline] blk_mq_get_request block/blk-mq.c:2588 [inline] blk_mq_submit_bio+0x4ae/0x22c0 block/blk-mq.c:2632 __submit_bio block/blk-core.c:849 [inline] __submit_bio_noacct_mq block/blk-core.c:924 [inline] submit_bio_noacct block/blk-core.c:950 [inline] submit_bio_noacct+0x82c/0xa20 block/blk-core.c:939 submit_bio block/blk-core.c:1011 [inline] submit_bio+0x1ea/0x430 block/blk-core.c:969 submit_bio_wait+0x106/0x230 block/bio.c:1254 blkdev_issue_flush+0xd6/0x130 block/blk-flush.c:458 blkdev_fsync+0x68/0xa0 block/fops.c:474 vfs_fsync_range+0x13a/0x220 fs/sync.c:182 generic_write_sync include/linux/fs.h:2956 [inline] blkdev_write_iter+0x552/0x690 block/fops.c:559 call_write_iter include/linux/fs.h:2162 [inline] do_iter_readv_writev+0x472/0x750 fs/read_write.c:725 do_iter_write+0x188/0x710 fs/read_write.c:851 vfs_iter_write+0x70/0xa0 fs/read_write.c:892 iter_file_splice_write+0x723/0xc70 fs/splice.c:689 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x110/0x180 fs/splice.c:936 splice_direct_to_actor+0x34b/0x8c0 fs/splice.c:891 do_splice_direct+0x1b3/0x280 fs/splice.c:979 do_sendfile+0xaf2/0x1250 fs/read_write.c:1245 __do_sys_sendfile64 fs/read_write.c:1310 [inline] __se_sys_sendfile64 fs/read_write.c:1296 [inline] __x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1296 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f6c683acae9 RSP: 002b:00007f6c65901188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f6c684c0020 RCX: 00007f6c683acae9 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000004 RBP: 00007f6c68406f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000024002da8 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff9c2915af R14: 00007f6c65901300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8bb83b60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458 1 lock held by khugepaged/33: #0: ffffffff8bc68bc8 (lock#5){+.+.}-{3:3}, at: __lru_add_drain_all+0x65/0x760 mm/swap.c:797 2 locks held by systemd-udevd/2975: #0: ffff88801a3f5918 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev.part.0+0x9b/0xb50 block/bdev.c:819 #1: ffff88801a3f1360 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_open+0x75/0x120 drivers/block/loop.c:1733 1 lock held by in:imklog/6213: #0: ffff88807b3ecd70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 1 lock held by syz-executor.2/22560: #0: ffff88801a3f1360 (&lo->lo_mutex){+.+.}-{3:3}, at: loop_set_status+0x2a/0x930 drivers/block/loop.c:1248 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc1d/0xf50 kernel/hung_task.c:295 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 58 Comm: kworker/u4:3 Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:lockdep_recursion_finish kernel/locking/lockdep.c:438 [inline] RIP: 0010:lock_acquire kernel/locking/lockdep.c:5639 [inline] RIP: 0010:lock_acquire+0x1c8/0x510 kernel/locking/lockdep.c:5602 Code: 41 0f 94 c1 45 0f b6 c9 e8 d5 96 ff ff 48 c7 c7 60 0d ac 89 48 83 c4 20 e8 65 36 f5 07 b8 ff ff ff ff 65 0f c1 05 68 76 a5 7e <83> f8 01 0f 85 b4 02 00 00 9c 58 f6 c4 02 0f 85 9f 02 00 00 48 83 RSP: 0018:ffffc90001a3f8c8 EFLAGS: 00000057 RAX: 0000000000000001 RBX: 1ffff92000347f1b RCX: ffffffff815cb0ff RDX: 1ffff11002e5588b RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff8ff75a17 R10: fffffbfff1feeb42 R11: 000000000000003f R12: 0000000000000000 R13: 0000000000000000 R14: ffff888010dba138 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1c8c4a0000 CR3: 000000000b88e000 CR4: 0000000000350ee0 Call Trace: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:349 [inline] __get_locked_pte+0x2b6/0x4d0 mm/memory.c:1722 get_locked_pte include/linux/mm.h:2160 [inline] __text_poke+0x1ae/0x8c0 arch/x86/kernel/alternative.c:1000 text_poke_bp_batch+0x187/0x560 arch/x86/kernel/alternative.c:1294 text_poke_flush arch/x86/kernel/alternative.c:1451 [inline] text_poke_flush arch/x86/kernel/alternative.c:1448 [inline] text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1458 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146 jump_label_update+0x1d5/0x430 kernel/jump_label.c:830 static_key_disable_cpuslocked+0x152/0x1b0 kernel/jump_label.c:207 static_key_disable+0x16/0x20 kernel/jump_label.c:215 toggle_allocation_gate mm/kfence/core.c:746 [inline] toggle_allocation_gate+0x183/0x390 mm/kfence/core.c:724 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 41 0f 94 c1 sete %r9b 4: 45 0f b6 c9 movzbl %r9b,%r9d 8: e8 d5 96 ff ff callq 0xffff96e2 d: 48 c7 c7 60 0d ac 89 mov $0xffffffff89ac0d60,%rdi 14: 48 83 c4 20 add $0x20,%rsp 18: e8 65 36 f5 07 callq 0x7f53682 1d: b8 ff ff ff ff mov $0xffffffff,%eax 22: 65 0f c1 05 68 76 a5 xadd %eax,%gs:0x7ea57668(%rip) # 0x7ea57692 29: 7e * 2a: 83 f8 01 cmp $0x1,%eax <-- trapping instruction 2d: 0f 85 b4 02 00 00 jne 0x2e7 33: 9c pushfq 34: 58 pop %rax 35: f6 c4 02 test $0x2,%ah 38: 0f 85 9f 02 00 00 jne 0x2dd 3e: 48 rex.W 3f: 83 .byte 0x83