INFO: task syz-executor.0:17528 blocked for more than 143 seconds. Not tainted 5.15.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:29072 pid:17528 ppid: 6949 flags:0x00024004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xb04/0x5920 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 io_uring_cancel_generic+0x4e8/0x650 fs/io_uring.c:9799 io_uring_files_cancel include/linux/io_uring.h:16 [inline] do_exit+0x1dc/0x24b0 kernel/exit.c:780 do_group_exit+0xe7/0x290 kernel/exit.c:922 get_signal+0x3b2/0x1ce0 kernel/signal.c:2855 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fad1a281af9 RSP: 002b:00007fad199f7218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fad1a394f68 RCX: 00007fad1a281af9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fad1a394f68 RBP: 00007fad1a394f60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fad1a394f6c R13: 00007ffff0b6a51f R14: 00007fad199f7300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8ab75d40 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446 3 locks held by kworker/u4:2/148: #0: ffff8880b9f31a98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x120 kernel/sched/core.c:474 #1: ffff8880b9f1f9c8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x16a/0x480 kernel/sched/psi.c:871 #2: ffff888078184858 (key#16){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:368 [inline] #2: ffff888078184858 (key#16){+...}-{2:2}, at: batadv_nc_purge_paths+0xc0/0x2d0 net/batman-adv/network-coding.c:444 1 lock held by in:imklog/6169: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x30/0xc0 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x11a/0x160 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0x88c/0xbf0 kernel/hung_task.c:295 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 9148 Comm: kworker/u4:7 Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: phy11 ieee80211_iface_work RIP: 0010:lock_is_held_type+0xfd/0x140 kernel/locking/lockdep.c:5673 Code: 00 00 b8 ff ff ff ff 65 0f c1 05 9e b7 96 77 83 f8 01 75 29 9c 58 f6 c4 02 75 3d 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ed eb b9 0f 0b 48 RSP: 0018:ffffc9000d2efbc8 EFLAGS: 00000282 RAX: 0000000000000046 RBX: 0000000000000002 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff88cb3d40 RDI: ffffffff891fdca0 RBP: ffffffff8ab75c80 R08: 0000000000000000 R09: ffff8880b9f32a4b R10: ffffed10173e6549 R11: 0000000000000000 R12: ffff888072c8e2c0 R13: 0000000000000000 R14: 00000000ffffffff R15: ffff888072c8ed08 FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f305e186020 CR3: 000000000a88e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_is_held include/linux/lockdep.h:283 [inline] rcu_read_lock_sched_held+0x3a/0x70 kernel/rcu/update.c:125 trace_kfree include/trace/events/kmem.h:118 [inline] kfree+0x1b0/0x2c0 mm/slab.c:3789 skb_free_head net/core/skbuff.c:654 [inline] skb_release_data+0x500/0x640 net/core/skbuff.c:676 skb_release_all net/core/skbuff.c:741 [inline] __kfree_skb net/core/skbuff.c:755 [inline] kfree_skb net/core/skbuff.c:773 [inline] kfree_skb+0xe0/0x2c0 net/core/skbuff.c:767 ieee80211_iface_work+0x2a6/0x970 net/mac80211/iface.c:1495 process_one_work+0x87f/0x1450 kernel/workqueue.c:2297 worker_thread+0x598/0x1040 kernel/workqueue.c:2444 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: b8 ff ff ff ff mov $0xffffffff,%eax 7: 65 0f c1 05 9e b7 96 xadd %eax,%gs:0x7796b79e(%rip) # 0x7796b7ad e: 77 f: 83 f8 01 cmp $0x1,%eax 12: 75 29 jne 0x3d 14: 9c pushfq 15: 58 pop %rax 16: f6 c4 02 test $0x2,%ah 19: 75 3d jne 0x58 1b: 48 f7 04 24 00 02 00 testq $0x200,(%rsp) 22: 00 23: 74 01 je 0x26 25: fb sti 26: 48 83 c4 08 add $0x8,%rsp * 2a: 44 89 e8 mov %r13d,%eax <-- trapping instruction 2d: 5b pop %rbx 2e: 5d pop %rbp 2f: 41 5c pop %r12 31: 41 5d pop %r13 33: 41 5e pop %r14 35: 41 5f pop %r15 37: c3 retq 38: 45 31 ed xor %r13d,%r13d 3b: eb b9 jmp 0xfffffff6 3d: 0f 0b ud2 3f: 48 rex.W