ci starts bisection 2024-09-22 11:59:30.045690946 +0000 UTC m=+249518.279031589 bisecting fixing commit since ea5f6ad9ad9645733b72ab53a98e719b460d36a6 building syzkaller on c2e0726105cc811a456d900c62443159acc29c32 ensuring issue is reproducible on original commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: dc2303af64af9ea9527706e13fe1407768e38a1b9d8f76e5ab0212f32177c709 run #0: crashed: INFO: task hung in blk_trace_setup run #1: crashed: INFO: task hung in blk_trace_setup run #2: crashed: INFO: task hung in blk_trace_setup run #3: crashed: INFO: task hung in blk_trace_setup run #4: crashed: INFO: task hung in blk_trace_setup run #5: crashed: INFO: task hung in blk_trace_setup run #6: crashed: INFO: task hung in blk_trace_setup run #7: crashed: INFO: task hung in blk_trace_remove run #8: crashed: INFO: task hung in blk_trace_setup run #9: crashed: INFO: task hung in blk_trace_remove run #10: crashed: INFO: task hung in blk_trace_setup run #11: crashed: INFO: task hung in blk_trace_setup run #12: crashed: INFO: task hung in blk_trace_setup run #13: crashed: INFO: task hung in blk_trace_setup run #14: crashed: INFO: task hung in blk_trace_setup run #15: crashed: INFO: task hung in blk_trace_setup run #16: crashed: INFO: task hung in blk_trace_setup run #17: crashed: INFO: task hung in blk_trace_remove run #18: crashed: INFO: task hung in blk_trace_remove run #19: crashed: INFO: task hung in blk_trace_remove representative crash: INFO: task hung in blk_trace_setup, types: [HANG] check whether we can drop unnecessary instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: dc66993cfbf2186acb8b46b7c8d1f22ab00f202dfdea18eb38bb793a9ea633b3 all runs: crashed: INFO: task hung in blk_trace_remove representative crash: INFO: task hung in blk_trace_remove, types: [HANG] the bug reproduces without the instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed kconfig minimization: base=4045 full=8032 leaves diff=2006 split chunks (needed=false): <2006> split chunk #0 of len 2006 into 5 parts testing without sub-chunk 1/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fa0731fcd5f118298ebb2527a1f763b541f40773ca8d18f67703e790f8f330ee run #0: crashed: INFO: task hung in blk_trace_remove run #1: crashed: INFO: task hung in blk_trace_remove run #2: crashed: INFO: task hung in blk_trace_remove run #3: crashed: INFO: task hung in blk_trace_setup run #4: crashed: INFO: task hung in blk_trace_remove run #5: crashed: INFO: task hung in blk_trace_setup run #6: crashed: INFO: task hung in blk_trace_setup run #7: crashed: INFO: task hung in blk_trace_remove run #8: crashed: INFO: task hung in blk_trace_setup run #9: crashed: INFO: task hung in blk_trace_remove representative crash: INFO: task hung in blk_trace_remove, types: [HANG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c5eca5b5d9bb39df40e72c08d154aaca4b7febd86e800cfcf41a3b01cb4d5081 run #0: crashed: INFO: task hung in corrupted run #1: crashed: INFO: task hung in blk_trace_remove run #2: crashed: INFO: task hung in blk_trace_remove run #3: crashed: INFO: task hung in blk_trace_remove run #4: crashed: INFO: task hung in blk_trace_remove run #5: crashed: INFO: task hung in blk_trace_remove run #6: crashed: INFO: task hung in blk_trace_setup run #7: crashed: INFO: task hung in blk_trace_remove run #8: crashed: INFO: task hung in blk_trace_remove run #9: crashed: INFO: task hung in blk_trace_remove representative crash: INFO: task hung in corrupted, types: [HANG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0c96b73e5b1b075fd18d3fd4fc042c6f345750380685d88986cdcece8d371ef0 run #0: crashed: INFO: task hung in blk_trace_setup run #1: crashed: INFO: task hung in blk_trace_remove run #2: crashed: INFO: task hung in blk_trace_setup run #3: crashed: INFO: task hung in blk_trace_remove run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: INFO: task hung in blk_trace_setup, types: [HANG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0590c1a50dbf893039c67a23760cb095381470afcfddc11503b3e6d3c933d7ce run #0: crashed: INFO: task hung in blk_trace_remove run #1: crashed: INFO: task hung in blk_trace_setup run #2: crashed: INFO: task hung in blk_trace_remove run #3: crashed: INFO: task hung in blk_trace_remove run #4: crashed: INFO: task hung in blk_trace_setup run #5: crashed: INFO: task hung in blk_trace_remove run #6: crashed: INFO: task hung in blk_trace_setup run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in dst_dev_put run #8: crashed: INFO: task hung in blk_trace_remove run #9: crashed: INFO: task hung in blk_trace_remove run #10: crashed: INFO: task hung in blk_trace_setup run #11: crashed: INFO: task hung in blk_trace_setup run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: INFO: task hung in blk_trace_remove, types: [HANG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed testing commit ea5f6ad9ad9645733b72ab53a98e719b460d36a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4b31885290c3703e80fa5b5d35e04128a55e5b59e1db4cd4b6485cdc0e3c6742 run #0: crashed: INFO: task hung in blk_trace_remove run #1: crashed: INFO: task hung in blk_trace_setup run #2: crashed: INFO: task hung in blk_trace_remove run #3: crashed: INFO: task hung in blk_trace_remove run #4: crashed: INFO: task hung in blk_trace_remove run #5: crashed: INFO: task hung in blk_trace_setup run #6: crashed: INFO: task hung in blk_trace_setup