INFO: task kworker/u5:7:2671 blocked for more than 143 seconds.
Not tainted 6.5.0-rc5-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u5:7 state:D stack:28384 pid:2671 ppid:2 flags:0x00004000
Workqueue: hci4 hci_cmd_sync_work
Call Trace:
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0xe64/0x59b0 kernel/sched/core.c:6710
schedule+0xe7/0x1b0 kernel/sched/core.c:6786
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6845
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x5b4/0x990 kernel/locking/mutex.c:747
hci_connect_cfm include/net/bluetooth/hci_core.h:1882 [inline]
hci_conn_failed+0xf8/0x2c0 net/bluetooth/hci_conn.c:1230
hci_abort_conn_sync+0x346/0x800 net/bluetooth/hci_sync.c:5433
hci_cmd_sync_work+0x173/0x340 net/bluetooth/hci_sync.c:306
process_one_work+0x973/0x1530 kernel/workqueue.c:2600
worker_thread+0xff/0x12d0 kernel/workqueue.c:2751
kthread+0x28d/0x350 kernel/kthread.c:389
ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
Showing all locks held in the system:
5 locks held by kworker/u4:1/12:
1 lock held by rcu_tasks_kthre/13:
#0: ffffffff886be930 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x2c/0xe30 kernel/rcu/tasks.h:522
1 lock held by rcu_tasks_trace/14:
#0: ffffffff886be630 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x2c/0xe30 kernel/rcu/tasks.h:522
3 locks held by kworker/1:0/22:
3 locks held by kworker/1:1/26:
1 lock held by khungtaskd/28:
#0: ffffffff886bf540 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x340 kernel/locking/lockdep.c:6615
2 locks held by kworker/u4:2/40:
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:20 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: raw_atomic64_set include/linux/atomic/atomic-arch-fallback.h:2608 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: raw_atomic_long_set include/linux/atomic/atomic-long.h:79 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:3196 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:678 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:705 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x861/0x1530 kernel/workqueue.c:2570
#1: ffffc90000b17d98 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x88e/0x1530 kernel/workqueue.c:2574
6 locks held by kworker/u5:0/46:
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:20 [inline]
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: raw_atomic64_set include/linux/atomic/atomic-arch-fallback.h:2608 [inline]
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: raw_atomic_long_set include/linux/atomic/atomic-long.h:79 [inline]
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:3196 [inline]
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:678 [inline]
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:705 [inline]
#0: ffff888076730938 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x861/0x1530 kernel/workqueue.c:2570
#1: ffffc90000b77d98 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x88e/0x1530 kernel/workqueue.c:2574
#2: ffff88807abf50b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x13f/0x340 net/bluetooth/hci_sync.c:305
#3: ffff88807abf4078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x33a/0x800 net/bluetooth/hci_sync.c:5432
#4: ffffffff898c8b48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1882 [inline]
#4: ffffffff898c8b48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0xf8/0x2c0 net/bluetooth/hci_conn.c:1230
#5: ffffffff886ca9f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:325 [inline]
#5: ffffffff886ca9f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3ff/0x800 kernel/rcu/tree_exp.h:992
2 locks held by kworker/u4:3/408:
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:20 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: raw_atomic64_set include/linux/atomic/atomic-arch-fallback.h:2608 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: raw_atomic_long_set include/linux/atomic/atomic-long.h:79 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:3196 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:678 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:705 [inline]
#0: ffff88800d079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x861/0x1530 kernel/workqueue.c:2570
#1: ffffc90002ab7d98 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x88e/0x1530 kernel/workqueue.c:2574
3 locks held by kworker/0:2/599:
2 locks held by getty/2129:
#0: ffff8881401ff098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x23/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900000bb2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xc6c/0x1310 drivers/tty/n_tty.c:2187
3 locks held by kworker/1:3/2547:
2 locks held by syz-executor.5/2661:
#0: ffff88807d80afe0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:167 [inline]
#0: ffff88807d80afe0 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5261 [inline]
#0: ffff88807d80afe0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x26/0x590 mm/memory.c:5323
#1: ffffffff887bc5e8 (oom_lock){+.+.}-{3:3}, at: mem_cgroup_out_of_memory+0x8d/0x270 mm/memcontrol.c:1734
5 locks held by kworker/u5:7/2671:
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:20 [inline]
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: raw_atomic64_set include/linux/atomic/atomic-arch-fallback.h:2608 [inline]
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: raw_atomic_long_set include/linux/atomic/atomic-long.h:79 [inline]
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:3196 [inline]
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:678 [inline]
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:705 [inline]
#0: ffff8880760f9938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x861/0x1530 kernel/workqueue.c:2570
#1: ffffc9000341fd98 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x88e/0x1530 kernel/workqueue.c:2574
#2: ffff88807b5f90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x13f/0x340 net/bluetooth/hci_sync.c:305
#3: ffff88807b5f8078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x33a/0x800 net/bluetooth/hci_sync.c:5432
#4: ffffffff898c8b48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1882 [inline]
#4: ffffffff898c8b48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0xf8/0x2c0 net/bluetooth/hci_conn.c:1230
3 locks held by kworker/0:5/4848:
3 locks held by kworker/1:4/4867:
3 locks held by kworker/0:6/4869:
3 locks held by kworker/1:9/4991:
3 locks held by kworker/0:10/8268:
3 locks held by kworker/1:11/11791:
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x5c/0xb0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x167/0x210 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d4/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xa22/0xca0 kernel/hung_task.c:379
kthread+0x28d/0x350 kernel/kthread.c:389
ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 26203 Comm: syz-executor.5 Not tainted 6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
RIP: 0010:stack_access_ok+0x166/0x1f0 arch/x86/kernel/unwind_orc.c:398
Code: 0f 85 8d 00 00 00 49 39 ee 48 8b 43 10 77 25 48 39 e8 76 20 4c 01 e5 48 39 e8 0f 93 c0 49 39 ee 0f 92 c2 21 d0 48 83 c4 08 5b <5d> 41 5c 41 5d 41 5e 41 5f c3 48 83 c4 08 31 c0 5b 5d 41 5c 41 5d
RSP: 0018:ffffc900be67f730 EFLAGS: 00000286
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffc900be680000
RDX: ffffc900be67ff01 RSI: ffffc900be67ff50 RDI: ffffc900be67f7d0
RBP: ffffc900be67ff50 R08: ffffffff8a98625e R09: ffffffff8a98625c
R10: ffffc900be67f7d0 R11: 000000000005b88c R12: 0000000000000008
R13: ffffc900be67f7e0 R14: ffffc900be67f7d8 R15: ffffc900be678000
FS: 0000555555f6a480(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff8dddabf84 CR3: 000000003d9bf000 CR4: 0000000000350ee0
Call Trace:
deref_stack_reg arch/x86/kernel/unwind_orc.c:403 [inline]
unwind_next_frame+0xab5/0x2020 arch/x86/kernel/unwind_orc.c:585
arch_stack_walk+0x8b/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x96/0xd0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:186 [inline]
slab_post_alloc_hook+0x5a/0xd0 mm/slab.h:762
kmem_cache_alloc_bulk+0x40c/0x7d0 mm/slub.c:4048
mt_alloc_bulk lib/maple_tree.c:164 [inline]
mas_alloc_nodes+0x2dd/0x700 lib/maple_tree.c:1304
mas_node_count_gfp lib/maple_tree.c:1362 [inline]
mas_preallocate+0x16e/0x300 lib/maple_tree.c:5547
vma_iter_prealloc mm/internal.h:1032 [inline]
mmap_region+0x645/0x1f70 mm/mmap.c:2810
do_mmap+0x61a/0xd30 mm/mmap.c:1363
vm_mmap_pgoff+0x16d/0x350 mm/util.c:543
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff8ddc7cde3
Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 b0 ff ff ff 64 c7
RSP: 002b:00007ffd51115998 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007ff8dd7ff6c0 RCX: 00007ff8ddc7cde3
RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffd51115c40
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000