ci starts bisection 2025-02-14 05:12:14.984745253 +0000 UTC m=+26071.728036112
bisecting fixing commit since 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd
building syzkaller on 402f1df054ddb07ed5bb299d08c781354eb06607
ensuring issue is reproducible on original commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 88d041af7ccaa9f59f8b21ed1cb7875bef004a0e89a2993a9c73ddaa2fa7b0c7
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_wp
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_wp
run #9: crashed: INFO: task hung in hugetlb_fault
run #10: crashed: INFO: task hung in hugetlb_fault
run #11: crashed: INFO: task hung in hugetlb_fault
run #12: crashed: INFO: task hung in remove_inode_hugepages
run #13: crashed: INFO: task hung in hugetlb_fault
run #14: crashed: INFO: task hung in hugetlb_fault
run #15: crashed: INFO: task hung in hugetlb_fault
run #16: crashed: INFO: task hung in hugetlb_fault
run #17: crashed: INFO: task hung in hugetlb_fault
run #18: crashed: INFO: task hung in hugetlb_fault
run #19: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ce2172fd02acbfddf3fa774dd81a3caf03e42819ff946a16cc502c4b90c1d64f
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in remove_inode_hugepages
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed
kconfig minimization: base=4064 full=8192 leaves diff=2119
split chunks (needed=false): <2119>
split chunk #0 of len 2119 into 5 parts
testing without sub-chunk 1/5
disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f7711f64fffc0e25eb28c31af38ed556b88f1bbc03af6b497236bb9f6933340e
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in remove_inode_hugepages
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in remove_inode_hugepages
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_wp
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 51603ec55208911460bd252b35b5e895aa267e67b87efce977ee25995dddf6bd
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_wp
run #2: crashed: INFO: task hung in remove_inode_hugepages
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: cce3b43f0529778bad12463c4be14b88d78682a8858fe57084fc5252674c5349
run #0: crashed: INFO: task hung in remove_inode_hugepages
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_wp
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in remove_inode_hugepages
representative crash: INFO: task hung in remove_inode_hugepages, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 048fa5db1399b0a9bb50f385ba919dc2890a1015f409b6098260cea1bb1a1971
run #0: crashed: INFO: task hung in remove_inode_hugepages
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in remove_inode_hugepages, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 9c54c5e189a15ee70e4701ca346081c70a3c33a9aea8a3cf40492bbb4700a96a
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in remove_inode_hugepages
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed
testing current HEAD 128c8f96eb8638c060cd3532dc394d046ce64fe1
testing commit 128c8f96eb8638c060cd3532dc394d046ce64fe1 gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b92510e1370144a5bb828a4c13db6e7df97fe404160a9df66f93ffd69587e512
all runs: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 2h31m36.765696544s (build: 1h16m37.797246057s, test: 1h7m19.732578942s)
crash still not fixed or there were kernel test errors
commit msg: Merge tag 'drm-fixes-2025-02-14' of https://gitlab.freedesktop.org/drm/kernel
crash: INFO: task hung in hugetlb_fault
INFO: task syz.2.312:5633 blocked for more than 143 seconds.
Not tainted 6.14.0-rc2-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.312 state:D stack:13992 pid:5633 tgid:5633 ppid:1901 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5377 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6764
__schedule_loop kernel/sched/core.c:6841 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6856
io_schedule+0x41/0x60 kernel/sched/core.c:7689
folio_wait_bit_common+0x136/0x380 mm/filemap.c:1318
__folio_lock mm/filemap.c:1665 [inline]
folio_lock include/linux/pagemap.h:1163 [inline]
folio_lock include/linux/pagemap.h:1159 [inline]
__filemap_get_folio+0x1be/0x340 mm/filemap.c:1918
filemap_lock_folio include/linux/pagemap.h:800 [inline]
filemap_lock_hugetlb_folio include/linux/hugetlb.h:790 [inline]
hugetlb_fault+0x7e0/0xc10 mm/hugetlb.c:6451
handle_mm_fault+0x351/0x360 mm/memory.c:6199
do_user_addr_fault arch/x86/mm/fault.c:1337 [inline]
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x256/0x6e0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7ff30d9b7208
RSP: 002b:00007ffe455131e8 EFLAGS: 00010246
RAX: 0000000020000640 RBX: 0000000000000004 RCX: 006b6e696c766564
RDX: 0000000000000008 RSI: 006b6e696c766564 RDI: 0000000020000640
RBP: 00007ff30dba7a80 R08: 00007ff30d870000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000009 R12: 000000000000f242
R13: 00007ffe455132f0 R14: 0000000000000032 R15: fffffffffffffffe
INFO: task syz.2.312:5634 blocked for more than 143 seconds.