run #7: OK run #8: OK run #9: crashed: INFO: task hung in blk_trace_setup run #10: OK run #11: OK run #12: crashed: INFO: task hung in blk_trace_remove run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: INFO: task hung in blk_trace_remove, types: [HANG] the chunk can be dropped disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed testing current HEAD 88264981f2082248e892a706b2c5004650faac54 testing commit 88264981f2082248e892a706b2c5004650faac54 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b7581e87f57e1eb2d766d666121462fda8e06164e3412f642bc815a1949f835e run #0: crashed: INFO: task hung in blk_trace_setup run #1: crashed: INFO: task hung in blk_trace_setup run #2: crashed: INFO: task hung in blk_trace_setup run #3: crashed: INFO: task hung in blk_trace_remove run #4: crashed: INFO: task hung in blk_trace_remove run #5: crashed: INFO: task hung in blk_trace_remove run #6: crashed: INFO: task hung in blk_trace_remove run #7: crashed: INFO: task hung in blk_trace_remove run #8: crashed: INFO: task hung in blk_trace_setup run #9: crashed: INFO: task hung in blk_trace_setup run #10: crashed: INFO: task hung in blk_trace_setup run #11: crashed: INFO: task hung in blk_trace_remove run #12: crashed: INFO: task hung in blk_trace_setup run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: INFO: task hung in blk_trace_setup, types: [HANG] crash still not fixed/happens on the oldest tested release reproducer is flaky (0.45 repro chance estimate) revisions tested: 8, total time: 2h9m43.427148992s (build: 52m6.672963781s, test: 1h12m28.452754487s) crash still not fixed or there were kernel test errors commit msg: Merge tag 'sched_ext-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext crash: INFO: task hung in blk_trace_setup INFO: task syz-executor.5:22973 blocked for more than 143 seconds. Not tainted 6.11.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.5 state:D stack:13944 pid:22973 tgid:22972 ppid:22519 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5315 [inline] __schedule+0x6c3/0xa30 kernel/sched/core.c:6674 __schedule_loop kernel/sched/core.c:6751 [inline] schedule+0xac/0x140 kernel/sched/core.c:6766 schedule_preempt_disabled+0x32/0x60 kernel/sched/core.c:6823 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x44a/0x970 kernel/locking/mutex.c:752 blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 sg_ioctl_common drivers/scsi/sg.c:1121 [inline] sg_ioctl+0x5a5/0xc90 drivers/scsi/sg.c:1163 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0x6d/0xb0 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f935c8fcee9 RSP: 002b:00007f935c47f0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f935ca2bf80 RCX: 00007f935c8fcee9 RDX: 0000000020000040 RSI: 00000000c0481273 RDI: 0000000000000003 RBP: 00007f935c94949e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f935ca2bf80 R15: 00007fff2f2b72c8 INFO: task syz-executor.5:22974 blocked for more than 143 seconds. Not tainted 6.11.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.5 state:D stack:14608 pid:22974 tgid:22972 ppid:22519 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5315 [inline] __schedule+0x6c3/0xa30 kernel/sched/core.c:6674 __schedule_loop kernel/sched/core.c:6751 [inline] schedule+0xac/0x140 kernel/sched/core.c:6766 schedule_preempt_disabled+0x32/0x60 kernel/sched/core.c:6823 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x44a/0x970 kernel/locking/mutex.c:752 blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 sg_ioctl_common drivers/scsi/sg.c:1129 [inline] sg_ioctl+0x2ed/0xc90 drivers/scsi/sg.c:1163 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0x6d/0xb0 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f935c8fcee9 RSP: 002b:00007f935c45e0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f935ca2c050 RCX: 00007f935c8fcee9 RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000003 RBP: 00007f935c94949e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f935ca2c050 R15: 00007fff2f2b72c8 Showing all locks held in the system: 1 lock held by khungtaskd/29: #0: ffffffff82777e10 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff82777e10 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff82777e10 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x30/0x100 kernel/locking/lockdep.c:6701 2 locks held by getty/791: #0: ffff8881052b30a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x20/0x40 drivers/tty/tty_ldisc.c:243 #1: ffffc900001fb2f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x23d/0x910 drivers/tty/n_tty.c:2211 2 locks held by kworker/u8:8/3055: #0: ffff888100078948 ((wq_completion)events_unbound){....}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff888100078948 ((wq_completion)events_unbound){....}-{0:0}, at: process_scheduled_works+0x246/0x5c0 kernel/workqueue.c:3310 #1: ffffc90001a37e58 ((work_completion)(&(&kfence_timer)->work)){....}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc90001a37e58 ((work_completion)(&(&kfence_timer)->work)){....