ci starts bisection 2025-01-14 14:18:07.614637131 +0000 UTC m=+50.463228941 bisecting fixing commit since 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd building syzkaller on 402f1df054ddb07ed5bb299d08c781354eb06607 ensuring issue is reproducible on original commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ba4b294061e35433739fae3dd8cc5e7768d867fd3668edff37c5de231ba854f8 run #0: crashed: INFO: task hung in hugetlb_fault run #1: crashed: INFO: task hung in hugetlb_wp run #2: crashed: INFO: task hung in hugetlb_fault run #3: crashed: INFO: task hung in hugetlb_wp run #4: crashed: INFO: task hung in remove_inode_hugepages run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in hugetlb_fault run #7: crashed: INFO: task hung in hugetlb_fault run #8: crashed: INFO: task hung in hugetlb_fault run #9: crashed: INFO: task hung in hugetlb_fault run #10: crashed: INFO: task hung in remove_inode_hugepages run #11: crashed: INFO: task hung in hugetlb_fault run #12: crashed: INFO: task hung in hugetlb_fault run #13: crashed: INFO: task hung in hugetlb_fault run #14: crashed: INFO: task hung in hugetlb_fault run #15: crashed: INFO: task hung in hugetlb_fault run #16: crashed: INFO: task hung in hugetlb_fault run #17: crashed: INFO: task hung in hugetlb_wp run #18: crashed: INFO: task hung in hugetlb_fault run #19: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_fault, types: [HANG] check whether we can drop unnecessary instrumentation disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9afa48040e6583040e7b313a02ce5118627b180cf07dae0459301027993185b9 run #0: crashed: INFO: task hung in hugetlb_wp run #1: crashed: INFO: task hung in hugetlb_fault run #2: crashed: INFO: task hung in hugetlb_fault run #3: crashed: INFO: task hung in hugetlb_fault run #4: crashed: INFO: task hung in hugetlb_fault run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in remove_inode_hugepages run #7: crashed: INFO: task hung in hugetlb_fault run #8: crashed: INFO: task hung in hugetlb_fault run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_wp, types: [HANG] the bug reproduces without the instrumentation disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed kconfig minimization: base=4046 full=8192 leaves diff=2108 split chunks (needed=false): <2108> split chunk #0 of len 2108 into 5 parts testing without sub-chunk 1/5 disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f17de0560cb066696d9e558fef0748fcecc2c2bd0922b8cd1b63bb3ad49814e7 run #0: crashed: INFO: task hung in remove_inode_hugepages run #1: crashed: INFO: task hung in hugetlb_fault run #2: crashed: INFO: task hung in remove_inode_hugepages run #3: crashed: INFO: task hung in hugetlb_fault run #4: crashed: INFO: task hung in hugetlb_fault run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in hugetlb_fault run #7: crashed: INFO: task hung in hugetlb_fault run #8: crashed: INFO: task hung in hugetlb_wp run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in remove_inode_hugepages, types: [HANG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 837ef1c10ddc0a7a9f9d6a8f863d6d78292953aa759858408853ce382751a45d run #0: crashed: INFO: task hung in hugetlb_wp run #1: crashed: INFO: task hung in hugetlb_fault run #2: crashed: INFO: task hung in hugetlb_fault run #3: crashed: INFO: task hung in hugetlb_fault run #4: crashed: INFO: task hung in hugetlb_fault run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in hugetlbfs_fallocate run #7: crashed: INFO: task hung in remove_inode_hugepages run #8: crashed: INFO: task hung in hugetlb_fault run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_wp, types: [HANG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a7828f4be3e6782341d7f41c122d5061c65fbd4972d64cd8f3b20fd782064520 run #0: crashed: INFO: task hung in hugetlb_wp run #1: crashed: INFO: task hung in hugetlb_fault run #2: crashed: INFO: task hung in hugetlb_wp run #3: crashed: INFO: task hung in hugetlb_fault run #4: crashed: INFO: task hung in hugetlb_wp run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in hugetlb_fault run #7: crashed: INFO: task hung in remove_inode_hugepages run #8: crashed: INFO: task hung in hugetlb_fault run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_wp, types: [HANG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c67fe0ecca06f617bd830994d140ff8827badab75538481efdeefcee42fdbaa4 run #0: crashed: INFO: task hung in hugetlb_fault run #1: crashed: INFO: task hung in remove_inode_hugepages run #2: crashed: INFO: task hung in hugetlb_fault run #3: crashed: INFO: task hung in hugetlb_fault run #4: crashed: INFO: task hung in remove_inode_hugepages run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in hugetlb_fault run #7: crashed: INFO: task hung in hugetlb_fault run #8: crashed: INFO: task hung in hugetlb_fault run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_fault, types: [HANG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: bc6934fed10c431aef7d943090f579f572da344f50cbd8fcdcf8a4c72a4ba1a8 run #0: crashed: INFO: task hung in hugetlb_fault run #1: crashed: INFO: task hung in hugetlb_fault run #2: crashed: INFO: task hung in hugetlb_fault run #3: crashed: INFO: task hung in remove_inode_hugepages run #4: crashed: INFO: task hung in hugetlb_fault run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in remove_inode_hugepages run #7: crashed: INFO: task hung in hugetlb_fault run #8: crashed: INFO: task hung in remove_inode_hugepages run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_fault, types: [HANG] the chunk can be dropped disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD c45323b7560ec87c37c729b703c86ee65f136d75 testing commit c45323b7560ec87c37c729b703c86ee65f136d75 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e80ad1d6f7b4655bd3d15dad2b036c71a74fbb0c2eeb58f2e7c963b3eec56906 run #0: ignore: lost connection to test machine run #1: crashed: INFO: task hung in hugetlb_fault run #2: crashed: INFO: task hung in hugetlb_fault run #3: crashed: INFO: task hung in hugetlb_fault run #4: crashed: INFO: task hung in hugetlb_fault run #5: crashed: INFO: task hung in hugetlb_fault run #6: crashed: INFO: task hung in hugetlb_fault run #7: crashed: INFO: task hung in hugetlb_fault run #8: crashed: INFO: task hung in hugetlb_fault run #9: crashed: INFO: task hung in hugetlb_fault representative crash: INFO: task hung in hugetlb_fault, types: [HANG] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 3h8m30.786507432s (build: 1h8m56.980245409s, test: 55m35.405300469s) crash still not fixed or there were kernel test errors commit msg: Merge tag 'mm-hotfixes-stable-2025-01-13-00-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm crash: INFO: task hung in hugetlb_fault INFO: task syz.3.393:6049 blocked for more than 143 seconds. Not tainted 6.13.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.393 state:D stack:13952 pid:6049 tgid:6049 ppid:2418 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x4c4/0xac0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x25/0x110 kernel/sched/core.c:6848 io_schedule+0x41/0x60 kernel/sched/core.c:7681 folio_wait_bit_common+0x136/0x380 mm/filemap.c:1299 __folio_lock mm/filemap.c:1637 [inline] folio_lock include/linux/pagemap.h:1151 [inline] folio_lock include/linux/pagemap.h:1147 [inline] __filemap_get_folio+0x196/0x2f0 mm/filemap.c:1890 filemap_lock_folio include/linux/pagemap.h:788 [inline] filemap_lock_hugetlb_folio include/linux/hugetlb.h:789 [inline] hugetlb_fault+0x7e6/0xc10 mm/hugetlb.c:6429 handle_mm_fault+0x351/0x360 mm/memory.c:6110 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x256/0x6e0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f7bae7d7208 RSP: 002b:00007ffee810e1c8 EFLAGS: 00010246 RAX: 0000000020000640 RBX: 0000000000000004 RCX: 006b6e696c766564 RDX: 0000000000000008 RSI: 006b6e696c766564 RDI: 0000000020000640 RBP: 00007f7bae9c7a80 R08: 00007f7bae690000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000009 R12: 000000000001292b R13: 00007ffee810e2d0 R14: 0000000000000032 R15: fffffffffffffffe INFO: task syz.3.393:6050 blocked for more than 143 seconds. Not tainted 6.13.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.393 state:D stack:13488 pid:6050 tgid:6049 ppid:2418 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x4c4/0xac0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x25/0x110 kernel/sched/core.c:6848 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905 __mutex_lock_common kernel/locking/mutex.c:665 [inline] __mutex_lock+0x573/0xa80 kernel/locking/mutex.c:735 hugetlb_wp+0x6ff/0xc90 mm/hugetlb.c:5913 hugetlb_fault+0xa9e/0xc10 mm/hugetlb.c:6477 handle_mm_fault+0x351/0x360 mm/memory.c:6110 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x161/0x6e0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58 Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb RSP: 0018:ffffc9000367fde0 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 RDX: 0000000020020bc8 RSI: ffffc9000367fe10 RDI: 0000000020020bc0 RBP: 0000000020020bc0 R08: 0000000000080000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffc9000367fe10 R13: 0000000000018ff8 R14: 0000000020019680 R15: 0000000000000000 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] _inline_copy_to_user include/linux/uaccess.h:197 [inline] _copy_to_user+0x56/0x70 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:225 [inline] msr_read+0x68/0xe0 arch/x86/kernel/msr.c:69 vfs_read+0xe0/0x370 fs/read_write.c:563 ksys_read+0x6f/0xf0 fs/read_write.c:708 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7bae80dff9 RSP: 002b:00007f7bae28f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f7bae9c5f80 RCX: 00007f7bae80dff9 RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003 RBP: 00007f7bae880296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f7bae9c5f80 