9pnet_virtio: no channels available for device 1.7.0.0.1

kasan: CONFIG_KASAN_INLINE enabled
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: -956945664 Comm:  Not tainted 5.0.0-rc1+ #22
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:cpuacct_account_field+0x17a/0x3d0 kernel/sched/cpuacct.c:366
Code: 0f 84 a9 00 00 00 49 bf 00 00 00 00 00 fc ff df 48 63 d3 4c 8d 34 d5 00 00 00 00 49 8d bc 24 38 01 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 ef 01 00 00 49 8b 9c 24 38 01 00 00 e8 7e 4f
RSP: 0018:ffff8880ae6079d8 EFLAGS: 00010006
RAX: 00000c0fea200427 RBX: 0000000000000003 RCX: 1ffffffff14b7b67
RDX: 0000000000000003 RSI: 00000000ffffffff RDI: 0000607f51002138
RBP: ffff8880ae607a70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffff8880ae607998 R12: 0000607f51002000
R13: 00000000009821bd R14: 0000000000000018 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2be22000 CR3: 0000000009871000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 cgroup_account_cputime_field include/linux/cgroup.h:777 [inline]
 task_group_account_field kernel/sched/cputime.c:108 [inline]
 account_system_index_time+0x1df/0x5f0 kernel/sched/cputime.c:171
 irqtime_account_process_tick.isra.0+0x3a2/0x490 kernel/sched/cputime.c:380
 account_process_tick+0x27f/0x350 kernel/sched/cputime.c:483
 update_process_times+0x25/0x80 kernel/time/timer.c:1633
 tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:161
 tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
 __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
 __hrtimer_run_queues+0x3a7/0x1050 kernel/time/hrtimer.c:1451
 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
 smp_apic_timer_interrupt+0x18d/0x760 arch/x86/kernel/apic/apic.c:1060
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
Modules linked in:

======================================================
WARNING: possible circular locking dependency detected
5.0.0-rc1+ #22 Not tainted
------------------------------------------------------
syz-executor3/28696 is trying to acquire lock:
00000000f8e0c5ec ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70 kernel/locking/semaphore.c:136

but task is already holding lock:
000000000e058fb9 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1149 [inline]
000000000e058fb9 (&rq->lock){-.-.}, at: ttwu_queue kernel/sched/core.c:1845 [inline]
000000000e058fb9 (&rq->lock){-.-.}, at: try_to_wake_up+0x933/0x1480 kernel/sched/core.c:2057

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&rq->lock){-.-.}:
       __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
       _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
       rq_lock kernel/sched/sched.h:1149 [inline]
       task_fork_fair+0xb5/0x7a0 kernel/sched/fair.c:10058
       sched_fork+0x437/0xb90 kernel/sched/core.c:2359
       copy_process+0x1f95/0x8710 kernel/fork.c:1887
       _do_fork+0x1a9/0x1170 kernel/fork.c:2227
       kernel_thread+0x34/0x40 kernel/fork.c:2286
       rest_init+0x28/0x37b init/main.c:408
       arch_call_rest_init+0xe/0x1b
       start_kernel+0x87c/0x8b7 init/main.c:740
       x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:470
       x86_64_start_kernel+0x77/0x7b arch/x86/kernel/head64.c:451
       secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243

