bisecting fixing commit since 6e764bcd1cf72a2846c0e53d3975a09b242c04c9
building syzkaller on b599f2fcc734e2183016a340d4f6fc2891d8e41f
testing commit 6e764bcd1cf72a2846c0e53d3975a09b242c04c9
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: d1906ccb709a282039276bb41361698f97581b0d39ead330d57b75f5b9ee0dc5
run #0: crashed: INFO: task hung in nbd_add_socket
run #1: crashed: INFO: task hung in nbd_add_socket
run #2: crashed: INFO: task hung in nbd_add_socket
run #3: crashed: INFO: task hung in __xfs_buf_submit
run #4: crashed: INFO: task hung in __xfs_buf_submit
run #5: crashed: INFO: task hung in __xfs_buf_submit
run #6: crashed: INFO: task hung in nbd_add_socket
run #7: crashed: INFO: task hung in nbd_add_socket
run #8: crashed: INFO: task hung in __xfs_buf_submit
run #9: crashed: INFO: task hung in nbd_add_socket
run #10: crashed: INFO: task hung in __xfs_buf_submit
run #11: crashed: INFO: task hung in __xfs_buf_submit
run #12: crashed: INFO: task hung in __xfs_buf_submit
run #13: crashed: INFO: task hung in __xfs_buf_submit
run #14: crashed: INFO: task hung in nbd_add_socket
run #15: crashed: INFO: task hung in __xfs_buf_submit
run #16: crashed: INFO: task hung in nbd_add_socket
run #17: crashed: INFO: task hung in __xfs_buf_submit
run #18: crashed: INFO: task hung in nbd_add_socket
run #19: crashed: INFO: task hung in __xfs_buf_submit
testing current HEAD c30b5b8cfb72cc83c10793588ce94471a4769409
testing commit c30b5b8cfb72cc83c10793588ce94471a4769409
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: b02f0a49534f07cae412ee395a4b586e82feab0a9e4169e489d96f0c17ea2b78
run #0: crashed: INFO: task hung in __xfs_buf_submit
run #1: crashed: INFO: task hung in __xfs_buf_submit
run #2: crashed: INFO: task hung in __xfs_buf_submit
run #3: crashed: INFO: task hung in __xfs_buf_submit
run #4: crashed: INFO: task hung in __xfs_buf_submit
run #5: crashed: INFO: task hung in __xfs_buf_submit
run #6: crashed: INFO: task hung in nbd_add_socket
run #7: crashed: INFO: task hung in nbd_add_socket
run #8: crashed: INFO: task hung in nbd_add_socket
run #9: crashed: INFO: task hung in __xfs_buf_submit
revisions tested: 2, total time: 24m40.15072809s (build: 12m16.383258868s, test: 11m32.194242774s)
the crash still happens on HEAD
commit msg: Merge tag 'staging-5.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
crash: INFO: task hung in __xfs_buf_submit
INFO: task syz-executor.2:4071 blocked for more than 143 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:26080 pid: 4071 ppid: 3921 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
schedule_timeout+0x19d/0x250 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common+0x2af/0x360 kernel/sched/completion.c:106
xfs_buf_iowait+0x8e/0x420 fs/xfs/xfs_buf.c:1573
__xfs_buf_submit+0x35b/0x630 fs/xfs/xfs_buf.c:1638
xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline]
xfs_buf_read_uncached+0x1bd/0x320 fs/xfs/xfs_buf.c:885
xfs_readsb+0x2a9/0x550 fs/xfs/xfs_mount.c:178
xfs_fs_fill_super+0x631/0x1870 fs/xfs/xfs_super.c:1490
get_tree_bdev+0x398/0x680 fs/super.c:1292
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f4037e55188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007fff055def8f R14: 00007f4037e55300 R15: 0000000000022000
INFO: task syz-executor.2:4104 blocked for more than 143 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:29568 pid: 4104 ppid: 3921 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
blk_mq_freeze_queue_wait+0xec/0x120 block/blk-mq.c:178
nbd_add_socket+0x152/0x7e0 drivers/block/nbd.c:1109
__nbd_ioctl drivers/block/nbd.c:1454 [inline]
nbd_ioctl+0x3aa/0x8f0 drivers/block/nbd.c:1511
blkdev_ioctl+0x30b/0x6d0 block/ioctl.c:588
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f4037e13188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 00000000004665e9
RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0f0
R13: 00007fff055def8f R14: 00007f4037e13300 R15: 0000000000022000
INFO: task syz-executor.2:4108 blocked for more than 143 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:28784 pid: 4108 ppid: 3921 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1142
__down_write_common kernel/locking/rwsem.c:1259 [inline]
__down_write_common kernel/locking/rwsem.c:1256 [inline]
__down_write kernel/locking/rwsem.c:1268 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1515
grab_super+0x50/0x1c0 fs/super.c:386
sget_fc+0x1e3/0x700 fs/super.c:561
get_tree_bdev+0x17d/0x680 fs/super.c:1262
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f4037df2188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056c1a8 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056c1a8
R13: 00007fff055def8f R14: 00007f4037df2300 R15: 0000000000022000
