bisecting fixing commit since 811218eceeaa7618652e1b8d11caeff67ab42072 building syzkaller on a52ee10ae11c1342cfca60cf3957619bcf92bd1a testing commit 811218eceeaa7618652e1b8d11caeff67ab42072 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f034ce9695321c6357560699acf3ef9c6a3b84e0d83ba653965c5da2789ea72a all runs: crashed: INFO: task hung in acct testing current HEAD 2950c9c5e0df6bd34af45a5168bbee345e95eae2 testing commit 2950c9c5e0df6bd34af45a5168bbee345e95eae2 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 47b03ae143a6346fda9de94073c3c24ed9908885fdd1dbe1c82134118f6e80a8 all runs: crashed: INFO: task hung in acct revisions tested: 2, total time: 43m28.418939199s (build: 21m33.164600282s, test: 21m16.239013285s) the crash still happens on HEAD commit msg: Linux 4.19.207 crash: INFO: task hung in acct autofs4:pid:13804:autofs_fill_super: called with bogus options Bluetooth: hci2: command 0x0406 tx timeout Bluetooth: hci3: command 0x0406 tx timeout Bluetooth: hci0: command 0x0406 tx timeout Bluetooth: hci5: command 0x0406 tx timeout INFO: task syz-executor.2:13450 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29064 13450 12579 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: Bad RIP value. RSP: 002b:00007ff486ff2188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffd726b39af R14: 00007ff486ff2300 R15: 0000000000022000 INFO: task syz-executor.5:13452 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D29784 13452 12582 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: Bad RIP value. RSP: 002b:00007fae84046188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffe01994a3f R14: 00007fae84046300 R15: 0000000000022000 INFO: task syz-executor.4:13456 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29784 13456 11693 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: Bad RIP value. RSP: 002b:00007fe6eaa5c188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffdaa01ee5f R14: 00007fe6eaa5c300 R15: 0000000000022000 INFO: task syz-executor.0:13458 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D29448 13458 12583 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: Bad RIP value. RSP: 002b:00007fa6aa874188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007fff7b3274ff R14: 00007fa6aa874300 R15: 0000000000022000 INFO: task syz-executor.5:13471 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D29448 13471 12582 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: Bad RIP value. RSP: 002b:00007fae84046188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffe01994a3f R14: 00007fae84046300 R15: 0000000000022000 INFO: task syz-executor.0:13478 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D29784 13478 12583 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: Bad RIP value. RSP: 002b:00007fa6aa874188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007fff7b3274ff R14: 00007fa6aa874300 R15: 0000000000022000 INFO: task syz-executor.4:13481 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29784 13481 11693 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: 00 e9 30 ff ff ff 83 f9 77 75 26 48 83 b8 d8 00 00 00 00 7c e2 83 f9 72 75 10 80 78 19 00 74 0a b9 03 00 00 00 e9 0c ff ff ff <31> c9 e9 05 ff ff ff 83 f9 72 eb e2 e8 c6 35 00 00 e9 c1 fe ff ff RSP: 002b:00007fe6eaa5c188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffdaa01ee5f R14: 00007fe6eaa5c300 R15: 0000000000022000 INFO: task syz-executor.1:13487 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D29784 13487 11694 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: 00 e9 30 ff ff ff 83 f9 77 75 26 48 83 b8 d8 00 00 00 00 7c e2 83 f9 72 75 10 80 78 19 00 74 0a b9 03 00 00 00 e9 0c ff ff ff <31> c9 e9 05 ff ff ff 83 f9 72 eb e2 e8 c6 35 00 00 e9 c1 fe ff ff RSP: 002b:00007f027b10a188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffd7e6feabf R14: 00007f027b10a300 R15: 0000000000022000 INFO: task syz-executor.0:13486 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D29448 13486 12583 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: 00 e9 30 ff ff ff 83 f9 77 75 26 48 83 b8 d8 00 00 00 00 7c e2 83 f9 72 75 10 80 78 19 00 74 0a b9 03 00 00 00 e9 0c ff ff ff <31> c9 e9 05 ff ff ff 83 f9 72 eb e2 e8 c6 35 00 00 e9 c1 fe ff ff RSP: 002b:00007fa6aa874188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007fff7b3274ff R14: 00007fa6aa874300 R15: 0000000000022000 INFO: task syz-executor.5:13489 blocked for more than 140 seconds. Not tainted 4.19.207-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D29784 13489 12582 0x00000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1016 [inline] __mutex_lock+0x571/0x11c0 kernel/locking/mutex.c:1078 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1093 __do_sys_acct kernel/acct.c:285 [inline] __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 __x64_sys_acct+0x2c/0x40 kernel/acct.c:273 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465b09 Code: 00 e9 30 ff ff ff 83 f9 77 75 26 48 83 b8 d8 00 00 00 00 7c e2 83 f9 72 75 10 80 78 19 00 74 0a b9 03 00 00 00 e9 0c ff ff ff <31> c9 e9 05 ff ff ff 83 f9 72 eb e2 e8 c6 35 00 00 e9 c1 fe ff ff RSP: 002b:00007fae84046188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffe01994a3f R14: 00007fae84046300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1570: #0: 00000000ddbe7cff (rcu_read_lock){....