INFO: task syz-executor.3:26587 blocked for more than 143 seconds. Not tainted 5.15.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:25264 pid:26587 ppid: 6505 flags:0x00024004 Call Trace: context_switch kernel/sched/core.c:4969 [inline] __schedule+0xb72/0x1460 kernel/sched/core.c:6250 schedule+0x12b/0x1f0 kernel/sched/core.c:6323 io_uring_cancel_generic+0x5b3/0x661 fs/io_uring.c:9795 io_uring_files_cancel include/linux/io_uring.h:16 [inline] do_exit+0x279/0x24e0 kernel/exit.c:781 do_group_exit+0x168/0x2d0 kernel/exit.c:923 get_signal+0x16b0/0x2090 kernel/signal.c:2855 arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:300 do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f9a1c888ae9 RSP: 002b:00007f9a19dfe218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f9a1c99bf68 RCX: 00007f9a1c888ae9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9a1c99bf68 RBP: 00007f9a1c99bf60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9a1c99bf6c R13: 00007ffefb3a979f R14: 00007f9a19dfe300 R15: 0000000000022000 Showing all locks held in the system: 4 locks held by kworker/u4:0/8: #0: ffff8880b9b31558 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x110 kernel/sched/core.c:478 #1: ffff8880b9b1f888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x4c1/0x780 kernel/sched/psi.c:880 #2: ffff8880b9b200d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x12a/0x270 kernel/time/timer.c:946 #3: ffffffff90bbe778 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x97/0x6a0 lib/debugobjects.c:661 1 lock held by khungtaskd/26: #0: ffffffff8c91d480 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 1 lock held by in:imklog/6156: #0: ffff88801da92870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:990 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 26 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 nmi_cpu_backtrace+0x45f/0x490 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc82/0xcd0 kernel/hung_task.c:295 kthread+0x468/0x490 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2923 Comm: systemd-journal Not tainted 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:next_tid mm/slub.c:2251 [inline] RIP: 0010:slab_alloc_node mm/slub.c:3197 [inline] RIP: 0010:slab_alloc mm/slub.c:3221 [inline] RIP: 0010:kmem_cache_alloc+0x145/0x300 mm/slub.c:3226 Code: 48 83 78 10 00 0f 84 11 01 00 00 49 8b 2e 40 f6 c5 0f 0f 85 83 01 00 00 40 84 ff 0f 84 7c 01 00 00 41 8b 46 28 49 8b 5c 05 00 <48> 8d 4a 08 4c 89 e8 65 48 0f c7 4d 00 0f 94 c0 a8 01 74 a2 0f 1f RSP: 0018:ffffc900020ef7f8 EFLAGS: 00000202 RAX: 00000000000000e8 RBX: ffff88807ec45180 RCX: 0000000000000000 RDX: 0000000000190549 RSI: 00000000000001d0 RDI: ffffffff8c9f6801 RBP: 0000000000038580 R08: dffffc0000000000 R09: ffffed10173664a3 R10: ffffed10173664a3 R11: 0000000000000000 R12: ffffffff81da2e66 R13: ffff88807ec44a00 R14: ffff8881400078c0 R15: 0000000000000dc0 FS: 00007f5a201c08c0(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5a1da99028 CR3: 00000000229cc000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kmem_cache_zalloc include/linux/slab.h:711 [inline] __alloc_file+0x26/0x2f0 fs/file_table.c:101 alloc_empty_file+0xa9/0x1b0 fs/file_table.c:150 path_openat+0x111/0x3670 fs/namei.c:3545 do_filp_open+0x277/0x4f0 fs/namei.c:3586 do_sys_openat2+0x13b/0x500 fs/open.c:1200 do_sys_open fs/open.c:1216 [inline] __do_sys_open fs/open.c:1224 [inline] __se_sys_open fs/open.c:1220 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1220 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f5a1f74f840 Code: 73 01 c3 48 8b 0d 68 77 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 bb 20 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 RSP: 002b:00007ffdca18c328 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007ffdca18c630 RCX: 00007f5a1f74f840 RDX: 00000000000001a0 RSI: 0000000000080042 RDI: 000055709b8fdee0 RBP: 000000000000000d R08: 0000000000000000 R09: 00000000ffffffff R10: 0000000000000069 R11: 0000000000000246 R12: 00000000ffffffff R13: 000055709b8f2040 R14: 00007ffdca18c5f0 R15: 000055709b8fdf30 ---------------- Code disassembly (best guess): 0: 48 83 78 10 00 cmpq $0x0,0x10(%rax) 5: 0f 84 11 01 00 00 je 0x11c b: 49 8b 2e mov (%r14),%rbp e: 40 f6 c5 0f test $0xf,%bpl 12: 0f 85 83 01 00 00 jne 0x19b 18: 40 84 ff test %dil,%dil 1b: 0f 84 7c 01 00 00 je 0x19d 21: 41 8b 46 28 mov 0x28(%r14),%eax 25: 49 8b 5c 05 00 mov 0x0(%r13,%rax,1),%rbx * 2a: 48 8d 4a 08 lea 0x8(%rdx),%rcx <-- trapping instruction 2e: 4c 89 e8 mov %r13,%rax 31: 65 48 0f c7 4d 00 cmpxchg16b %gs:0x0(%rbp) 37: 0f 94 c0 sete %al 3a: a8 01 test $0x1,%al 3c: 74 a2 je 0xffffffe0 3e: 0f .byte 0xf 3f: 1f (bad)