INFO: task syz-executor.3:4113 blocked for more than 144 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:27528 pid: 4113 ppid: 3929 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
blk_mq_freeze_queue_wait+0xec/0x120 block/blk-mq.c:178
nbd_add_socket+0x152/0x7e0 drivers/block/nbd.c:1109
__nbd_ioctl drivers/block/nbd.c:1454 [inline]
nbd_ioctl+0x3aa/0x8f0 drivers/block/nbd.c:1511
blkdev_ioctl+0x30b/0x6d0 block/ioctl.c:588
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f20817c0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9
RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffcaa6fafdf R14: 00007f20817c0300 R15: 0000000000022000
INFO: task syz-executor.3:4116 blocked for more than 144 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:27048 pid: 4116 ppid: 3929 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
schedule_timeout+0x19d/0x250 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common+0x2af/0x360 kernel/sched/completion.c:106
xfs_buf_iowait+0x8e/0x420 fs/xfs/xfs_buf.c:1573
__xfs_buf_submit+0x35b/0x630 fs/xfs/xfs_buf.c:1638
xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline]
xfs_buf_read_uncached+0x1bd/0x320 fs/xfs/xfs_buf.c:885
xfs_readsb+0x2a9/0x550 fs/xfs/xfs_mount.c:178
xfs_fs_fill_super+0x631/0x1870 fs/xfs/xfs_super.c:1490
get_tree_bdev+0x398/0x680 fs/super.c:1292
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f208179f188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056c038
R13: 00007ffcaa6fafdf R14: 00007f208179f300 R15: 0000000000022000
INFO: task syz-executor.3:4143 blocked for more than 144 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3 state:D stack:28784 pid: 4143 ppid: 3929 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1142
__down_write_common kernel/locking/rwsem.c:1259 [inline]
__down_write_common kernel/locking/rwsem.c:1256 [inline]
__down_write kernel/locking/rwsem.c:1268 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1515
grab_super+0x50/0x1c0 fs/super.c:386
sget_fc+0x1e3/0x700 fs/super.c:561
get_tree_bdev+0x17d/0x680 fs/super.c:1262
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f208175d188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056c1a8 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056c1a8
R13: 00007ffcaa6fafdf R14: 00007f208175d300 R15: 0000000000022000
INFO: task syz-executor.1:4120 blocked for more than 144 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:27048 pid: 4120 ppid: 3922 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
schedule_timeout+0x19d/0x250 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common+0x2af/0x360 kernel/sched/completion.c:106
xfs_buf_iowait+0x8e/0x420 fs/xfs/xfs_buf.c:1573
__xfs_buf_submit+0x35b/0x630 fs/xfs/xfs_buf.c:1638
xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline]
xfs_buf_read_uncached+0x1bd/0x320 fs/xfs/xfs_buf.c:885
xfs_readsb+0x2a9/0x550 fs/xfs/xfs_mount.c:178
xfs_fs_fill_super+0x631/0x1870 fs/xfs/xfs_super.c:1490
get_tree_bdev+0x398/0x680 fs/super.c:1292
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007ff74fd15188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056c038
R13: 00007ffd538edf1f R14: 00007ff74fd15300 R15: 0000000000022000
INFO: task syz-executor.1:4136 blocked for more than 145 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:29568 pid: 4136 ppid: 3922 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
blk_mq_freeze_queue_wait+0xec/0x120 block/blk-mq.c:178
nbd_add_socket+0x152/0x7e0 drivers/block/nbd.c:1109
__nbd_ioctl drivers/block/nbd.c:1454 [inline]
nbd_ioctl+0x3aa/0x8f0 drivers/block/nbd.c:1511
blkdev_ioctl+0x30b/0x6d0 block/ioctl.c:588
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007ff74fcf4188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 00000000004665e9
RDX: 0000000000000004 RSI: 000000000000ab00 RDI: 0000000000000003
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0f0
R13: 00007ffd538edf1f R14: 00007ff74fcf4300 R15: 0000000000022000
INFO: task syz-executor.1:4146 blocked for more than 145 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:28784 pid: 4146 ppid: 3922 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
rwsem_down_write_slowpath+0x634/0x1110 kernel/locking/rwsem.c:1142
__down_write_common kernel/locking/rwsem.c:1259 [inline]
__down_write_common kernel/locking/rwsem.c:1256 [inline]
__down_write kernel/locking/rwsem.c:1268 [inline]
down_write+0x135/0x150 kernel/locking/rwsem.c:1515
grab_super+0x50/0x1c0 fs/super.c:386
sget_fc+0x1e3/0x700 fs/super.c:561
get_tree_bdev+0x17d/0x680 fs/super.c:1262
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007ff74fcd3188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056c1a8 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056c1a8
R13: 00007ffd538edf1f R14: 00007ff74fcd3300 R15: 0000000000022000
INFO: task syz-executor.5:4135 blocked for more than 145 seconds.
