INFO: task syz.3.421:8941 blocked for more than 143 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.421 state:D stack:25824 pid:8941 tgid:8941 ppid:6577 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 io_schedule+0xbf/0x130 kernel/sched/core.c:7574 folio_wait_bit_common+0x3d8/0x9b0 mm/filemap.c:1309 __folio_lock mm/filemap.c:1647 [inline] folio_lock include/linux/pagemap.h:1148 [inline] folio_lock include/linux/pagemap.h:1144 [inline] __filemap_get_folio+0x6a4/0xaf0 mm/filemap.c:1900 filemap_lock_folio include/linux/pagemap.h:788 [inline] filemap_lock_hugetlb_folio include/linux/hugetlb.h:795 [inline] hugetlb_fault+0x16ff/0x2fa0 mm/hugetlb.c:6406 handle_mm_fault+0x930/0xaa0 mm/memory.c:6064 do_user_addr_fault+0x60d/0x13f0 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7fb725545a98 RSP: 002b:00007ffe95860148 EFLAGS: 00010246 RAX: 0000000020000640 RBX: 0000000000000004 RCX: 006b6e696c766564 RDX: 0000000000000008 RSI: 006b6e696c766564 RDI: 0000000020000640 RBP: 00007fb725737a80 R08: 00007fb725400000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000009 R12: 000000000002d037 R13: 00007ffe95860250 R14: 0000000000000032 R15: fffffffffffffffe INFO: task syz.3.421:8943 blocked for more than 144 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.421 state:D stack:27312 pid:8943 tgid:8941 ppid:6577 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlb_wp+0x1b4a/0x3320 mm/hugetlb.c:5894 hugetlb_fault+0x2248/0x2fa0 mm/hugetlb.c:6454 handle_mm_fault+0x930/0xaa0 mm/memory.c:6064 do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1389 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58 Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb RSP: 0018:ffffc9000c4ffc40 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 RDX: fffff5200189ff98 RSI: ffffc9000c4ffcb8 RDI: 000000002001d6d8 RBP: 000000002001d6d8 R08: 0000000000000000 R09: fffff5200189ff97 R10: ffffc9000c4ffcbf R11: 0000000000000000 R12: ffffc9000c4ffcb8 R13: 000000002001d6e0 R14: 00007fffffffefff R15: 0000000000000000 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] _inline_copy_to_user include/linux/uaccess.h:188 [inline] _copy_to_user+0xbb/0xd0 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:216 [inline] msr_read+0x14f/0x250 arch/x86/kernel/msr.c:69 vfs_read+0x1df/0xbe0 fs/read_write.c:567 ksys_read+0x12f/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb72557dff9 RSP: 002b:00007fb72640b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fb725735f80 RCX: 00007fb72557dff9 RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003 RBP: 00007fb7255f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fb725735f80 R15: 00007ffe9585ffe8 INFO: task syz.0.423:8952 blocked for more than 145 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.423 state:D stack:28288 pid:8952 tgid:8950 ppid:6565 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 handle_mm_fault+0x930/0xaa0 mm/memory.c:6064 do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1389 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58 Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb RSP: 0018:ffffc9000c5c7c40 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 RDX: fffff520018b8f98 RSI: ffffc9000c5c7cb8 RDI: 000000002001fc68 RBP: 000000002001fc68 R08: 0000000000000000 R09: fffff520018b8f97 R10: ffffc9000c5c7cbf R11: 0000000000000000 R12: ffffc9000c5c7cb8 R13: 000000002001fc70 R14: 00007fffffffefff R15: 0000000000000000 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] _inline_copy_to_user include/linux/uaccess.h:188 [inline] _copy_to_user+0xbb/0xd0 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:216 [inline] msr_read+0x14f/0x250 arch/x86/kernel/msr.c:69 vfs_read+0x1df/0xbe0 fs/read_write.c:567 ksys_read+0x12f/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7febbef7dff9 RSP: 002b:00007febbfd4d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007febbf135f80 RCX: 00007febbef7dff9 RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003 RBP: 00007febbeff0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007febbf135f80 R15: 00007ffc4a54bc38 INFO: task syz.0.423:8954 blocked for more than 146 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.423 state:D stack:27408 pid:8954 tgid:8950 ppid:6565 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 vfs_fallocate+0x459/0xf90 fs/open.c:333 ksys_fallocate fs/open.c:356 [inline] __do_sys_fallocate fs/open.c:364 [inline] __se_sys_fallocate fs/open.c:362 [inline] __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7febbef7dff9 RSP: 002b:00007febbfd2c038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007febbf136058 RCX: 00007febbef7dff9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007febbeff0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007febbf136058 R15: 00007ffc4a54bc38 INFO: task syz.2.436:9028 blocked for more than 146 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.436 state:D stack:28272 pid:9028 tgid:9027 ppid:6568 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 handle_mm_fault+0x930/0xaa0 mm/memory.c:6064 do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1389 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58 Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb RSP: 0018:ffffc9000baefc40 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 RDX: fffff5200175df98 RSI: ffffc9000baefcb8 RDI: 0000000020025000 RBP: 0000000020025000 R08: 0000000000000000 R09: fffff5200175df97 R10: ffffc9000baefcbf R11: 0000000000000000 R12: ffffc9000baefcb8 R13: 0000000020025008 R14: 00007fffffffefff R15: 0000000000000000 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] _inline_copy_to_user include/linux/uaccess.h:188 [inline] _copy_to_user+0xbb/0xd0 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:216 [inline] msr_read+0x14f/0x250 arch/x86/kernel/msr.c:69 vfs_read+0x1df/0xbe0 fs/read_write.c:567 ksys_read+0x12f/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f95b997dff9 RSP: 002b:00007f95b93ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f95b9b35f80 RCX: 00007f95b997dff9 RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003 RBP: 00007f95b99f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f95b9b35f80 R15: 00007ffd8cab0a08 INFO: task syz.2.436:9029 blocked for more than 147 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.436 state:D stack:27408 pid:9029 tgid:9027 ppid:6568 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 vfs_fallocate+0x459/0xf90 fs/open.c:333 ksys_fallocate fs/open.c:356 [inline] __do_sys_fallocate fs/open.c:364 [inline] __se_sys_fallocate fs/open.c:362 [inline] __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f95b997dff9 RSP: 002b:00007f95b93de038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007f95b9b36058 RCX: 00007f95b997dff9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f95b99f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f95b9b36058 R15: 00007ffd8cab0a08 INFO: task syz.1.486:9229 blocked for more than 147 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.486 