}-{0:0}, at: process_scheduled_works+0x266/0x5c0 kernel/workqueue.c:3310 2 locks held by syz-executor.1/22517: 1 lock held by syz-executor.5/22973: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.5/22974: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.2/23430: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.2/23431: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor/23889: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor/23890: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.3/24346: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.3/24347: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.4/24804: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.4/24805: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.1/25261: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.1/25262: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.5/25718: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.5/25719: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.2/26176: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.2/26177: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor/26634: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor/26635: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.3/27091: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.3/27092: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.4/27549: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.4/27550: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.1/28006: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.1/28007: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.5/28463: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.5/28464: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.2/28921: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.2/28922: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor/29379: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor/29380: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.3/29836: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.3/29837: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.4/30294: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.4/30295: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.1/30751: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.1/30752: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.5/31208: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.5/31209: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.2/31666: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.2/31667: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor/32124: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor/32125: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 1 lock held by syz-executor.3/32581: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_setup+0x41/0x130 kernel/trace/blktrace.c:647 1 lock held by syz-executor.3/32582: #0: ffff8881062ed660 (&q->debugfs_mutex){....}-{3:3}, at: blk_trace_remove+0x1b/0x40 kernel/trace/blktrace.c:406 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 29 Comm: khungtaskd Not tainted 6.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x3e/0xe0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x146/0x160 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x8e/0x140 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0x5e4/0x610 kernel/hung_task.c:379 kthread+0xec/0x100 kernel/kthread.c:389 ret_from_fork+0x34/0x40 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 22517 Comm: syz-executor.1 Not tainted 6.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:find_held_lock kernel/locking/lockdep.c:5312 [inline] RIP: 0010:__lock_release kernel/locking/lockdep.c:5497 [inline] RIP: 0010:lock_release+0xfe/0x2d0 kernel/locking/lockdep.c:5843 Code: 6c 24 10 48 89 1c 24 41 8d 5c 24 ff 48 63 c3 4c 8d 34 80 4b 8d ac f5 00 0a 00 00 48 89 ef 4c 89 fe e8 36 71 c0 00 89 5c 24 0c <85> c0 0f 84 89 00 00 00 48 85 ed 0f 84 bd 00 00 00 8b 45 20 3d 00 RSP: 0018:ffffc90001097c68 EFLAGS: 00000046 RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000001 RDX: adf33ccc0f23a820 RSI: ffffffff86ec6230 RDI: ffff8881fa29a590 RBP: ffff8881fa29a590 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff8881fa299b40 R14: 000000000000000a R15: ffffffff86ec6230 FS: 00007fee488ae6c0(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d024c2c040 CR3: 00000001c0bba000 CR4: 0000000000350ef0 Call Trace: __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline] _raw_spin_unlock_irqrestore+0x2d/0xb0 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:998 [inline] debug_check_no_obj_freed+0x1f2/0x250 lib/debugobjects.c:1019 free_pages_prepare mm/page_alloc.c:1115 [inline] free_unref_page+0x1ac/0x610 mm/page_alloc.c:2638 relay_destroy_buf+0x37/0xd0 kernel/relay.c:201 relay_remove_buf kernel/relay.c:221 [inline] kref_put include/linux/kref.h:65 [inline] relay_close_buf kernel/relay.c:430 [inline] relay_close+0x9b/0x210 kernel/relay.c:766 blk_trace_free+0x12/0x70 kernel/trace/blktrace.c:316 blk_trace_cleanup kernel/trace/blktrace.c:384 [inline] __blk_trace_remove+0x82/0xa0 kernel/trace/blktrace.c:397 blk_trace_remove+0x23/0x40 kernel/trace/blktrace.c:407 sg_ioctl_common drivers/scsi/sg.c:1129 [inline] sg_ioctl+0x2ed/0xc90 drivers/scsi/sg.c:1163 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0x6d/0xb0 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fee48d4cee9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fee488ae0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fee48e7c050 RCX: 00007fee48d4cee9 RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000003 RBP: 00007fee48d9949e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fee48e7c050 R15: 00007ffed8bb9a58