bisecting fixing commit since 830a059cbba6832c11fefc0894c7ec7a27f75734 building syzkaller on 6a81331a1d4c744da9204d02ec88d558f7eea9c9 testing commit 830a059cbba6832c11fefc0894c7ec7a27f75734 with gcc (GCC) 8.4.1 20210217 kernel signature: 8ca17403a8aa540183f4d70baa6d3b9d6050f7b4b775016783ed39ee1aa26ba7 run #0: crashed: INFO: task hung in nbd_ioctl run #1: crashed: INFO: task hung in nbd_ioctl run #2: crashed: INFO: task hung in blk_freeze_queue run #3: crashed: INFO: task hung in nbd_ioctl run #4: crashed: INFO: task hung in nbd_ioctl run #5: crashed: INFO: task hung in nbd_ioctl run #6: crashed: INFO: task hung in nbd_ioctl run #7: crashed: INFO: task hung in nbd_ioctl run #8: crashed: INFO: task hung in nbd_ioctl run #9: crashed: INFO: task hung in nbd_ioctl run #10: crashed: INFO: task hung in nbd_ioctl run #11: crashed: INFO: task hung in nbd_ioctl run #12: crashed: INFO: task hung in nbd_ioctl run #13: crashed: INFO: task hung in nbd_ioctl run #14: crashed: INFO: task hung in nbd_ioctl run #15: crashed: INFO: task hung in nbd_ioctl run #16: crashed: INFO: task hung in blk_freeze_queue run #17: crashed: INFO: task hung in nbd_ioctl run #18: crashed: INFO: task hung in nbd_ioctl run #19: crashed: INFO: task hung in nbd_ioctl testing current HEAD 9f84340f012ee60c12aacc03662bcdd67419a31a testing commit 9f84340f012ee60c12aacc03662bcdd67419a31a with gcc (GCC) 8.4.1 20210217 kernel signature: ee0f858d04fdf37a23293831bd7aa43f06c7070c723ed256ac067f4e256a3452 all runs: crashed: INFO: task hung in nbd_ioctl revisions tested: 2, total time: 27m57.489149996s (build: 15m46.789300644s, test: 11m48.843431195s) the crash still happens on HEAD commit msg: Linux 4.19.196 crash: INFO: task hung in nbd_ioctl Bluetooth: hci5: command 0x0406 tx timeout Bluetooth: hci4: command 0x0406 tx timeout Bluetooth: hci0: command 0x0406 tx timeout ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 INFO: task syz-executor.4:9911 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27864 9911 8474 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] __nbd_ioctl drivers/block/nbd.c:1347 [inline] nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f0ad2e13188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007fff1f1f0b3f R14: 00007f0ad2e13300 R15: 0000000000022000 INFO: task syz-executor.4:9941 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28344 9941 8474 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f0ad2df2188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 RDX: 00000000000000ff RSI: 000000000000ab09 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008 R13: 00007fff1f1f0b3f R14: 00007f0ad2df2300 R15: 0000000000022000 INFO: task syz-executor.4:10003 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29496 10003 8474 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 blk_mq_freeze_queue_wait+0x105/0x220 block/blk-mq.c:152 blk_freeze_queue+0x3d/0x60 block/blk-mq.c:181 blk_mq_freeze_queue+0x9/0x10 block/blk-mq.c:190 nbd_add_socket+0x109/0x840 drivers/block/nbd.c:973 __nbd_ioctl drivers/block/nbd.c:1320 [inline] nbd_ioctl+0x4fd/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f0ad2dd1188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c0b0 RCX: 0000000000466459 RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0b0 R13: 00007fff1f1f0b3f R14: 00007f0ad2dd1300 R15: 0000000000022000 INFO: task syz-executor.4:10010 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29496 10010 8474 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f0ad2db0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c158 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c158 R13: 00007fff1f1f0b3f R14: 00007f0ad2db0300 R15: 0000000000022000 INFO: task syz-executor.5:9957 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D28248 9957 8466 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f1bc042a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 00000000000000ff RSI: 000000000000ab09 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffea72ebc1f R14: 00007f1bc042a300 R15: 0000000000022000 INFO: task syz-executor.5:9977 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D28728 9977 8466 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 blk_mq_freeze_queue_wait+0x105/0x220 block/blk-mq.c:152 blk_freeze_queue+0x3d/0x60 block/blk-mq.c:181 blk_mq_freeze_queue+0x9/0x10 block/blk-mq.c:190 nbd_add_socket+0x109/0x840 drivers/block/nbd.c:973 __nbd_ioctl drivers/block/nbd.c:1320 [inline] nbd_ioctl+0x4fd/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f1bc0409188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008 R13: 00007ffea72ebc1f R14: 00007f1bc0409300 R15: 0000000000022000 INFO: task syz-executor.5:10015 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D29496 10015 8466 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f1bc03e8188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c0b0 RCX: 0000000000466459 RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0b0 R13: 00007ffea72ebc1f R14: 00007f1bc03e8300 R15: 0000000000022000 INFO: task syz-executor.5:10016 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D29304 10016 8466 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007f1bc03c7188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c158 RCX: 