bisecting fixing commit since 830a059cbba6832c11fefc0894c7ec7a27f75734 building syzkaller on 6a81331a1d4c744da9204d02ec88d558f7eea9c9 testing commit 830a059cbba6832c11fefc0894c7ec7a27f75734 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 4e4bab377ee2cc1c3551c91880ff00bd4e56c3224633728c12490fb0516dad00 run #0: crashed: INFO: task hung in nbd_ioctl run #1: crashed: INFO: task hung in blk_freeze_queue run #2: crashed: INFO: task hung in nbd_ioctl run #3: crashed: INFO: task hung in nbd_ioctl run #4: crashed: INFO: task hung in nbd_ioctl run #5: crashed: INFO: task hung in nbd_ioctl run #6: crashed: INFO: task hung in nbd_ioctl run #7: crashed: INFO: task hung in nbd_ioctl run #8: crashed: INFO: task hung in nbd_ioctl run #9: crashed: INFO: task hung in nbd_ioctl run #10: crashed: INFO: task hung in nbd_ioctl run #11: crashed: INFO: task hung in nbd_ioctl run #12: crashed: INFO: task hung in nbd_ioctl run #13: crashed: INFO: task hung in nbd_ioctl run #14: crashed: INFO: task hung in nbd_ioctl run #15: crashed: INFO: task hung in nbd_ioctl run #16: crashed: INFO: task hung in nbd_ioctl run #17: crashed: INFO: task hung in nbd_ioctl run #18: crashed: INFO: task hung in nbd_ioctl run #19: crashed: INFO: task hung in nbd_ioctl testing current HEAD b172b44fcb1771e083aad806fa96f3f60e2ddfac testing commit b172b44fcb1771e083aad806fa96f3f60e2ddfac compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: b5e23ec2cff9824f3a38ba9f883e7cb3309ae730b410ca500cb097f28f839e20 run #0: crashed: INFO: task hung in blk_freeze_queue run #1: crashed: INFO: task hung in blk_freeze_queue run #2: crashed: INFO: task hung in nbd_ioctl run #3: crashed: INFO: task hung in nbd_ioctl run #4: crashed: INFO: task hung in nbd_ioctl run #5: crashed: INFO: task hung in nbd_ioctl run #6: crashed: INFO: task hung in nbd_ioctl run #7: crashed: INFO: task hung in nbd_ioctl run #8: crashed: INFO: task hung in nbd_ioctl run #9: crashed: INFO: task hung in nbd_ioctl revisions tested: 2, total time: 34m45.014124743s (build: 22m9.816909295s, test: 12m6.820452286s) the crash still happens on HEAD commit msg: Linux 4.19.206 crash: INFO: task hung in nbd_ioctl Bluetooth: hci1: command 0x0406 tx timeout Bluetooth: hci3: command 0x0406 tx timeout Bluetooth: hci5: command 0x0406 tx timeout ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 INFO: task syz-executor.1:9909 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D27656 9909 8472 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] __nbd_ioctl drivers/block/nbd.c:1347 [inline] nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f30200ad188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffdd5f3cfef R14: 00007f30200ad300 R15: 0000000000022000 INFO: task syz-executor.1:9927 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D28728 9927 8472 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f302008c188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 RDX: 00000000000000ff RSI: 000000000000ab09 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008 R13: 00007ffdd5f3cfef R14: 00007f302008c300 R15: 0000000000022000 INFO: task syz-executor.1:9999 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D29216 9999 8472 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 blk_mq_freeze_queue_wait+0x105/0x220 block/blk-mq.c:152 blk_freeze_queue+0x3d/0x60 block/blk-mq.c:181 blk_mq_freeze_queue+0x9/0x10 block/blk-mq.c:190 nbd_add_socket+0x109/0x840 drivers/block/nbd.c:973 __nbd_ioctl drivers/block/nbd.c:1320 [inline] nbd_ioctl+0x4fd/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f302006b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c0b0 RCX: 0000000000466459 RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0b0 R13: 00007ffdd5f3cfef R14: 00007f302006b300 R15: 0000000000022000 INFO: task syz-executor.1:10001 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D29304 10001 8472 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f302004a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c158 RCX: 0000000000466459 RDX: 0000000000000f53 RSI: 000000000000ab07 RDI: 0000000000000007 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c158 R13: 00007ffdd5f3cfef R14: 00007f302004a300 R15: 0000000000022000 INFO: task syz-executor.4:9947 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28072 9947 8475 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f2f600c2188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 00000000000000ff RSI: 000000000000ab09 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffd6370807f R14: 00007f2f600c2300 R15: 0000000000022000 INFO: task syz-executor.4:9961 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28248 9961 8475 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] __nbd_ioctl drivers/block/nbd.c:1347 [inline] nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f2f600a1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008 R13: 00007ffd6370807f R14: 00007f2f600a1300 R15: 0000000000022000 INFO: task syz-executor.4:10002 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29216 10002 8475 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 blk_mq_freeze_queue_wait+0x105/0x220 block/blk-mq.c:152 blk_freeze_queue+0x3d/0x60 block/blk-mq.c:181 blk_mq_freeze_queue+0x9/0x10 block/blk-mq.c:190 nbd_add_socket+0x109/0x840 drivers/block/nbd.c:973 __nbd_ioctl drivers/block/nbd.c:1320 [inline] nbd_ioctl+0x4fd/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f2f60080188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c0b0 RCX: 0000000000466459 RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0b0 R13: 00007ffd6370807f R14: 00007f2f60080300 R15: 0000000000022000 INFO: task syz-executor.4:10003 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28664 10003 8475 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f2f6005f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c158 RCX: 0000000000466459 RDX: 0000000000000f53 RSI: 000000000000ab07 RDI: 0000000000000007 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c158 R13: 00007ffd6370807f R14: 00007f2f6005f300 R15: 0000000000022000 INFO: task syz-executor.3:9975 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28120 9975 8470 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] __nbd_ioctl