-> #1 (&p->pi_lock){-.-.}:
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
       try_to_wake_up+0xb9/0x1480 kernel/sched/core.c:1965
       wake_up_process+0x10/0x20 kernel/sched/core.c:2129
       __up.isra.0+0x1c0/0x2a0 kernel/locking/semaphore.c:262
       up+0x13e/0x1c0 kernel/locking/semaphore.c:187
       __up_console_sem+0xb7/0x1c0 kernel/printk/printk.c:236
       console_unlock+0x778/0x11e0 kernel/printk/printk.c:2426
       vprintk_emit+0x370/0x960 kernel/printk/printk.c:1931
       vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
       vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
       printk+0xba/0xed kernel/printk/printk.c:1991
       check_stack_usage kernel/exit.c:755 [inline]
       do_exit.cold+0x57/0x16a kernel/exit.c:916
       do_group_exit+0x177/0x430 kernel/exit.c:970
       __do_sys_exit_group kernel/exit.c:981 [inline]
       __se_sys_exit_group kernel/exit.c:979 [inline]
       __x64_sys_exit_group+0x44/0x50 kernel/exit.c:979
       do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 ((console_sem).lock){-.-.}:
       lock_acquire+0x1db/0x570 kernel/locking/lockdep.c:3841
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
       down_trylock+0x13/0x70 kernel/locking/semaphore.c:136
       __down_trylock_console_sem+0xa8/0x210 kernel/printk/printk.c:219
       console_trylock+0x15/0xa0 kernel/printk/printk.c:2242
       console_trylock_spinning kernel/printk/printk.c:1662 [inline]
       vprintk_emit+0x351/0x960 kernel/printk/printk.c:1930
       vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
       vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
       printk+0xba/0xed kernel/printk/printk.c:1991
       kasan_die_handler arch/x86/mm/kasan_init_64.c:252 [inline]
       kasan_die_handler.cold+0x11/0x23 arch/x86/mm/kasan_init_64.c:247
       notifier_call_chain+0x179/0x380 kernel/notifier.c:93
       __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
       atomic_notifier_call_chain+0x96/0x190 kernel/notifier.c:193
       notify_die+0x1b2/0x270 kernel/notifier.c:549
       do_general_protection+0x13d/0x300 arch/x86/kernel/traps.c:557
       general_protection+0x1e/0x30 arch/x86/entry/entry_64.S:1142
       cpuacct_charge+0x1d5/0x440 kernel/sched/cpuacct.c:350
       cgroup_account_cputime include/linux/cgroup.h:762 [inline]
       update_curr+0x371/0xbc0 kernel/sched/fair.c:830
       enqueue_entity+0x3e5/0x20b0 kernel/sched/fair.c:3880
       enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133
       enqueue_task kernel/sched/core.c:730 [inline]
       activate_task+0x11d/0x470 kernel/sched/core.c:751
       ttwu_activate kernel/sched/core.c:1643 [inline]
       ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702
       ttwu_queue kernel/sched/core.c:1847 [inline]
       try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057
       wake_up_process+0x10/0x20 kernel/sched/core.c:2129
       swake_up_locked kernel/sched/swait.c:30 [inline]
       swake_up_locked kernel/sched/swait.c:22 [inline]
       swake_up_one+0x125/0x3c0 kernel/sched/swait.c:40
       rcu_gp_kthread_wake+0xc3/0x100 kernel/rcu/tree.c:1571
       rcu_report_qs_rsp+0x177/0x220 kernel/rcu/tree.c:2131
       rcu_report_qs_rnp+0x316/0x460 kernel/rcu/tree.c:2202
       rcu_report_qs_rdp kernel/rcu/tree.c:2286 [inline]
       rcu_check_quiescent_state kernel/rcu/tree.c:2323 [inline]
       rcu_process_callbacks+0xa5c/0x1680 kernel/rcu/tree.c:2739
       __do_softirq+0x30b/0xb11 kernel/softirq.c:292
       invoke_softirq kernel/softirq.c:373 [inline]
       irq_exit+0x180/0x1d0 kernel/softirq.c:413
       exiting_irq arch/x86/include/asm/apic.h:536 [inline]
       smp_apic_timer_interrupt+0x1b7/0x760 arch/x86/kernel/apic/apic.c:1062
       apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
       arch_local_irq_restore arch/x86/include/asm/paravirt.h:766 [inline]
       lock_release+0x546/0xc40 kernel/locking/lockdep.c:3863
       rcu_lock_release include/linux/rcupdate.h:228 [inline]
       rcu_read_unlock include/linux/rcupdate.h:661 [inline]
       dput+0x277/0x790 fs/dcache.c:820
       proc_flush_task_mnt fs/proc/base.c:3102 [inline]
       proc_flush_task+0x4ee/0x700 fs/proc/base.c:3143
       release_task+0x26a/0x1b90 kernel/exit.c:196
       exit_notify kernel/exit.c:737 [inline]
       do_exit+0xf33/0x2650 kernel/exit.c:887
       do_group_exit+0x177/0x430 kernel/exit.c:970
       get_signal+0x8b4/0x19b0 kernel/signal.c:2517
       do_signal+0x91/0x1ea0 arch/x86/kernel/signal.c:816
       exit_to_usermode_loop+0x2f7/0x3b0 arch/x86/entry/common.c:162
       prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
       syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
       do_syscall_64+0x696/0x800 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  (console_sem).lock --> &p->pi_lock --> &rq->lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&rq->lock);
                               lock(&p->pi_lock);
                               lock(&rq->lock);
  lock((console_sem).lock);