Not tainted 6.14.0-rc2-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.312 state:D stack:14080 pid:5634 tgid:5633 ppid:1901 task_flags:0x400140 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5377 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6764
__schedule_loop kernel/sched/core.c:6841 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6856
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6913
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5936
hugetlb_fault+0xa98/0xc10 mm/hugetlb.c:6499
handle_mm_fault+0x351/0x360 mm/memory.c:6199
do_user_addr_fault arch/x86/mm/fault.c:1388 [inline]
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x161/0x6e0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58
Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb
RSP: 0018:ffffc90002e9fde0 EFLAGS: 00050246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008
RDX: 0000000020027ed0 RSI: ffffc90002e9fe10 RDI: 0000000020027ec8
RBP: 0000000020027ec8 R08: 0000000000080000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90002e9fe10
R13: 0000000000018ff8 R14: 0000000020019680 R15: 0000000000000000
copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
_inline_copy_to_user include/linux/uaccess.h:197 [inline]
_copy_to_user+0x56/0x70 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
msr_read+0x68/0xe0 arch/x86/kernel/msr.c:69
vfs_read+0xe0/0x380 fs/read_write.c:563
ksys_read+0x6f/0xf0 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff30d9edff9
RSP: 002b:00007ff30d46f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007ff30dba5f80 RCX: 00007ff30d9edff9
RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003
RBP: 00007ff30da60296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff30dba5f80 R15: 00007ffe45513088
INFO: task syz.1.349:5807 blocked for more than 143 seconds.
Not tainted 6.14.0-rc2-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.349 state:D stack:13376 pid:5807 tgid:5807 ppid:2412 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5377 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6764
__schedule_loop kernel/sched/core.c:6841 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6856
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6913
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
handle_mm_fault+0x351/0x360 mm/memory.c:6199
do_user_addr_fault arch/x86/mm/fault.c:1337 [inline]
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x256/0x6e0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7faf843c7208
RSP: 002b:00007ffc22d85698 EFLAGS: 00010246
RAX: 0000000020000640 RBX: 0000000000000004 RCX: 006b6e696c766564
RDX: 0000000000000008 RSI: 006b6e696c766564 RDI: 0000000020000640
RBP: 00007faf845b7a80 R08: 00007faf8427a000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000009 R12: 000000000000f7cb
R13: 00007ffc22d857a0 R14: 0000000000000032 R15: fffffffffffffffe
INFO: task syz.1.349:5808 blocked for more than 143 seconds.
Not tainted 6.14.0-rc2-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.349 state:D stack:13520 pid:5808 tgid:5807 ppid:2412 task_flags:0x400140 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5377 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6764
__schedule_loop kernel/sched/core.c:6841 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6856
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6913
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
vfs_fallocate+0x121/0x3b0 fs/open.c:338
ksys_fallocate fs/open.c:362 [inline]
__do_sys_fallocate fs/open.c:367 [inline]
__se_sys_fallocate fs/open.c:365 [inline]
__x64_sys_fallocate+0x3e/0x80 fs/open.c:365
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faf843fdff9
RSP: 002b:00007faf83e79038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007faf845b5f80 RCX: 00007faf843fdff9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007faf84470296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007faf845b5f80 R15: 00007ffc22d85538
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8277c700 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8277c700 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8277c700 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x36/0x120 kernel/locking/lockdep.c:6746
2 locks held by kworker/u8:5/306:
2 locks held by getty/839:
#0: ffff888100a860a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x23/0x60 drivers/tty/tty_ldisc.c:243
#1: ffffc90001cb72f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x54b/0x6a0 drivers/tty/n_tty.c:2211
3 locks held by syz.2.312/5633:
#0: ffff88810e3dee18 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff88810e3dee18 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6367
#1: ffff888101ac44e8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
#2: ffff888101f2dee8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6374
2 locks held by syz.2.312/5634:
#0: ffff88810eede7a0 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
#0: ffff88810eede7a0 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6238 [inline]
#0: ffff88810eede7a0 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x270 mm/memory.c:6298
#1: ffff888101ac44e8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5936
2 locks held by syz.1.349/5807:
#0: ffff88810ebb1368 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff88810ebb1368 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6367
#1: ffff888101ac44e8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
3 locks held by syz.1.349/5808:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff888102ad32c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff888102ad32c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac44e8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.3.719/8161:
#0: ffff88810231deb0 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff88810231deb0 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6367
#1: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
#2: ffff888118999ee8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6374
