bisecting cause commit starting from 288b9117de5cc1b7fb80f54b7c17deed6f018641 building syzkaller on 46c0be242e2548c889a96285e9c1ec97db28efe2 testing commit 288b9117de5cc1b7fb80f54b7c17deed6f018641 with gcc (GCC) 8.1.0 all runs: crashed: INFO: task hung in pipe_write testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 all runs: OK # git bisect start 288b9117de5cc1b7fb80f54b7c17deed6f018641 v5.3 Bisecting: 6816 revisions left to test after this (roughly 13 steps) [3d47b92b5de3ba881ec266fb4353087a18649b08] Merge remote-tracking branch 'rdma/for-next' testing commit 3d47b92b5de3ba881ec266fb4353087a18649b08 with gcc (GCC) 8.1.0 all runs: crashed: INFO: task hung in pipe_write # git bisect bad 3d47b92b5de3ba881ec266fb4353087a18649b08 Bisecting: 3326 revisions left to test after this (roughly 12 steps) [6ab8ad31601f29470eb895fd95e5c963e125aa1b] Merge tag 'sound-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 6ab8ad31601f29470eb895fd95e5c963e125aa1b with gcc (GCC) 8.1.0 all runs: OK # git bisect good 6ab8ad31601f29470eb895fd95e5c963e125aa1b Bisecting: 1647 revisions left to test after this (roughly 11 steps) [67cfee8d258332b3dc1baac4f9eee3699f1f65dc] Merge remote-tracking branch 'mips/mips-next' testing commit 67cfee8d258332b3dc1baac4f9eee3699f1f65dc with gcc (GCC) 8.1.0 all runs: OK # git bisect good 67cfee8d258332b3dc1baac4f9eee3699f1f65dc Bisecting: 817 revisions left to test after this (roughly 10 steps) [9f077ed906a93d1200d05b1521845217a21f2c20] Merge remote-tracking branch 'nfs-anna/linux-next' testing commit 9f077ed906a93d1200d05b1521845217a21f2c20 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 9f077ed906a93d1200d05b1521845217a21f2c20 Bisecting: 496 revisions left to test after this (roughly 9 steps) [6dd666d234ccc8fcecf621c2b5351e62cf479fa3] Merge remote-tracking branch 'pci/next' testing commit 6dd666d234ccc8fcecf621c2b5351e62cf479fa3 with gcc (GCC) 8.1.0 all runs: crashed: INFO: task hung in pipe_write # git bisect bad 6dd666d234ccc8fcecf621c2b5351e62cf479fa3 Bisecting: 147 revisions left to test after this (roughly 7 steps) [26b469a5faa45539fb7d0b91dab6958eba2b9665] Merge remote-tracking branch 'vfs/for-next' testing commit 26b469a5faa45539fb7d0b91dab6958eba2b9665 with gcc (GCC) 8.1.0 all runs: crashed: INFO: task hung in pipe_write # git bisect bad 26b469a5faa45539fb7d0b91dab6958eba2b9665 Bisecting: 72 revisions left to test after this (roughly 7 steps) [6a7e6d6228550c8365a8336b0d4196b1b6d1a095] Merge remote-tracking branch 'xfs/for-next' testing commit 6a7e6d6228550c8365a8336b0d4196b1b6d1a095 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 6a7e6d6228550c8365a8336b0d4196b1b6d1a095 Bisecting: 41 revisions left to test after this (roughly 5 steps) [82acbd7ae5d485e18284253ba8658188251fa259] gfs2: Convert gfs2 to fs_context testing commit 82acbd7ae5d485e18284253ba8658188251fa259 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 82acbd7ae5d485e18284253ba8658188251fa259 Bisecting: 19 revisions left to test after this (roughly 4 steps) [07c7cd86d2904befa3f55e4390b31c263d80e06f] Merge remote-tracking branch 'file-locks/locks-next' testing commit 07c7cd86d2904befa3f55e4390b31c263d80e06f with gcc (GCC) 8.1.0 all runs: crashed: INFO: task hung in pipe_write # git bisect bad 07c7cd86d2904befa3f55e4390b31c263d80e06f Bisecting: 10 revisions left to test after this (roughly 4 steps) [db10bd824bc0353702231f1294b58903cb66bac7] iomap: split size and error for iomap_dio_rw ->end_io testing commit db10bd824bc0353702231f1294b58903cb66bac7 with gcc (GCC) 8.1.0 all runs: OK # git bisect good db10bd824bc0353702231f1294b58903cb66bac7 Bisecting: 4 revisions left to test after this (roughly 3 steps) [059818536bfbb75b4821131bb03f449cfd6d7418] Merge remote-tracking branch 'djw-vfs/vfs-for-next' testing commit 059818536bfbb75b4821131bb03f449cfd6d7418 