ci starts bisection 2025-07-07 09:36:47.021009533 +0000 UTC m=+185902.191744092 bisecting cause commit starting from 05df91921da664ebba2752a7e45b63e3dddb85de building syzkaller on 4f67c4aece4f5794be20c6bc99c177e44b1320e8 ensuring issue is reproducible on original commit 05df91921da664ebba2752a7e45b63e3dddb85de testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d4da6d3e04a2ace91eacfa36824809eca90a406c1361e80c3e00f2bb269ae499 all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] check whether we can drop unnecessary instrumentation disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e0c1d18b365741a094efa1a8562059f69ebfe7d179c05f9d44bc50b0ba3abe40 all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] the bug reproduces without the instrumentation disabling configs for [kasan locking atomic_sleep memleak ubsan bug_or_warning], they are not needed kconfig minimization: base=4089 full=8470 leaves diff=2181 split chunks (needed=false): <2181> split chunk #0 of len 2181 into 5 parts testing without sub-chunk 1/5 disabling configs for [bug_or_warning kasan locking atomic_sleep memleak ubsan], they are not needed testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 57697af1b4f995268f5cbcf8c1b5929caa75fa6ee1ab68515c58b655e67203ee all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 510f4cfb1f22502235289d999b3202ae768f9ee1a01739a1be0546ea29176758 all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [atomic_sleep memleak ubsan bug_or_warning kasan locking], they are not needed testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4f10fa60a21d55a195641d75a37c21f44957ace535c3b9dd624d62bb5b27ffd0 all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0c3b2408a809a2fadf3a29d4bcadea4be0f5ae759977fa4da95b7be495d6efb3 all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [bug_or_warning kasan locking atomic_sleep memleak ubsan], they are not needed testing commit 05df91921da664ebba2752a7e45b63e3dddb85de gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d72bb1112e1fd9f286836b21418c54c0be7dd41d4bcf71d164afcb3d129fc36b all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] the chunk can be dropped disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed picked [v6.15 v6.14 v6.13 v6.11 v6.9 v6.7 v6.5 v6.3 v6.0 v5.17 v5.14 v5.11 v5.8 v5.5 v5.2 v4.20 v4.19] out of 38 release tags testing release v6.15 testing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d6acd6ae9f19f788097e76d69391f091a15dc84372d3f939efc61a47375a0297 all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] testing release v6.14 testing commit 38fec10eb60d687e30c8c6b5420d86e8149f7557 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5188a75e75a5aa0a2a32d2f82653a19092071577f166e5094815bff6af6acc2c all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] testing release v6.13 testing commit ffd294d346d185b70e28b1a28abe367bbfe53c04 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2710d28b977f6c2153762c3f22a9d4d19157547ae565b4e4317d8be9c44cd4ba all runs: crashed: INFO: task hung in do_coredump representative crash: INFO: task hung in do_coredump, types: [HANG] testing release v6.11 testing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e94b10023b0412f736040ae68c72e5a86f49913578b95d9721b0eb03f44d2221 all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] testing release v6.9 testing commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2d894ede019d7351a4757c2ada94d22c8299661e41523899656c40a2feb08ca0 all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] testing release v6.7 testing commit 0dd3ee31125508cd67f7e7172247f05b7fd1753a gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 61726d4215c24a158ff5fd57c2373eb0542a89330bc14d78019969d872cebd4a all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] testing release v6.5 testing commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e20254e62e0601c8f59459f81f0d9a4e320620b48cec5cfd69b2d304f8f5bfd9 all runs: OK false negative chance: 0.000 # git bisect start 0dd3ee31125508cd67f7e7172247f05b7fd1753a 2dde18cd1d8fac735875f2e4987f11817cc0bc2c Bisecting: 16833 revisions left to test after this (roughly 14 steps) [ec4c20ca09831ddba8fac10a7d82a9902e96e717] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit ec4c20ca09831ddba8fac10a7d82a9902e96e717 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d47c3b92b42d6bcd586df5c77c7b570c38cb41a660616fb42429f64c4ecc9d24 all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad ec4c20ca09831ddba8fac10a7d82a9902e96e717 Bisecting: 8496 revisions left to test after this (roughly 13 steps) [4a3b1007eeb26b2bb7ae4d734cc8577463325165] Merge tag 'pinctrl-v6.