 *** DEADLOCK ***

5 locks held by syz-executor3/28696:
 #0: 000000005453d079 (&rcu_state.gp_wq){..-.}, at: swake_up_one+0x88/0x3c0 kernel/sched/swait.c:39
 #1: 00000000bb1eb87e (&p->pi_lock){-.-.}, at: try_to_wake_up+0xb9/0x1480 kernel/sched/core.c:1965
 #2: 000000000e058fb9 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1149 [inline]
 #2: 000000000e058fb9 (&rq->lock){-.-.}, at: ttwu_queue kernel/sched/core.c:1845 [inline]
 #2: 000000000e058fb9 (&rq->lock){-.-.}, at: try_to_wake_up+0x933/0x1480 kernel/sched/core.c:2057
 #3: 00000000d13140cb (rcu_read_lock){....}, at: cpuacct_charge+0xd2/0x440 kernel/sched/cpuacct.c:344
 #4: 00000000d13140cb (rcu_read_lock){....}, at: atomic_notifier_call_chain+0x0/0x190 kernel/notifier.c:329

stack backtrace:
CPU: 1 PID: 28696 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #22
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1224
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1979 [inline]
 validate_chain kernel/locking/lockdep.c:2350 [inline]
 __lock_acquire+0x3014/0x4a30 kernel/locking/lockdep.c:3338
 lock_acquire+0x1db/0x570 kernel/locking/lockdep.c:3841
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152
 down_trylock+0x13/0x70 kernel/locking/semaphore.c:136
 __down_trylock_console_sem+0xa8/0x210 kernel/printk/printk.c:219
 console_trylock+0x15/0xa0 kernel/printk/printk.c:2242
 console_trylock_spinning kernel/printk/printk.c:1662 [inline]
 vprintk_emit+0x351/0x960 kernel/printk/printk.c:1930
 vprintk_default+0x28/0x30 kernel/printk/printk.c:1958
 vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:398
 printk+0xba/0xed kernel/printk/printk.c:1991
 kasan_die_handler arch/x86/mm/kasan_init_64.c:252 [inline]
 kasan_die_handler.cold+0x11/0x23 arch/x86/mm/kasan_init_64.c:247
 notifier_call_chain+0x179/0x380 kernel/notifier.c:93
 __atomic_notifier_call_chain kernel/notifier.c:183 [inline]
 atomic_notifier_call_chain+0x96/0x190 kernel/notifier.c:193
 notify_die+0x1b2/0x270 kernel/notifier.c:549
 do_general_protection+0x13d/0x300 arch/x86/kernel/traps.c:557
 general_protection+0x1e/0x30 arch/x86/entry/entry_64.S:1142
RIP: 0010:cpuacct_charge+0x1d5/0x440 kernel/sched/cpuacct.c:350
Code: 0f 84 a5 00 00 00 49 63 d7 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 d5 00 00 00 00 49 8d bc 24 30 01 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 e8 01 00 00 49 8b 9c 24 30 01 00 00 e8 63 53
RSP: 0018:ffff8880ae7071b8 EFLAGS: 00010002
RAX: 00000c0fea200426 RBX: ffff8880a9466240 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000607f51002130
RBP: ffff8880ae707250 R08: ffff8880a4578080 R09: ffffed1015ce5b90
R10: ffffed1015ce5b8f R11: ffff8880ae72dc7b R12: 0000607f51002000