with gcc (GCC) 8.1.0 all runs: crashed: INFO: task hung in pipe_write # git bisect bad 059818536bfbb75b4821131bb03f449cfd6d7418 Bisecting: 2 revisions left to test after this (roughly 2 steps) [cfb864757d8690631aadf1c4b80022c18ae865b3] splice: only read in as much information as there is pipe buffer space testing commit cfb864757d8690631aadf1c4b80022c18ae865b3 with gcc (GCC) 8.1.0 run #0: crashed: INFO: task hung in corrupted run #1: crashed: INFO: task hung in pipe_write run #2: crashed: INFO: task hung in pipe_write run #3: crashed: INFO: task hung in pipe_write run #4: crashed: INFO: task hung in pipe_write run #5: crashed: INFO: task hung in pipe_write run #6: crashed: INFO: task hung in pipe_write run #7: crashed: INFO: task hung in pipe_write run #8: crashed: INFO: task hung in pipe_write run #9: crashed: INFO: task hung in pipe_write # git bisect bad cfb864757d8690631aadf1c4b80022c18ae865b3 Bisecting: 0 revisions left to test after this (roughly 1 step) [dc617f29dbe5ef0c8ced65ce62c464af1daaab3d] vfs: don't allow writes to swap files testing commit dc617f29dbe5ef0c8ced65ce62c464af1daaab3d with gcc (GCC) 8.1.0 all runs: OK # git bisect good dc617f29dbe5ef0c8ced65ce62c464af1daaab3d cfb864757d8690631aadf1c4b80022c18ae865b3 is the first bad commit commit cfb864757d8690631aadf1c4b80022c18ae865b3 Author: Darrick J. Wong Date: Tue Sep 17 09:05:22 2019 -0700 splice: only read in as much information as there is pipe buffer space Andreas Grünbacher reports that on the two filesystems that support iomap directio, it's possible for splice() to return -EAGAIN (instead of a short splice) if the pipe being written to has less space available in its pipe buffers than the length supplied by the calling process. Months ago we fixed splice_direct_to_actor to clamp the length of the read request to the size of the splice pipe. Do the same to do_splice. Fixes: 17614445576b6 ("splice: don't read more than available pipe space") Reported-by: Andreas Grünbacher Signed-off-by: Darrick J. Wong Reviewed-by: Andreas Grünbacher Tested-by: Andreas Grünbacher :040000 040000 7716c9f7ef75775a3c5ad529186e5a99fd8eec89 cc587f7becf2571e9f5251cf082c625c571e7af6 M fs revisions tested: 15, total time: 3h42m13.973381233s (build: 1h25m58.615347843s, test: 2h10m51.441145407s) first bad commit: cfb864757d8690631aadf1c4b80022c18ae865b3 splice: only read in as much information as there is pipe buffer space cc: ["agruenba@redhat.com" "darrick.wong@oracle.com" "linux-fsdevel@vger.kernel.org" "linux-kernel@vger.kernel.org" "viro@zeniv.linux.org.uk"] crash: INFO: task hung in pipe_write INFO: task syz-executor.5:8682 blocked for more than 143 seconds. Not tainted 5.3.0-rc2+ #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D27392 8682 8662 0x00004004 Call Trace: context_switch kernel/sched/core.c:3254 [inline] __schedule+0x713/0x1520 kernel/sched/core.c:3880 schedule+0x8f/0x260 kernel/sched/core.c:3944 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4003 __mutex_lock_common kernel/locking/mutex.c:1007 [inline] __mutex_lock+0x8bf/0x1410 kernel/locking/mutex.c:1077 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1092 pipe_lock_nested fs/pipe.c:63 [inline] pipe_lock fs/pipe.c:71 [inline] pipe_wait+0x185/0x1b0 fs/pipe.c:119 pipe_write+0x49b/0xcd0 fs/pipe.c:497 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3416b0cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 RDX: 00000000fffffc8f RSI: 0000000020000140 RDI: 0000000000000007 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3416b0d6d4 R13: 00000000004c9a0d R14: 00000000004e10e8 R15: 00000000ffffffff INFO: task syz-executor.4:8703 blocked for more than 144 seconds. Not tainted 5.3.0-rc2+ #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27392 8703 8667 0x00004004 Call Trace: context_switch