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit 4a3b1007eeb26b2bb7ae4d734cc8577463325165 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4ef674899edd13b6c5407c72296fb11a02bf3385247c024fc7eb3b8ea5dee5ad all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad 4a3b1007eeb26b2bb7ae4d734cc8577463325165 Bisecting: 4343 revisions left to test after this (roughly 12 steps) [651a00bc56403161351090a9d7ddbd7095975324] Merge tag 'slab-for-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab testing commit 651a00bc56403161351090a9d7ddbd7095975324 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ac1c626639a7c904daaf1028fd18005981903b49cf22d1e42c2ad03b2fe82656 all runs: OK false negative chance: 0.000 # git bisect good 651a00bc56403161351090a9d7ddbd7095975324 Bisecting: 1985 revisions left to test after this (roughly 11 steps) [461f35f014466c4e26dca6be0f431f57297df3f2] Merge tag 'drm-next-2023-08-30' of git://anongit.freedesktop.org/drm/drm testing commit 461f35f014466c4e26dca6be0f431f57297df3f2 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8dfe6d673e41e76ad596b09cabc4582d3aedcd2fe0007150604b68e2999a7eed all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad 461f35f014466c4e26dca6be0f431f57297df3f2 Bisecting: 1178 revisions left to test after this (roughly 10 steps) [e8b2ad875ffa1c213d047e02c9c1b7db5f149241] drm/amdgpu: Remove duplicated includes testing commit e8b2ad875ffa1c213d047e02c9c1b7db5f149241 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 04273eb03b92ceeed58744d055d0d82914ad02308e9792d6ad739f3c4634c894 all runs: OK false negative chance: 0.000 # git bisect good e8b2ad875ffa1c213d047e02c9c1b7db5f149241 Bisecting: 587 revisions left to test after this (roughly 9 steps) [daa22f5a78c27412e88d31780c4a6262cda559cd] Merge tag 'modules-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux testing commit daa22f5a78c27412e88d31780c4a6262cda559cd gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 46c83fbe3ae10be8fdb558038235bf018d444bddd4202ff2156b4181c2a73e21 all runs: OK false negative chance: 0.000 # git bisect good daa22f5a78c27412e88d31780c4a6262cda559cd Bisecting: 319 revisions left to test after this (roughly 8 steps) [87fa732dc5ff9ea6a2e75b630f7931899e845eb1] Merge tag 'x86-core-2023-08-30-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 87fa732dc5ff9ea6a2e75b630f7931899e845eb1 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3fd1892f3448358a1dd1d728ff0047dbcf021585d7bd38403e90fd8714fdc4c9 all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad 87fa732dc5ff9ea6a2e75b630f7931899e845eb1 Bisecting: 151 revisions left to test after this (roughly 7 steps) [146afeb235ccec10c17ad8ea26327c0c79dbd968] block: use strscpy() to instead of strncpy() testing commit 146afeb235ccec10c17ad8ea26327c0c79dbd968 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 81ec834ae3d6bea3a30a3c5c00ca4d44fdee84f5b9828e26e40155b7d7d38ef8 all runs: OK false negative chance: 0.000 # git bisect good 146afeb235ccec10c17ad8ea26327c0c79dbd968 Bisecting: 68 revisions left to test after this (roughly 6 steps) [6c1b980a7e79e55e951b4b2c47eefebc75071209] Merge tag 'dma-mapping-6.6-2023-08-29' of git://git.infradead.org/users/hch/dma-mapping testing commit 6c1b980a7e79e55e951b4b2c47eefebc75071209 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 593df71b4af32103d094a0ea17f0c14d0932e56d06588a0f8f63824ab37e7ece all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad 6c1b980a7e79e55e951b4b2c47eefebc75071209 Bisecting: 41 revisions left to test after this (roughly 5 steps) [e5598d6ae62626d261b046a2f19347c38681ff51] io_uring: compact SQ/CQ heads/tails testing commit e5598d6ae62626d261b046a2f19347c38681ff51 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 099f3e8a827f87473b34c91434724c2a315e4709b9b6a32f2a549e51ca963ceb all runs: OK false negative chance: 0.000 # git bisect good e5598d6ae62626d261b046a2f19347c38681ff51 Bisecting: 19 revisions left to test after this (roughly 4 steps) [c1b7fcf3f6d94c2c3528bf77054bf174a5ef63d7] Merge tag 'for-6.6/io_uring-2023-08-28' of git://git.kernel.dk/linux testing commit c1b7fcf3f6d94c2c3528bf77054bf174a5ef63d7 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3c52242203487ad79ab367073a1cd5cfe5de602f47dc3bebb6f491525dab7f14 all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad c1b7fcf3f6d94c2c3528bf77054bf174a5ef63d7 Bisecting: 10 revisions left to test after this (roughly 4 steps) [c899710fe7f9f24dd77135875f199359f7b8b774] networking: Update to register_net_sysctl_sz testing commit c899710fe7f9f24dd77135875f199359f7b8b774 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 56feed5d3163a335cbd24ad897502e382f8d97f0b4925e58c11d2305da489a64 all runs: OK false negative chance: 0.000 # git bisect good c899710fe7f9f24dd77135875f199359f7b8b774 Bisecting: 5 revisions left to test after this (roughly 3 steps) [0aa7aa5f766933d4f91b22d9658cd688e1f15dab] io_uring: move multishot cqe cache in ctx testing commit 0aa7aa5f766933d4f91b22d9658cd688e1f15dab gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 58bcbff795d7f25d8f5da81af6857e8d4afe8524d7024fe19f7bfebede39196a all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad 0aa7aa5f766933d4f91b22d9658cd688e1f15dab Bisecting: 2 revisions left to test after this (roughly 1 step) [d7f06fea5d6be78403d42c9637f67bc883870094] io_uring: move non aligned field to the end testing commit d7f06fea5d6be78403d42c9637f67bc883870094 gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: bedf71dd29485b966a5e831d024e54f368b88504e4295e6b929aa57d25e75e1c all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad d7f06fea5d6be78403d42c9637f67bc883870094 Bisecting: 0 revisions left to test after this (roughly 0 steps) [2af89abda7d9c2aeb573677e2c498ddb09f8058a] io_uring: add option to remove SQ indirection testing commit 2af89abda7d9c2aeb573677e2c498ddb09f8058a gcc compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9d89e195e7ea96ddb1a6d0a40cda1182478151dc16227974a1bfca4205755ef0 all runs: crashed: INFO: task hung in do_exit representative crash: INFO: task hung in do_exit, types: [HANG] # git bisect bad 2af89abda7d9c2aeb573677e2c498ddb09f8058a 2af89abda7d9c2aeb573677e2c498ddb09f8058a is the first bad commit commit 2af89abda7d9c2aeb573677e2c498ddb09f8058a Author: Pavel Begunkov Date: Thu Aug 24 23:53:32 2023 +0100 io_uring: add option to remove SQ indirection Not many aware, but io_uring submission queue has two levels. The first level usually appears as sq_array and stores indexes into the actual SQ. To my knowledge, no one has ever seriously used it, nor liburing exposes it to users. Add IORING_SETUP_NO_SQARRAY, when set we don't bother creating and using the sq_array and SQ heads/tails will be pointing directly into the SQ. Improves memory footprint, in term of both allocations as well as cache usage, and also should make io_get_sqe() less branchy in the end. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/0ffa3268a5ef61d326201ff43a233315c96312e0.1692916914.git.asml.silence@gmail.com Signed-off-by: Jens Axboe include/uapi/linux/io_uring.h | 5 +++++ io_uring/io_uring.c | 52 ++++++++++++++++++++++++++----------------- 2 files changed, 37 insertions(+), 20 deletions(-) accumulated error probability: 0.00 culprit signature: 9d89e195e7ea96ddb1a6d0a40cda1182478151dc16227974a1bfca4205755ef0 parent signature: 099f3e8a827f87473b34c91434724c2a315e4709b9b6a32f2a549e51ca963ceb revisions tested: 29, total time: 6h48m49.439155427s (build: 2h32m11.133364869s, test: 3h48m35.734155011s) first bad commit: 2af89abda7d9c2aeb573677e2c498ddb09f8058a io_uring: add option to remove SQ indirection recipients (to): ["asml.silence@gmail.com" "axboe@kernel.dk" "axboe@kernel.dk" "io-uring@vger.kernel.org"] recipients (cc): ["asml.silence@gmail.com" "linux-kernel@vger.kernel.org"] crash: INFO: task hung in do_exit INFO: task syz.3.16:2856 blocked for more than 143 seconds. Not tainted 6.5.0-rc2-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.16 state:D stack:13968 pid:2856 ppid:2402 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x3ff/0xa80 kernel/sched/core.c:6710 schedule+0x59/0xb0 kernel/sched/core.c:6786 coredump_task_exit kernel/exit.c:436 [inline] do_exit+0xfd/0xb80 kernel/exit.c:823 do_group_exit+0x32/0xa0 kernel/exit.c:1024 get_signal+0xae6/0xaf0 kernel/signal.c:2877 arch_do_signal_or_restart+0x39/0x280 arch/x86/kernel/signal.c:308 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0xc3/0x150 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x17/0x40 kernel/entry/common.c:297 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 RIP: 0033:0x7f715adab929 RSP: 002b:00007ffc02f429b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffdfc RBX: 000000000000d49d RCX: 00007f715adab929 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f715afd308c RBP: 0000000000000032 R08: 0000000000000001 R09: 0000000602f42caf R10: 00007ffc02f42ab0 R11: 0000000000000246 R12: 00007f715afd308c R13: 00007ffc02f42ab0 R14: 000000000000d4cf R15: 00007ffc02f42ad0 INFO: task syz.3.16:2858 blocked for