[ 9407] 0 9407 17634 8455 25 4 0 0 syz-executor1 [ 9424] 0 9424 17601 8454 25 3 0 0 syz-executor1 [ 9427] 0 9427 17667 8459 25 3 0 0 syz-executor1 [ 9466] 0 9466 17667 8456 32 4 0 1000 syz-executor0 INFO: task syz-executor3:10496 blocked for more than 140 seconds. Not tainted 4.14.91+ #3 [ 9544] 0 9544 17634 8456 25 4 0 0 syz-executor1 [ 9639] 0 9639 17700 8443 25 4 0 1000 syz-executor0 [ 9688] 0 9688 17700 8443 25 4 0 1000 syz-executor0 [ 9775] 0 9775 17601 8451 24 4 0 1000 syz-executor0 [ 9805] 0 9805 17667 8461 26 4 0 1000 syz-executor4 [ 9953] 0 9953 17634 12753 31 3 0 1000 syz-executor0 [10109] 0 10109 17601 8454 24 3 0 0 syz-executor1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor3 D29936 10496 1856 0x00000004 Call Trace: [10113] 0 10113 17634 8456 24 3 0 0 syz-executor1 schedule+0x92/0x1c0 kernel/sched/core.c:3490 [10124] 0 10124 17601 8230 25 3 0 1000 syz-executor2 [10235] 0 10235 17632 8460 25 4 0 0 syz-executor1 __lock_sock+0x12b/0x220 net/core/sock.c:2237 [10335] 0 10335 17667 8457 26 4 0 1000 syz-executor2 lock_sock_nested+0xe1/0x100 net/core/sock.c:2758 lock_sock include/net/sock.h:1452 [inline] packet_setsockopt+0x885/0x2830 net/packet/af_packet.c:3780 [10407] 0 10407 17601 8232 24 3 0 1000 syz-executor4 [10409] 0 10409 17667 8461 27 4 0 0 syz-executor1 [10456] 0 10456 17766 8493 26 4 0 1000 syz-executor2 [10471] 0 10471 17634 8479 25 4 0 0 syz-executor5 [10522] 0 10522 17697 8460 25 4 0 1000 /group.stat [10539] 0 10539 17634 8457 25 4 0 1000 /group.stat Showing all locks held in the system: [10688] 0 10688 17634 8456 25 4 0 1000 syz-executor4 [10895] 0 10895 17601 8228 24 3 0 1000 syz-executor0 2 locks held by init/1: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x271/0xb80 arch/x86/mm/fault.c:1354 #1: (&ei->i_mmap_sem){++++}, at: [] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6178 2 locks held by kworker/u4:0/5: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 1 lock held by khungtaskd/23: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4541 2 locks held by kworker/u4:1/64: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:2/366: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by rsyslogd/1632: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x271/0xb80 arch/x86/mm/fault.c:1354 #1: (&ei->i_mmap_sem){++++}, at: [] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6178 2 locks held by getty/1760: #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:275 #1: (&ldata->atomic_read_lock){+.+.}, at: [] n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156 2 locks held by syz-fuzzer/1779: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x271/0xb80 arch/x86/mm/fault.c:1354 #1: (&ei->i_mmap_sem){++++}, at: [] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6178 1 lock held by syz-executor5/1847: #0: (&xt[i].mutex){+.+.}, at: [] xt_find_target+0x3d/0x1e0 net/netfilter/x_tables.c:232 2 locks held by kworker/u4:3/1852: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:5/1868: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:6/1876: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by udevd/5781: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x271/0xb80 arch/x86/mm/fault.c:1354 #1: (&ei->i_mmap_sem){++++}, at: [] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6178 2 locks held by kworker/u4:9/6054: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:10/6056: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:11/6062: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:12/6067: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:13/6070: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:14/6547: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:15/6550: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:16/11968: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:17/11972: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:18/11978: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:19/11985: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:20/12021: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:21/12026: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:22/12033: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:24/18502: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 [10897] 0 10897 17634 8231 25 3 0 1000 syz-executor0 2 locks held by kworker/u4:25/18504: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:27/18508: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:28/18510: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:30/18514: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:31/18516: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:32/18518: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:33/18519: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:34/18522: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:36/18527: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 [10901] 0 10901 17733 8463 26 4 0 1000 syz-executor2 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:38/22034: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:39/22036: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:40/22038: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:29/2655: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:37/2658: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:7/7351: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:26/7353: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:41/7356: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 [10965] 0 10965 17634 12753 31 3 0 1000 syz-executor0 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:43/7359: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 2 locks held by kworker/u4:44/7365: #0: ("events_unbound"){+.