kernel/sched/core.c:3254 [inline] __schedule+0x713/0x1520 kernel/sched/core.c:3880 schedule+0x8f/0x260 kernel/sched/core.c:3944 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4003 __mutex_lock_common kernel/locking/mutex.c:1007 [inline] __mutex_lock+0x8bf/0x1410 kernel/locking/mutex.c:1077 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1092 pipe_lock_nested fs/pipe.c:63 [inline] pipe_lock fs/pipe.c:71 [inline] pipe_wait+0x185/0x1b0 fs/pipe.c:119 pipe_write+0x49b/0xcd0 fs/pipe.c:497 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fbc65c91c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 RDX: 00000000fffffc8f RSI: 0000000020000140 RDI: 0000000000000007 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbc65c926d4 R13: 00000000004c9a0d R14: 00000000004e10e8 R15: 00000000ffffffff INFO: task syz-executor.2:8706 blocked for more than 145 seconds. Not tainted 5.3.0-rc2+ #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D27392 8706 8659 0x00004004 Call Trace: context_switch kernel/sched/core.c:3254 [inline] __schedule+0x713/0x1520 kernel/sched/core.c:3880 schedule+0x8f/0x260 kernel/sched/core.c:3944 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4003 __mutex_lock_common kernel/locking/mutex.c:1007 [inline] __mutex_lock+0x8bf/0x1410 kernel/locking/mutex.c:1077 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1092 pipe_lock_nested fs/pipe.c:63 [inline] pipe_lock fs/pipe.c:71 [inline] pipe_wait+0x185/0x1b0 fs/pipe.c:119 pipe_write+0x49b/0xcd0 fs/pipe.c:497 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f769169fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 RDX: 00000000fffffc8f RSI: 0000000020000140 RDI: 0000000000000007 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f76916a06d4 R13: 00000000004c9a0d R14: 00000000004e10e8 R15: 00000000ffffffff INFO: task syz-executor.0:8716 blocked for more than 146 seconds. Not tainted 5.3.0-rc2+ #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D27344 8716 8666 0x00004004 Call Trace: context_switch kernel/sched/core.c:3254 [inline] __schedule+0x713/0x1520 kernel/sched/core.c:3880 schedule+0x8f/0x260 kernel/sched/core.c:3944 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4003 __mutex_lock_common kernel/locking/mutex.c:1007 [inline] __mutex_lock+0x8bf/0x1410 kernel/locking/mutex.c:1077 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1092 pipe_lock_nested fs/pipe.c:63 [inline] pipe_lock fs/pipe.c:71 [inline] pipe_wait+0x185/0x1b0 fs/pipe.c:119 pipe_write+0x49b/0xcd0 fs/pipe.c:497 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f789590bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 RDX: 00000000fffffc8f RSI: 0000000020000140 RDI: 0000000000000007 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f789590c6d4 R13: 00000000004c9a0d R14: 00000000004e10e8 R15: 00000000ffffffff INFO: task syz-executor.3:8725 blocked for more than 147 seconds. Not tainted 5.3.0-rc2+ #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D27392 8725 8664 0x00004004 Call Trace: context_switch kernel/sched/core.c:3254 [inline] __schedule+0x713/0x1520 kernel/sched/core.c:3880 schedule+0x8f/0x260 kernel/sched/core.c:3944 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4003 __mutex_lock_common kernel/locking/mutex.c:1007 [inline] __mutex_lock+0x8bf/0x1410 kernel/locking/mutex.c:1077 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1092 pipe_lock_nested fs/pipe.c:63 [inline] pipe_lock fs/pipe.c:71 [inline] pipe_wait+0x185/0x1b0 fs/pipe.c:119 pipe_write+0x49b/0xcd0 fs/pipe.c:497 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fd6c0f6ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 RDX: 00000000fffffc8f RSI: 0000000020000140 RDI: 0000000000000007 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd6c0f6b6d4 R13: 00000000004c9a0d R14: 00000000004e10e8 