R15: 00007ffee810e068 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8277d540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8277d540 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8277d540 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x36/0x120 kernel/locking/lockdep.c:6744 2 locks held by getty/840: #0: ffff888100a8e0a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x23/0x60 drivers/tty/tty_ldisc.c:243 #1: ffffc900001fb2f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x54b/0x6a0 drivers/tty/n_tty.c:2211 3 locks held by syz.3.393/6049: #0: ffff888107abf1a0 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline] #0: ffff888107abf1a0 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6278 #1: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6345 #2: ffff8881046face8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6352 2 locks held by syz.3.393/6050: #0: ffff88810376d2e0 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88810376d2e0 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6149 [inline] #0: ffff88810376d2e0 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x280 mm/memory.c:6209 #1: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x6ff/0xc90 mm/hugetlb.c:5913 2 locks held by syz.2.487/6491: #0: ffff888103768ae0 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline] #0: ffff888103768ae0 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6158 [inline] #0: ffff888103768ae0 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x98/0x280 mm/memory.c:6209 #1: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6345 3 locks held by syz.2.487/6499: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff888100ea7748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff888100ea7748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.1.496/6532: #0: ffff888101fee2d0 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline] #0: ffff888101fee2d0 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6278 #1: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6345 #2: ffff8881097a1ee8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6352 2 locks held by syz.1.496/6533: #0: ffff88810376f6e0 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88810376f6e0 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6149 [inline] #0: ffff88810376f6e0 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x280 mm/memory.c:6209 #1: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x6ff/0xc90 mm/hugetlb.c:5913 2 locks held by syz.0.527/6655: #0: ffff88810efc76f8 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline] #0: ffff88810efc76f8 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6278 #1: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6345 3 locks held by syz.0.527/6657: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff888119102e48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff888119102e48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.0.994/10384: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810dbbb2c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810dbbb2c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.2.1049/10617: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810dbbbbc8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810dbbbbc8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.3.1301/11690: #0: ffff88810ef595c8 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline] #0: ffff88810ef595c8 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6278 #1: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6345 #2: ffff888100f20ee8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6352 2 locks held by syz.3.1301/11691: #0: ffff88810e3637e0 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88810e3637e0 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6149 [inline] #0: ffff88810e3637e0 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x280 mm/memory.c:6209 #1: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x6ff/0xc90 mm/hugetlb.c:5913 3 locks held by syz.1.1309/11716: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810dbba9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810dbba9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.4.1310/11722: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff888100ea60c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff888100ea60c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.2.1854/15910: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810cf38148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810cf38148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.4.1859/15925: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810cf38ec8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810cf38ec8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.3.1873/15988: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