Not tainted 5.17.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.5 state:D stack:27528 pid: 4135 ppid: 3928 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:4995 [inline]
__schedule+0x90d/0x2680 kernel/sched/core.c:6304
schedule+0xd2/0x260 kernel/sched/core.c:6377
schedule_timeout+0x19d/0x250 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common+0x2af/0x360 kernel/sched/completion.c:106
xfs_buf_iowait+0x8e/0x420 fs/xfs/xfs_buf.c:1573
__xfs_buf_submit+0x35b/0x630 fs/xfs/xfs_buf.c:1638
xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline]
xfs_buf_read_uncached+0x1bd/0x320 fs/xfs/xfs_buf.c:885
xfs_readsb+0x2a9/0x550 fs/xfs/xfs_mount.c:178
xfs_fs_fill_super+0x631/0x1870 fs/xfs/xfs_super.c:1490
get_tree_bdev+0x398/0x680 fs/super.c:1292
vfs_get_tree+0x7f/0x2c0 fs/super.c:1497
do_new_mount fs/namespace.c:3024 [inline]
path_mount+0x7e8/0x1a40 fs/namespace.c:3354
do_mount fs/namespace.c:3367 [inline]
__do_sys_mount fs/namespace.c:3575 [inline]
__se_sys_mount fs/namespace.c:3552 [inline]
__x64_sys_mount+0x1f5/0x260 fs/namespace.c:3552
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665e9
RSP: 002b:00007f13c9a0f188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9
RDX: 0000000020000140 RSI: 0000000020000000 RDI: 00000000200000c0
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008002 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffcaafcd19f R14: 00007f13c9a0f300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/26:
#0: ffffffff8ab791e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6460
2 locks held by getty/3309:
#0: ffff88807e6a9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x1f/0x70 drivers/tty/tty_ldisc.c:244
#1: ffffc900027662e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x9dd/0xed0 drivers/tty/n_tty.c:2075
1 lock held by syz-executor.2/4071:
#0: ffff88801e0be0e0 (&type->s_umount_key#49/1){+.+.}-{3:3}, at: alloc_super+0x192/0x9e0 fs/super.c:228
1 lock held by syz-executor.2/4104:
#0: ffff8880199bd198 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x120/0x8f0 drivers/block/nbd.c:1504
2 locks held by syz-executor.2/4108:
#0: ffff8881408b1d18 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0xdd/0x680 fs/super.c:1252
#1: ffff88801e0be0e0 (&type->s_umount_key#50){+.+.}-{3:3}, at: grab_super+0x50/0x1c0 fs/super.c:386
1 lock held by syz-executor.3/4113:
#0: ffff8880199d4998 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x120/0x8f0 drivers/block/nbd.c:1504
1 lock held by syz-executor.3/4116:
#0: ffff88807d2c20e0 (&type->s_umount_key#49/1){+.+.}-{3:3}, at: alloc_super+0x192/0x9e0 fs/super.c:228
2 locks held by syz-executor.3/4143:
#0: ffff8881408b2898 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0xdd/0x680 fs/super.c:1252
#1: ffff88807d2c20e0 (&type->s_umount_key#50){+.+.}-{3:3}, at: grab_super+0x50/0x1c0 fs/super.c:386
1 lock held by syz-executor.1/4120:
#0: ffff88807265c0e0 (&type->s_umount_key#49/1){+.+.}-{3:3}, at: alloc_super+0x192/0x9e0 fs/super.c:228
1 lock held by syz-executor.1/4136:
#0: ffff8880199ad998 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x120/0x8f0 drivers/block/nbd.c:1504
2 locks held by syz-executor.1/4146:
#0: ffff8881408b1198 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0xdd/0x680 fs/super.c:1252
#1: ffff88807265c0e0 (&type->s_umount_key#50){+.+.}-{3:3}, at: grab_super+0x50/0x1c0 fs/super.c:386
1 lock held by syz-executor.5/4135:
#0: ffff8880648960e0 (&type->s_umount_key#49/1){+.+.}-{3:3}, at: alloc_super+0x192/0x9e0 fs/super.c:228
2 locks held by syz-executor.5/4201:
#0: ffff8881408b3f98 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0xdd/0x680 fs/super.c:1252
#1: ffff8880648960e0 (&type->s_umount_key#50){+.+.}-{3:3}, at: grab_super+0x50/0x1c0 fs/super.c:386
1 lock held by syz-executor.4/4148:
#0: ffff88807a9200e0 (&type->s_umount_key#49/1){+.+.}-{3:3}, at: alloc_super+0x192/0x9e0 fs/super.c:228
1 lock held by syz-executor.4/4210:
#0: ffff888019a64198 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x120/0x8f0 drivers/block/nbd.c:1504
2 locks held by syz-executor.4/4215:
#0: ffff8881408b3418 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0xdd/0x680 fs/super.c:1252
#1: ffff88807a9200e0 (&type->s_umount_key#50){+.+.}-{3:3}, at: grab_super+0x50/0x1c0 fs/super.c:386
1 lock held by syz-executor.0/4154:
#0: ffff88807c8d20e0 (&type->s_umount_key#49/1){+.+.}-{3:3}, at: alloc_super+0x192/0x9e0 fs/super.c:228
1 lock held by syz-executor.0/4214:
#0: ffff88801990e198 (&nbd->config_lock){+.+.}-{3:3}, at: nbd_ioctl+0x120/0x8f0 drivers/block/nbd.c:1504
2 locks held by syz-executor.0/4220:
#0: ffff8881408b0618 (&bdev->bd_fsfreeze_mutex){+.+.}-{3:3}, at: get_tree_bdev+0xdd/0x680 fs/super.c:1252
#1: ffff88807c8d20e0 (&type->s_umount_key#50){+.+.}-{3:3}, at: grab_super+0x50/0x1c0 fs/super.c:386
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 26 Comm: khungtaskd Not tainted 5.17.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x30/0xc0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x140/0x170 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0x88c/0xbf0 kernel/hung_task.c:369
kthread+0x299/0x340 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 5.17.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4701 [inline]
RIP: 0010:__lock_acquire+0x509/0x5630 kernel/locking/lockdep.c:4977
Code: f1 0b 00 00 48 8d bd b9 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 0f b6 04 01 48 89 f9 83 e1 07 38 c8 7f 08 <84> c0 0f 85 c2 0f 00 00 0f b6 85 b9 00 00 00 48 8b 14 24 84 c0 41
RSP: 0018:ffffc90000cd79b8 EFLAGS: 00000097
RAX: 0000000000000000 RBX: ffff88801088e060 RCX: 0000000000000001
RDX: fffffbfff1dd4d2b RSI: 0000000000000006 RDI: ffffffff8eef6559
RBP: ffffffff8eef64a0 R08: 0000000000000000 R09: ffffffff8eea6957
R10: fffffbfff1dd4d2a R11: 0000000000000001 R12: ffff88801088e0b0
R13: ffff88801088d640 R14: 0000000000000002 R15: 0000000000040000
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f549b516990 CR3: 0000000022ba1000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_acquire kernel/locking/lockdep.c:5639 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5604
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:354 [inline]
batadv_nc_purge_paths+0xc0/0x2d0 net/batman-adv/network-coding.c:442
batadv_nc_worker+0x722/0xd70 net/batman-adv/network-coding.c:722
process_one_work+0x879/0x1410 kernel/workqueue.c:2307
worker_thread+0x5a0/0xf60 kernel/workqueue.c:2454
kthread+0x299/0x340 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: f1 icebp
1: 0b 00 or (%rax),%eax
3: 00 48 8d add %cl,-0x73(%rax)
6: bd b9 00 00 00 mov $0xb9,%ebp
b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
12: fc ff df
15: 48 89 f9 mov %rdi,%rcx
18: 48 c1 e9 03 shr $0x3,%rcx
1c: 0f b6 04 01 movzbl (%rcx,%rax,1),%eax
20: 48 89 f9 mov %rdi,%rcx
23: 83 e1 07 and $0x7,%ecx
26: 38 c8 cmp %cl,%al
28: 7f 08 jg 0x32
* 2a: 84 c0 test %al,%al <-- trapping instruction
2c: 0f 85 c2 0f 00 00 jne 0xff4
32: 0f b6 85 b9 00 00 00 movzbl 0xb9(%rbp),%eax
39: 48 8b 14 24 mov (%rsp),%rdx
3d: 84 c0 test %al,%al
3f: 41 rex.B