0000000000466459 RDX: 0000000000000f53 RSI: 000000000000ab07 RDI: 0000000000000007 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c158 R13: 00007ffea72ebc1f R14: 00007f1bc03c7300 R15: 0000000000022000 INFO: task syz-executor.0:9974 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28248 9974 8468 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3619 __mutex_lock_common kernel/locking/mutex.c:1015 [inline] __mutex_lock+0x4ba/0x1190 kernel/locking/mutex.c:1083 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1098 nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007ff43a917188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000466459 RDX: 00000000000000ff RSI: 000000000000ab09 RDI: 0000000000000006 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 R13: 00007ffde027c50f R14: 00007ff43a917300 R15: 0000000000022000 INFO: task syz-executor.0:9990 blocked for more than 140 seconds. Not tainted 4.19.196-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28728 9990 8468 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x80c/0x1f70 kernel/sched/core.c:3517 schedule+0x7f/0x1b0 kernel/sched/core.c:3561 blk_mq_freeze_queue_wait+0x105/0x220 block/blk-mq.c:152 blk_freeze_queue+0x3d/0x60 block/blk-mq.c:181 blk_mq_freeze_queue+0x9/0x10 block/blk-mq.c:190 nbd_add_socket+0x109/0x840 drivers/block/nbd.c:973 __nbd_ioctl drivers/block/nbd.c:1320 [inline] nbd_ioctl+0x4fd/0xb30 drivers/block/nbd.c:1387 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0x7ea/0x1790 block/ioctl.c:601 block_ioctl+0xd7/0x130 fs/block_dev.c:1906 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:688 ksys_ioctl+0x62/0x90 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:710 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x466459 Code: Bad RIP value. RSP: 002b:00007ff43a8f6188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459 RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003 RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008 R13: 00007ffde027c50f R14: 00007ff43a8f6300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1561: #0: 000000006757124f (rcu_read_lock){....}, at: debug_show_all_locks+0x5b/0x27a kernel/locking/lockdep.c:4443 1 lock held by in:imklog/7795: #0: 00000000aaf2c1af (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xa7/0xd0 fs/file.c:767 1 lock held by syz-executor.4/9911: #0: 00000000f8569e0d (&nbd->config_lock){+.+.}, at: nbd_start_device_ioctl drivers/block/nbd.c:1278 [inline] #0: 00000000f8569e0d (&nbd->config_lock){+.+.}, at: __nbd_ioctl drivers/block/nbd.c:1347 [inline] #0: 00000000f8569e0d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x2d6/0xb30 drivers/block/nbd.c:1387 1 lock held by syz-executor.4/9941: #0: 00000000f8569e0d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.4/10003: #0: 00000000f8569e0d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.4/10010: #0: 00000000f8569e0d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/9957: #0: 00000000837fb90b (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/9977: #0: 00000000837fb90b (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10015: #0: 00000000837fb90b (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.5/10016: #0: 00000000837fb90b (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/9974: #0: 000000006e40af1d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/9990: #0: 000000006e40af1d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.0/10017: #0: 000000006e40af1d (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/9999: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10001: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10002: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10006: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10024: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10025: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10026: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.1/10027: #0: 00000000064eb85f (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10009: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10011: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10013: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10014: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10028: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10029: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.2/10030: #0: 00000000e47866e3 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10020: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10021: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10022: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10023: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10032: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10033: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 1 lock held by syz-executor.3/10034: #0: 00000000cc5de4c5 (&nbd->config_lock){+.+.}, at: nbd_ioctl+0x12a/0xb30 drivers/block/nbd.c:1380 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1561 Comm: khungtaskd Not tainted 4.19.196-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x120 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x5c3/0xb40 kernel/hung_task.c:287 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x12/0x20 arch/x86/include/asm/irqflags.h:60