drivers/block/nbd.c:1347 [inline] nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f22e10d4188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffde4d2ca7f R14: 00007f22e10d4300 R15: 0000000000022000 INFO: task syz-executor.3:9986 blocked for more than 140 seconds. Not tainted 4.19.206-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28728 9986 8470 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: 40 48 89 44 24 78 48 8b 6c 24 58 48 83 c4 60 c3 48 8d 0d 7a d0 1d 00 48 89 0c 24 48 8d 15 57 cf 27 01 48 89 54 24 08 0f 57 c0 <0f> 11 44 24 10 48 89 44 24 20 e8 d8 6c fe ff 48 8b 4c 24 28 48 8b RSP: 002b:00007f22e10b3188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 RDX: 00000000000000ff RSI: 000000000000ab09 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008 R13: 00007ffde4d2ca7f R14: 00007f22e10b3300 R15: 0000000000022000 Showing all locks held in the system: 2 locks held by kworker/u4:0/7: #0: 0000000076af635d (&rq->lock){-.-.}, at: idle_balance kernel/sched/fair.c:9702 [inline] #0: 0000000076af635d (&rq->lock){-.-.}, at: pick_next_task_fair+0x1006/0x1540 kernel/sched/fair.c:6841 #1: 000000004da8c4b4 (rcu_read_lock){....}, at: cpu_of kernel/sched/sched.h:921 [inline] #1: 000000004da8c4b4 (rcu_read_lock){....}, at: __update_idle_core+0x3c/0x3f0 kernel/sched/fair.c:6057 1 lock held by khungtaskd/1571: #0: 000000004da8c4b4 (rcu_read_lock){....}, at: debug_show_all_locks+0x5b/0x27a kernel/locking/lockdep.c:4443 1 lock held by syz-executor.1/9909: #0: 0000000011f658d3 (&nbd->config_lock){+.+.}, at: nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] #0: 0000000011f658d3 (&nbd->config_lock){+.+.}, at: __nbd_ioctl drivers/block/nbd.c:1347 [inline] #0: 0000000011f658d3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 1 lock held by syz-executor.1/9927: #0: 0000000011f658d3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/9999: #0: 0000000011f658d3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10001: #0: 0000000011f658d3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.4/9947: #0: 0000000056e5b487 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.4/9961: #0: 0000000056e5b487 (&nbd->config_lock){+.+.}, at: nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] #0: 0000000056e5b487 (&nbd->config_lock){+.+.}, at: __nbd_ioctl drivers/block/nbd.c:1347 [inline] #0: 0000000056e5b487 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 1 lock held by syz-executor.4/10002: #0: 0000000056e5b487 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.4/10003: #0: 0000000056e5b487 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/9975: #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: __nbd_ioctl drivers/block/nbd.c:1347 [inline] #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 1 lock held by syz-executor.3/9986: #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10004: #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10009: #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10012: #0: 0000000078ee6017 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/9976: #0: 00000000596c0cb2 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/9988: #0: 00000000596c0cb2 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10005: #0: 00000000596c0cb2 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/9994: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/9997: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/9998: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10000: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10015: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10016: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10017: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10018: #0: 000000006adc569c (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10007: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10011: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10013: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10014: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10019: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10020: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10021: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10022: #0: 0000000007ef24bd (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1571 Comm: khungtaskd Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x120 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x5c3/0xb40 kernel/hung_task.c:287 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 4.19.206-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0x36/0xb0 kernel/rcu/tree.c:348 Code: 02 00 48 83 ec 08 e8 89 d6 fa 01 48 ba 00 00 00 00 00 fc ff df 89 c0 48 8d 3c c5 00 af 5c 89 48 89 f9 48 c1 e9 03 80 3c 11 00 <75> 5d 48 03 1c c5 00 af 5c 89 be 04 00 00 00 4c 8d 63 10 4c 89 e7 RSP: 0018:ffff8880b599fcd8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000022ac0 RCX: 1ffffffff12b95e0 RDX: dffffc0000000000 RSI: ffffffff885023e0 RDI: ffffffff895caf00 RBP: ffff8880b599fcf0 R08: ffffed101744455b R09: ffffed101744455a R10: ffffed101744455a R11: ffff8880ba222ad3 R12: ffff8880a51ea1c0 R13: 0000000000000329 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4d078da000 CR3: 00000000955d2000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:1025 rcu_read_unlock include/linux/rcupdate.h:677 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:423 [inline] batadv_nc_worker+0x3a9/0x630 net/batman-adv/network-coding.c:730 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2153 worker_thread+0x85/0xb60 kernel/workqueue.c:2296 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ---------------- Code disassembly (best guess): 0: 02 00 add (%rax),%al 2: 48 83 ec 08 sub $0x8,%rsp 6: e8 89 d6 fa 01 callq 0x1fad694 b: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 12: fc ff df 15: 89 c0 mov %eax,%eax 17: 48 8d 3c c5 00 af 5c lea -0x76a35100(,%rax,8),%rdi 1e: 89 1f: 48 89 f9 mov %rdi,%rcx 22: 48 c1 e9 03 shr $0x3,%rcx 26: 80 3c 11 00 cmpb $0x0,(%rcx,%rdx,1) * 2a: 75 5d jne 0x89 <-- trapping instruction 2c: 48 03 1c c5 00 af 5c add -0x76a35100(,%rax,8),%rbx 33: 89 34: be 04 00 00 00 mov $0x4,%esi 39: 4c 8d 63 10 lea 0x10(%rbx),%r12 3d: 4c 89 e7 mov %r12,%rdi