2 locks held by syz.3.719/8162:
#0: ffff88810eed9460 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
#0: ffff88810eed9460 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6238 [inline]
#0: ffff88810eed9460 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x270 mm/memory.c:6298
#1: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5936
2 locks held by syz.4.747/8359:
#0: ffff888101b78bb8 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff888101b78bb8 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6367
#1: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
3 locks held by syz.4.747/8360:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff888102ad1c48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff888102ad1c48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
2 locks held by syz.0.750/8385:
#0: ffff88810f35ef48 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff88810f35ef48 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6367
#1: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
3 locks held by syz.0.750/8386:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff888102ad3748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff888102ad3748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.2.751/8403:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff888102ad0ec8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff888102ad0ec8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.0.1414/13076:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810db96548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810db96548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.1965/15825:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810db9ca48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810db9ca48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac44e8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.2.1968/15830:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810db9d348 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810db9d348 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.0.1802/15857:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810db9e548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810db9e548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.1.3377/23948:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810cb91c48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810cb91c48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.2.3378/23958:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810cb92548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810cb92548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac44e8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
2 locks held by syz.0.3392/24019:
#0: ffff88810ff8de60 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:199 [inline]
#0: ffff88810ff8de60 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6247 [inline]
#0: ffff88810ff8de60 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x98/0x270 mm/memory.c:6298
#1: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6367
3 locks held by syz.0.3392/24032:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810cb93748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810cb93748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.1.4315/28813:
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026b23f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810bb7e9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810bb7e9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101ac4188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.14.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x5a/0x90 lib/dump_stack.c:120
nmi_cpu_backtrace+0xd4/0x110 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0xd5/0x140 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
watchdog+0x645/0x680 kernel/hung_task.c:399
kthread+0xf7/0x200 kernel/kthread.c:464
ret_from_fork+0x2c/0x50 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.14.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:__prepare_ICR arch/x86/kernel/apic/local.h:34 [inline]
RIP: 0010:__default_send_IPI_dest_field arch/x86/kernel/apic/ipi.c:185 [inline]
RIP: 0010:default_send_IPI_single_phys+0xb8/0xd0 arch/x86/kernel/apic/ipi.c:193
Code: 58 00 00 f6 c4 10 75 da c1 e5 18 89 2c 25 10 c3 5f ff be 00 04 00 00 eb a4 e8 44 34 c3 00 eb ab c1 e5 18 89 2c 25 10 c3 5f ff 91 89 e8 c1 e0 18 89 04 25 10 c3 5f ff eb d8 0f 1f 84 00 00 00
RSP: 0018:ffffc90000073c88 EFLAGS: 00000006
RAX: 00000000000000fb RBX: 0000000000000282 RCX: 0000000000000002
RDX: ffff888237d00000 RSI: 00000000000000fb RDI: 0000000000000001
RBP: 0000000001000000 R08: ffff888237d34740 R09: 0000000000014235
R10: 0000000000000001 R11: ffffffff8303be0a R12: 000000000002dc0c
R13: ffff888237c2ffc0 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020032000 CR3: 000000000264a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
arch_send_call_function_single_ipi arch/x86/include/asm/smp.h:94 [inline]
send_call_function_single_ipi kernel/smp.c:118 [inline]
smp_call_function_many_cond+0x590/0x620 kernel/smp.c:867
on_each_cpu_cond_mask+0x3b/0x70 kernel/smp.c:1052
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:2118 [inline]
text_poke_bp_batch+0x2ec/0x310 arch/x86/kernel/alternative.c:2411
text_poke_flush arch/x86/kernel/alternative.c:2519 [inline]
text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:2526
arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:146
static_key_disable_cpuslocked kernel/jump_label.c:240 [inline]
static_key_disable_cpuslocked+0x4f/0x60 kernel/jump_label.c:228
static_key_disable+0x15/0x20 kernel/jump_label.c:248
toggle_allocation_gate mm/kfence/core.c:855 [inline]
toggle_allocation_gate+0x75/0x130 mm/kfence/core.c:842
process_one_work+0x22f/0x6b0 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3317 [inline]
worker_thread+0x1bc/0x350 kernel/workqueue.c:3398
kthread+0xf7/0x200 kernel/kthread.c:464
ret_from_fork+0x2c/0x50 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244