more than 144 seconds. Not tainted 6.5.0-rc2-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.16 state:D stack:14144 pid:2858 ppid:2402 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x3ff/0xa80 kernel/sched/core.c:6710 schedule+0x59/0xb0 kernel/sched/core.c:6786 schedule_timeout+0x137/0x150 kernel/time/timer.c:2143 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion_state+0x14a/0x210 kernel/sched/completion.c:254 coredump_wait fs/coredump.c:414 [inline] do_coredump+0x2e1/0x1810 fs/coredump.c:571 get_signal+0x9d3/0xaf0 kernel/signal.c:2863 arch_do_signal_or_restart+0x39/0x280 arch/x86/kernel/signal.c:308 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0xc3/0x150 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x17/0x40 kernel/entry/common.c:297 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 RIP: 0033:0x7f715adab929 RSP: 002b:00007f715a67a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 00000000000000ca RBX: 00007f715afd3088 RCX: 00007f715adab929 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f715afd308c RBP: 00007f715afd3080 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f715afd308c R13: 0000000000000000 R14: 00007ffc02f42770 R15: 00007ffc02f42858 Showing all locks held in the system: 2 locks held by kworker/u4:0/10: #0: ffff888100070938 ((wq_completion)events_unbound){....}-{0:0}, at: wake_up_worker kernel/workqueue.c:898 [inline] #0: ffff888100070938 ((wq_completion)events_unbound){....}-{0:0}, at: process_one_work+0x1ff/0x4f0 kernel/workqueue.c:2559 #1: ffffc9000005be58 ((work_completion)(&(&kfence_timer)->work)){....}-{0:0}, at: wake_up_worker kernel/workqueue.c:898 [inline] #1: ffffc9000005be58 ((work_completion)(&(&kfence_timer)->work)){....}-{0:0}, at: process_one_work+0x1ff/0x4f0 kernel/workqueue.c:2559 1 lock held by rcu_tasks_kthre/13: #0: ffffffff8257b610 (rcu_tasks.tasks_gp_mutex){....}-{3:3}, at: rcu_tasks_one_gp+0x26/0x3c0 kernel/rcu/tasks.h:522 1 lock held by khungtaskd/27: #0: ffffffff8257bcc0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x12/0x120 kernel/locking/lockdep.c:6615 2 locks held by getty/808: #0: ffff888101e6f898 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x23/0x60 drivers/tty/tty_ldisc.c:243 #1: ffffc900003fb2f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x513/0x650 drivers/tty/n_tty.c:2187 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 6.5.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x3d/0x70 lib/dump_stack.c:106 nmi_cpu_backtrace+0xd4/0x110 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x11c/0x140 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0x5e2/0x620 kernel/hung_task.c:379 kthread+0xde/0x110 kernel/kthread.c:389 ret_from_fork+0x2c/0x50 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:296 RIP: 0000:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2857 Comm: syz.3.16 Not tainted 6.5.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:get_lock_parent_ip include/linux/ftrace.h:986 [inline] RIP: 0010:preempt_latency_start kernel/sched/core.c:5834 [inline] RIP: 0010:preempt_latency_start kernel/sched/core.c:5831 [inline] RIP: 0010:preempt_count_add+0x73/0x90 kernel/sched/core.c:5859 Code: 6f 03 00 85 c0 75 1a 65 48 8b 04 25 80 bf 02 00 48 89 98 c0 13 00 00 48 83 c4 08 5b c3 cc cc cc cc 31 ff 31 db e8 2d 6f 03 00 db 89 7c 24 04 90 e8 e1 f9 4c 00 90 8b 7c 24 04 eb 9f 66 2e 0f RSP: 0018:ffffc900016f3e10 EFLAGS: 00000003 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc900016f3db4 RDX: 0000000000000001 RSI: ffffc900016f3ec0 RDI: 0000000000000000 RBP: 0000000000000202 R08: ffff888109294488 R09: ffffc900016f3e10 R10: 0000000000080000 R11: 0000000000000000 R12: ffff888109294460 R13: ffff888109294000 R14: 0000000000000000 R15: ffffc900016f3ed8 FS: 00007f715a81c6c0(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc5636772f0 CR3: 0000000104ff8000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:109 [inline] _raw_spin_lock_irqsave+0x16/0x50 kernel/locking/spinlock.c:162 prepare_to_wait_exclusive+0x29/0xb0 kernel/sched/wait.c:285 io_cqring_wait io_uring/io_uring.c:2572 [inline] __do_sys_io_uring_enter+0x79a/0xc10 io_uring/io_uring.c:3655 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 RIP: 0033:0x7f715adab929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f715a81c038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 00007f715afd2fa0 RCX: 00007f715adab929 RDX: 000000000000235c RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f715ae2db39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f715afd2fa0 R15: 00007ffc02f42858