}, at: debug_show_all_locks+0x5b/0x27a kernel/locking/lockdep.c:4443 3 locks held by in:imklog/7809: #0: 00000000ec07f62c (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xa7/0xd0 fs/file.c:767 #1: 0000000090f7faa6 (logbuf_lock){....}, at: __debug_check_no_obj_freed lib/debugobjects.c:776 [inline] #1: 0000000090f7faa6 (logbuf_lock){....}, at: debug_check_no_obj_freed+0xad/0x430 lib/debugobjects.c:817 #2: 00000000ddbe7cff (rcu_read_lock){....}, at: trace_sched_stat_runtime include/trace/events/sched.h:428 [inline] #2: 00000000ddbe7cff (rcu_read_lock){....}, at: update_curr+0x2cf/0x870 kernel/sched/fair.c:857 1 lock held by syz-executor.2/13450: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.5/13452: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.1/13455: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.4/13456: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.0/13458: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.5/13471: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.0/13478: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.4/13481: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.1/13487: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.0/13486: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.5/13489: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.0/13502: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.4/13507: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.1/13509: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.5/13510: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor.3/13787: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor589/13802: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 1 lock held by syz-executor589/13803: #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline] #0: 000000003402c81d (acct_on_mutex){+.+.}, at: __se_sys_acct+0x65/0x7d0 kernel/acct.c:273 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1570 Comm: khungtaskd Not tainted 4.19.207-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x120 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x5c3/0xb40 kernel/hung_task.c:287 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9806 Comm: kworker/u4:8 Not tainted 4.19.207-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:check_preemption_disabled+0x31/0x230 lib/smp_processor_id.c:52 Code: 56 41 55 41 54 53 48 83 ec 08 65 8b 1d f8 35 ba 7c 65 8b 05 11 94 ba 7c a9 ff ff ff 7f 74 11 48 83 c4 08 89 d8 5b 41 5c 41 5d <41> 5e 41 5f 5d c3 48 b8 00 00 00 00 00 fc ff df 49 89 fc 48 c7 c7 RSP: 0018:ffff88809b2e7c28 EFLAGS: 00000092 RAX: 0000000000000001 RBX: 0000000000000201 RCX: 0000000000000000 RDX: 0000000000000004 RSI: ffffffff88083340 RDI: ffffffff88502520 RBP: ffff88809b2e7c38 R08: 0000000000000001 R09: ffffed101605c588 R10: ffffed101605c588 R11: ffff8880b02e2c43 R12: ffffffff87695725 R13: ffff888099756440 R14: 0000000000000000 R15: ffff8880945c1b00 FS: 0000000000000000(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8f47317000 CR3: 00000000a8c8c000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __this_cpu_preempt_check+0x13/0x20 lib/smp_processor_id.c:62 __local_bh_enable_ip+0x1f5/0x250 kernel/softirq.c:184 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x30/0x40 kernel/locking/spinlock.c:200 spin_unlock_bh include/linux/spinlock.h:374 [inline] batadv_nc_purge_paths+0x1c5/0x2c0 net/batman-adv/network-coding.c:482 batadv_nc_worker+0x225/0x630 net/batman-adv/network-coding.c:733 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2153 worker_thread+0x85/0xb60 kernel/workqueue.c:2296 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ---------------- Code disassembly (best guess): 0: 56 push %rsi 1: 41 55 push %r13 3: 41 54 push %r12 5: 53 push %rbx 6: 48 83 ec 08 sub $0x8,%rsp a: 65 8b 1d f8 35 ba 7c mov %gs:0x7cba35f8(%rip),%ebx # 0x7cba3609 11: 65 8b 05 11 94 ba 7c mov %gs:0x7cba9411(%rip),%eax # 0x7cba9429 18: a9 ff ff ff 7f test $0x7fffffff,%eax 1d: 74 11 je 0x30 1f: 48 83 c4 08 add $0x8,%rsp 23: 89 d8 mov %ebx,%eax 25: 5b pop %rbx 26: 41 5c pop %r12 28: 41 5d pop %r13 * 2a: 41 5e pop %r14 <-- trapping instruction 2c: 41 5f pop %r15 2e: 5d pop %rbp 2f: c3 retq 30: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 37: fc ff df 3a: 49 89 fc mov %rdi,%r12 3d: 48 rex.W 3e: c7 .byte 0xc7 3f: c7 .byte 0xc7