R13: 000000000099e644 R14: 0000000000000008 R15: dffffc0000000000
 cgroup_account_cputime include/linux/cgroup.h:762 [inline]
 update_curr+0x371/0xbc0 kernel/sched/fair.c:830
 enqueue_entity+0x3e5/0x20b0 kernel/sched/fair.c:3880
 enqueue_task_fair+0x237/0x10c0 kernel/sched/fair.c:5133
 enqueue_task kernel/sched/core.c:730 [inline]
 activate_task+0x11d/0x470 kernel/sched/core.c:751
 ttwu_activate kernel/sched/core.c:1643 [inline]
 ttwu_do_activate+0xd4/0x1f0 kernel/sched/core.c:1702
 ttwu_queue kernel/sched/core.c:1847 [inline]
 try_to_wake_up+0x997/0x1480 kernel/sched/core.c:2057
 wake_up_process+0x10/0x20 kernel/sched/core.c:2129
 swake_up_locked kernel/sched/swait.c:30 [inline]
 swake_up_locked kernel/sched/swait.c:22 [inline]
 swake_up_one+0x125/0x3c0 kernel/sched/swait.c:40
Lost 125 message(s)!
---[ end trace e2ef82376cd330a9 ]---
RIP: 0010:cpuacct_account_field+0x17a/0x3d0 kernel/sched/cpuacct.c:366
kasan: GPF could be caused by NULL-ptr deref or user memory access
Code: 0f 84 a9 00 00 00 49 bf 00 00 00 00 00 fc ff df 48 63 d3 4c 8d 34 d5 00 00 00 00 49 8d bc 24 38 01 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 ef 01 00 00 49 8b 9c 24 38 01 00 00 e8 7e 4f
general protection fault: 0000 [#2] PREEMPT SMP KASAN
RSP: 0018:ffff8880ae6079d8 EFLAGS: 00010006
CPU: 1 PID: 28696 Comm: syz-executor3 Tainted: G      D           5.0.0-rc1+ #22
RAX: 00000c0fea200427 RBX: 0000000000000003 RCX: 1ffffffff14b7b67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RDX: 0000000000000003 RSI: 00000000ffffffff RDI: 0000607f51002138
RIP: 0010:cpuacct_charge+0x1d5/0x440 kernel/sched/cpuacct.c:350
RBP: ffff8880ae607a70 R08: 0000000000000000 R09: 0000000000000000
Code: 0f 84 a5 00 00 00 49 63 d7 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 d5 00 00 00 00 49 8d bc 24 30 01 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 e8 01 00 00 49 8b 9c 24 30 01 00 00 e8 63 53
R10: 0000000000000000 R11: ffff8880ae607998 R12: 0000607f51002000
RSP: 0018:ffff8880ae7071b8 EFLAGS: 00010002
R13: 00000000009821bd R14: 0000000000000018 R15: dffffc0000000000
RAX: 00000c0fea200426 RBX: ffff8880a9466240 RCX: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000607f51002130
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RBP: ffff8880ae707250 R08: ffff8880a4578080 R09: ffffed1015ce5b90
CR2: 0000001b2be22000 CR3: 0000000009871000 CR4: 00000000001406f0
R10: ffffed1015ce5b8f R11: ffff8880ae72dc7b R12: 0000607f51002000
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
R13: 000000000099e644 R14: 0000000000000008 R15: dffffc0000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
FS:  00007fe04e442700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000