+.}, at: [] process_one_work+0x6e5/0x14e0 kernel/workqueue.c:2085 #1: ((&sub_info->work)){+.+.}, at: [] process_one_work+0x71b/0x14e0 kernel/workqueue.c:2089 1 lock held by modprobe/10494: #0: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock_shared include/linux/fs.h:725 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] do_last fs/namei.c:3360 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] path_openat+0x14aa/0x2b70 fs/namei.c:3597 1 lock held by modprobe/10505: #0: (&mm->mmap_sem){++++}, at: [] vm_mmap_pgoff+0x147/0x1c0 mm/util.c:331 1 lock held by modprobe/10521: #0: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock_shared include/linux/fs.h:725 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] do_last fs/namei.c:3360 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] path_openat+0x14aa/0x2b70 fs/namei.c:3597 2 locks held by modprobe/10525: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x871/0xb80 arch/x86/mm/fault.c:1361 [11017] 0 11017 17601 8454 24 3 0 0 syz-executor1 #1: (&ei->i_mmap_sem [11020] 0 11020 17667 8458 24 3 0 0 syz-executor1 [11064] 0 11064 17667 8459 27 4 0 0 syz-executor1 ){++++}, at: [] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6178 1 lock held by modprobe/10526: #0: (&mm->mmap_sem){++++}, at: [] setup_arg_pages+0x255/0x710 fs/exec.c:734 1 lock held by modprobe/10529: #0: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock_shared include/linux/fs.h:725 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] do_last fs/namei.c:3360 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] path_openat+0x14aa/0x2b70 fs/namei.c:3597 1 lock held by modprobe/10532: #0: (&mm->mmap_sem){++++}, at: [] vm_mmap_pgoff+0x147/0x1c0 mm/util.c:331 1 lock held by modprobe/10553: #0: (&type->i_mutex_dir_key#3){++++}, at: [] inode_lock_shared include/linux/fs.h:725 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] do_last fs/namei.c:3360 [inline] #0: (&type->i_mutex_dir_key#3){++++}, at: [] path_openat+0x14aa/0x2b70 fs/namei.c:3597 1 lock held by modprobe/10554: #0: (&mm->mmap_sem){++++}, at: [] setup_arg_pages+0x255/0x710 fs/exec.c:734 2 locks held by init/10562: #0: (&mm->mmap_sem){++++}, at: [] __do_page_fault+0x271/0xb80 arch/x86/mm/fault.c:1354 #1: (&ei->i_mmap_sem){++++}, at: [] ext4_filemap_fault+0x7c/0xb0 fs/ext4/inode.c:6178 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.91+ #3 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101 [11070] 0 11070 17667 8459 27 4 0 0 syz-executor1 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 10524 Comm: modprobe Not tainted 4.14.91+ #3 task: ffff8880b05a8000 task.stack: ffff888081d38000 RIP: 0010:debug_spin_unlock kernel/locking/spinlock_debug.c:102 [inline] RIP: 0010:do_raw_spin_unlock+0xf4/0x210 kernel/locking/spinlock_debug.c:134 RSP: 0000:ffff888081d3ebb0 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: 0000000000000297 RCX: 1ffff110160b5104 RDX: 1ffff1103aa9bf6e RSI: 0000000000000002 RDI: ffff8881d54dfb64 RBP: ffff8881d54dfb60 R08: 0000000000000001 R09: 0000000000000001 R10: ffff8880b05a8858 R11: 0000000000000001 R12: ffff8881d54dfb68 R13: ffff8881d54dfb70 R14: 0000000000000297 R15: ffff8881d54dfb60 FS: 0000000000000000(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000459e74 CR3: 0000000186296002 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline] _raw_spin_unlock_irqrestore+0x23/0x70 kernel/locking/spinlock.c:192 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] __remove_mapping+0x422/0x560 mm/vmscan.c:758 shrink_page_list+0x1870/0x32b0 mm/vmscan.c:1311 shrink_inactive_list+0x39a/0x1170 mm/vmscan.c:1816 shrink_list mm/vmscan.c:2175 [inline] shrink_node_memcg+0x5f9/0x1320 mm/vmscan.c:2440 shrink_node+0x2fa/0xbf0 mm/vmscan.c:2632 shrink_zones mm/vmscan.c:2814 [inline] do_try_to_free_pages+0x350/0xd80 mm/vmscan.c:2876 try_to_free_pages+0x20a/0x6c0 mm/vmscan.c:3082 __perform_reclaim mm/page_alloc.c:3593 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:3614 [inline] __alloc_pages_slowpath mm/page_alloc.c:4001 [inline] __alloc_pages_nodemask+0xac8/0x22e0 mm/page_alloc.c:4210 __alloc_pages include/linux/gfp.h:461 [inline] __alloc_pages_node include/linux/gfp.h:474 [inline] alloc_pages_node include/linux/gfp.h:488 [inline] alloc_slab_page mm/slub.c:1437 [inline] allocate_slab mm/slub.c:1588 [inline] new_slab+0x397/0x480 mm/slub.c:1651 Code: 0f 8e ef 00 00 00 65 8b 05 ca e7 a0 5b 39 45 08 0f 85 9d 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 <0f> 85 f5 00 00 00 4c 89 e2 48 c7 45 10 ff ff ff ff 48 b8 00 00