810cf3a9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810cf3a9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.0.1875/15992: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810cf3ae48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810cf3ae48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.1.2006/16390: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810cf3b2c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810cf3b2c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.0.2201/19411: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810c33a9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810c33a9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.1.2212/19444: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810c33b748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810c33b748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.3.2985/23333: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810b710a48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810b710a48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae9188 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.0.3769/26844: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810b780148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810b780148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.1.3778/26882: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810b7820c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810b7820c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae98d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 3 locks held by syz.3.3790/26935: #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:351 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:356 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:354 [inline] #0: ffff888101ac73f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:354 #1: ffff88810b783748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:818 [inline] #1: ffff88810b783748 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:760 #2: ffff888101ae93c8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:804 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x5a/0x90 lib/dump_stack.c:120 nmi_cpu_backtrace+0xd4/0x110 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0xd5/0x140 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline] watchdog+0x63b/0x670 kernel/hung_task.c:397 kthread+0xd6/0x100 kernel/kthread.c:389 ret_from_fork+0x2c/0x50 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 27693 Comm: syz-executor Not tainted 6.13.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:stack_trace_consume_entry+0x22/0x50 kernel/stacktrace.c:94 Code: 90 90 90 90 90 90 90 90 f3 0f 1e fa 8b 47 10 31 d2 3b 47 08 73 1d 8b 57 0c 85 d2 75 1d 48 8b 17 8d 48 01 89 4f 10 48 89 34 c2 <8b> 47 08 39 47 10 0f 92 c2 89 d0 c3 cc cc cc cc 83 ea 01 89 57 0c RSP: 0018:ffffc90005ef77d8 EFLAGS: 00000246 RAX: 0000000000000004 RBX: ffffc90005ef77e0 RCX: 0000000000000005 RDX: ffffc90005ef78a8 RSI: ffffffff8127d0bf RDI: ffffc90005ef7880 RBP: ffffc90005ef7870 R08: ffffffff812dddc6 R09: ffffffff82975524 R10: 0000000000000010 R11: ffff888106ec6dc0 R12: ffffffff811503d0 R13: ffffc90005ef7880 R14: 0000000000000000 R15: ffff88810cb4a1c0 FS: 000055557e095500(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc0577956c0 CR3: 0000000118b7e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0x86/0x100 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x4f/0x80 kernel/stacktrace.c:122 save_stack+0x86/0xb0 mm/page_owner.c:156 __set_page_owner+0x24/0x180 mm/page_owner.c:320 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xcb/0x180 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x718/0x1380 mm/page_alloc.c:3476 __alloc_pages_noprof+0x1e5/0x350 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x47/0x150 mm/mempolicy.c:2269 pagetable_alloc_noprof include/linux/mm.h:2899 [inline] __pud_alloc_one_noprof include/asm-generic/pgalloc.h:174 [inline] pud_alloc_one_noprof include/asm-generic/pgalloc.h:195 [inline] __pud_alloc+0x2f/0x220 mm/memory.c:6341 pud_alloc include/linux/mm.h:2856 [inline] copy_pud_range mm/memory.c:1278 [inline] copy_p4d_range mm/memory.c:1322 [inline] copy_page_range+0xce8/0x1f20 mm/memory.c:1420 dup_mmap kernel/fork.c:748 [inline] dup_mm kernel/fork.c:1691 [inline] copy_mm kernel/fork.c:1743 [inline] copy_process+0x18fb/0x2890 kernel/fork.c:2394 kernel_clone+0xa9/0x4e0 kernel/fork.c:2806 __do_sys_clone+0x66/0x90 kernel/fork.c:2949 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc056aa4853 Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 RSP: 002b:00007ffe61f401c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc056aa4853 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 000055557e0957d0 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000036580 R14: 000000000003650b R15: 00007ffe61f40350