R15: 00000000ffffffff INFO: task syz-executor.1:8724 blocked for more than 148 seconds. Not tainted 5.3.0-rc2+ #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D27392 8724 8657 0x00004004 Call Trace: context_switch kernel/sched/core.c:3254 [inline] __schedule+0x713/0x1520 kernel/sched/core.c:3880 schedule+0x8f/0x260 kernel/sched/core.c:3944 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:4003 __mutex_lock_common kernel/locking/mutex.c:1007 [inline] __mutex_lock+0x8bf/0x1410 kernel/locking/mutex.c:1077 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1092 pipe_lock_nested fs/pipe.c:63 [inline] pipe_lock fs/pipe.c:71 [inline] pipe_wait+0x185/0x1b0 fs/pipe.c:119 pipe_write+0x49b/0xcd0 fs/pipe.c:497 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x3fd/0x7e0 fs/read_write.c:483 __vfs_write+0x94/0x110 fs/read_write.c:496 vfs_write+0x18a/0x520 fs/read_write.c:558 ksys_write+0x105/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:620 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f0b69d73c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 RDX: 00000000fffffc8f RSI: 0000000020000140 RDI: 0000000000000007 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b69d746d4 R13: 00000000004c9a0d R14: 00000000004e10e8 R15: 00000000ffffffff INFO: lockdep is turned off. NMI backtrace for cpu 0 CPU: 0 PID: 1055 Comm: khungtaskd Not tainted 5.3.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 nmi_cpu_backtrace.cold.7+0x4b/0x84 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x18b/0x1b7 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0x592/0xb60 kernel/hung_task.c:289 kthread+0x331/0x3f0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 8730 Comm: syz-executor.3 Not tainted 5.3.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:iov_iter_alignment+0x2a7/0x6b0 lib/iov_iter.c:1200 Code: 18 41 89 cc 49 c1 e4 04 4d 01 c4 49 8d 7c 24 0c 48 89 fa 48 c1 ea 03 44 0f b6 1c 32 48 89 fa 83 e2 07 83 c2 03 44 38 da 7c 09 <45> 84 db 0f 85 dc 02 00 00 49 8d 7c 24 08 41 8b 54 24 0c 49 89 fb RSP: 0018:ffff88807a32f458 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 000000000000f000 RCX: 0000000000000000 RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff88807a9d448c RBP: ffff88807a32f4b0 R08: ffff88807a9d4480 R09: ffffed100f465f9d R10: ffff88807a32fce8 R11: 0000000000000000 R12: ffff88807a9d4480 R13: ffff88807a32fcd0 R14: 0000000000240000 R15: 0000000000000000 FS: 00007fd6c0f4a700(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 0000000095a17000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_blockdev_direct_IO+0x1a5/0x5a10 fs/direct-io.c:1181 __blockdev_direct_IO+0x72/0xd9 fs/direct-io.c:1413 ext4_direct_IO_write fs/ext4/inode.c:3788 [inline] ext4_direct_IO+0xa92/0x14e0 fs/ext4/inode.c:3915 generic_file_direct_write+0x1e7/0x400 mm/filemap.c:3233 __generic_file_write_iter+0x270/0x580 mm/filemap.c:3416 ext4_file_write_iter+0x2cb/0x1100 fs/ext4/file.c:270 call_write_iter include/linux/fs.h:1870 [inline] do_iter_readv_writev+0x526/0xa70 fs/read_write.c:693 do_iter_write+0x12a/0x510 fs/read_write.c:970 vfs_iter_write+0x5b/0xb0 fs/read_write.c:983 iter_file_splice_write+0x556/0xc00 fs/splice.c:746 do_splice_from fs/splice.c:848 [inline] do_splice+0x60a/0x1450 fs/splice.c:1161 __do_sys_splice fs/splice.c:1436 [inline] __se_sys_splice fs/splice.c:1416 [inline] __x64_sys_splice+0x248/0x300 fs/splice.c:1416 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4598e9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fd6c0f49c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004598e9 RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000006 RBP: 000000000075bfc8 R08: 000100000000ffe0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd6c0f4a6d4 R13: 00000000004c90ca R14: 00000000004df570 R15: 00000000ffffffff