audit: type=1800 audit(1641883496.455:11108): pid=8568 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.0" name="bus" dev="sda1" ino=14232 res=0 audit: type=1800 audit(1641883496.465:11109): pid=8579 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.4" name="bus" dev="sda1" ino=14235 res=0 audit: type=1800 audit(1641883496.465:11110): pid=8579 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.4" name="bus" dev="sda1" ino=14235 res=0 INFO: task kworker/u4:9:10041 blocked for more than 140 seconds. Not tainted 4.14.261-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u4:9 D26536 10041 2 0x80000000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_timeout+0x80a/0xe90 kernel/time/timer.c:1724 do_wait_for_common kernel/sched/completion.c:91 [inline] __wait_for_common kernel/sched/completion.c:112 [inline] wait_for_common+0x272/0x430 kernel/sched/completion.c:123 __synchronize_srcu+0x10a/0x1d0 kernel/rcu/srcutree.c:898 fsnotify_mark_destroy_workfn+0xed/0x2e0 fs/notify/mark.c:757 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/u4:4:6669 blocked for more than 140 seconds. Not tainted 4.14.261-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u4:4 D27312 6669 2 0x80000000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_timeout+0x80a/0xe90 kernel/time/timer.c:1724 do_wait_for_common kernel/sched/completion.c:91 [inline] __wait_for_common kernel/sched/completion.c:112 [inline] wait_for_common+0x272/0x430 kernel/sched/completion.c:123 __synchronize_srcu+0x10a/0x1d0 kernel/rcu/srcutree.c:898 fsnotify_connector_destroy_workfn+0x49/0xa0 fs/notify/mark.c:156 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Showing all locks held in the system: 1 lock held by khungtaskd/1533: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548 1 lock held by in:imklog/7688: #0: (&f->f_pos_lock){+.+.}, at: [] __fdget_pos+0x1fb/0x2b0 fs/file.c:778 2 locks held by kworker/u4:9/10041: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088 #1: ((reaper_work).work){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 2 locks held by kworker/u4:4/6669: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088 #1: (connector_reaper_work){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 2 locks held by syz-executor.2/8615: #0: (sb_writers#3){.+.+}, at: [] file_start_write include/linux/fs.h:2714 [inline] #0: (sb_writers#3){.+.+}, at: [] do_sendfile+0x84f/0xb30 fs/read_write.c:1440 #1: (&sb->s_type->i_mutex_key#10){++++}, at: [] inode_trylock include/linux/fs.h:739 [inline] #1: (&sb->s_type->i_mutex_key#10){++++}, at: [] ext4_file_write_iter+0x1cc/0xd20 fs/ext4/file.c:236 1 lock held by syz-executor.3/8609: #0: (&mm->mmap_sem){++++}, at: [] vm_mmap_pgoff+0x11e/0x1a0 mm/util.c:331 1 lock held by syz-executor.3/8616: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x7b8/0xad0 arch/x86/mm/fault.c:1378 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1533 Comm: khungtaskd Not tainted 4.14.261-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x5b9/0xb40 kernel/hung_task.c:274 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 8619 Comm: syz-executor.3 Not tainted 4.14.261-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888099d0e180 task.stack: ffff88809edd0000 RIP: 0010:__rcu_read_unlock+0x0/0x160 kernel/rcu/update.c:253 RSP: 0018:ffff88809edd7b88 EFLAGS: 00000246 RAX: 0000000000040000 RBX: ffff88823b320880 RCX: ffffc90009bfc000 RDX: 0000000000040000 RSI: ffffffff8175a6e1 RDI: ffff8880ba52ca8c RBP: ffff8880aa92c318 R08: ffff88823b320cd0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000004 R13: 0000000020490000 R14: 0000000000000246 R15: 0000000000000016 FS: 00007f170c0d9700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000002 CR3: 00000000a5da0000 CR4: 00000000003426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_read_unlock include/linux/rcupdate.h:684 [inline] count_memcg_event_mm include/linux/memcontrol.h:715 [inline] handle_mm_fault+0x306/0x9c0 mm/memory.c:4233 faultin_page mm/gup.c:523 [inline] __get_user_pages+0x4e9/0x1270 mm/gup.c:729 populate_vma_page_range+0x17b/0x210 mm/gup.c:1246 __mm_populate+0x195/0x2c0 mm/gup.c:1294 mm_populate include/linux/mm.h:2194 [inline] vm_mmap_pgoff+0x18f/0x1a0 mm/util.c:338 SYSC_mmap_pgoff mm/mmap.c:1545 [inline] SyS_mmap_pgoff+0x249/0x510 mm/mmap.c:1503 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f170d7a5e99 RSP: 002b:00007f170c0d9168 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007f170d8b9100 RCX: 00007f170d7a5e99 RDX: 00000000007ffffe RSI: 0000000000600000 RDI: 0000000020000000 RBP: 00007f170d7ffff1 R08: 0000000000000013 R09: 0000000000000000 R10: 0000000004002011 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff1bf2055f R14: 00007f170c0d9300 R15: 0000000000022000 Code: 5d 41 5c e9 83 74 11 00 48 89 34 24 e8 fa d3 38 00 48 8b 34 24 eb 8f e8 ef d3 38 00 eb c7 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> b8 00 00 00 00 00 fc ff df 55 53 65 48 8b 1c 25 c0 7f 02 00 ---------------- Code disassembly (best guess): 0: 5d pop %rbp 1: 41 5c pop %r12 3: e9 83 74 11 00 jmpq 0x11748b 8: 48 89 34 24 mov %rsi,(%rsp) c: e8 fa d3 38 00 callq 0x38d40b 11: 48 8b 34 24 mov (%rsp),%rsi 15: eb 8f jmp 0xffffffa6 17: e8 ef d3 38 00 callq 0x38d40b 1c: eb c7 jmp 0xffffffe5 1e: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 25: 00 00 00 00 29: 66 90 xchg %ax,%ax * 2b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax <-- trapping instruction 32: fc ff df 35: 55 push %rbp 36: 53 push %rbx 37: 65 48 8b 1c 25 c0 7f mov %gs:0x27fc0,%rbx 3e: 02 00