state:D stack:27408 pid:9229 tgid:9227 ppid:6564 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 vfs_fallocate+0x459/0xf90 fs/open.c:333 ksys_fallocate fs/open.c:356 [inline] __do_sys_fallocate fs/open.c:364 [inline] __se_sys_fallocate fs/open.c:362 [inline] __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f42edf7dff9 RSP: 002b:00007f42eecf7038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007f42ee136058 RCX: 00007f42edf7dff9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f42edff0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f42ee136058 R15: 00007ffe6df91a88 INFO: task syz.4.498:9282 blocked for more than 147 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.498 state:D stack:27648 pid:9282 tgid:9281 ppid:6575 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 handle_mm_fault+0x930/0xaa0 mm/memory.c:6064 do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1389 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58 Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb RSP: 0018:ffffc9000bea7c40 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 RDX: fffff520017d4f98 RSI: ffffc9000bea7cb8 RDI: 0000000020027ef0 RBP: 0000000020027ef0 R08: 0000000000000000 R09: fffff520017d4f97 R10: ffffc9000bea7cbf R11: 0000000000000000 R12: ffffc9000bea7cb8 R13: 0000000020027ef8 R14: 00007fffffffefff R15: 0000000000000000 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] _inline_copy_to_user include/linux/uaccess.h:188 [inline] _copy_to_user+0xbb/0xd0 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:216 [inline] msr_read+0x14f/0x250 arch/x86/kernel/msr.c:69 vfs_read+0x1df/0xbe0 fs/read_write.c:567 ksys_read+0x12f/0x260 fs/read_write.c:712 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe43377dff9 RSP: 002b:00007fe434566038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fe433935f80 RCX: 00007fe43377dff9 RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003 RBP: 00007fe4337f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fe433935f80 R15: 00007ffcbab51f48 INFO: task syz.4.498:9283 blocked for more than 148 seconds. Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.498 state:D stack:27408 pid:9283 tgid:9281 ppid:6575 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5328 [inline] __schedule+0xe55/0x5730 kernel/sched/core.c:6690 __schedule_loop kernel/sched/core.c:6767 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6782 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6839 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 vfs_fallocate+0x459/0xf90 fs/open.c:333 ksys_fallocate fs/open.c:356 [inline] __do_sys_fallocate fs/open.c:364 [inline] __se_sys_fallocate fs/open.c:362 [inline] __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe43377dff9 RSP: 002b:00007fe434545038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d RAX: ffffffffffffffda RBX: 00007fe433936058 RCX: 00007fe43377dff9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007fe4337f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fe433936058 R15: 00007ffcbab51f48 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e1b8340 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6720 3 locks held by kworker/u8:2/35: 3 locks held by kworker/u8:4/66: #0: ffff888030feb948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204 #1: ffffc900020afd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205 #2: ffffffff8fee2a68 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4736 3 locks held by kworker/u8:7/1147: #0: ffff88801b089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x129b/0x1ba0 kernel/workqueue.c:3204 #1: ffffc90003f47d80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205 #2: ffffffff8fee2a68 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:276 2 locks held by kworker/u8:8/3546: 1 lock held by udevd/5202: 2 locks held by getty/5580: #0: ffff8880351520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211 3 locks held by syz.3.421/8941: #0: ffff8880325a9658 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:704 [inline] #0: ffff8880325a9658 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6232 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 #2: ffff8880795230e8 (&resv_map->rw_sema){++++}-{3:3}, at: hugetlb_vma_lock_read mm/hugetlb.c:276 [inline] #2: ffff8880795230e8 (&resv_map->rw_sema){++++}-{3:3}, at: hugetlb_vma_lock_read+0x105/0x140 mm/hugetlb.c:267 2 locks held by syz.3.421/8943: #0: ffff88807965ba98 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88807965ba98 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6103 [inline] #0: ffff88807965ba98 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x35/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_wp+0x1b4a/0x3320 mm/hugetlb.c:5894 2 locks held by syz.0.423/8952: #0: ffff88803190cd98 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff88803190cd98 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6103 [inline] #0: ffff88803190cd98 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x35/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.0.423/8954: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff8880605424b8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff8880605424b8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz.2.436/9028: #0: ffff88807949d718 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline] #0: ffff88807949d718 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6112 [inline] #0: ffff88807949d718 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x3a9/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.2.436/9029: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88806d298b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88806d298b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.1.486/9229: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888031491a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888031491a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz.4.498/9282: #0: ffff88807995c418 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline] #0: ffff88807995c418 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6112 [inline] #0: ffff88807995c418 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x3a9/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.4.498/9283: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88806442aed8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88806442aed8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.3.508/9346: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888060540b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888060540b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.4.620/9848: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88805d8be4b8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88805d8be4b8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.1.624/9864: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888031775a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888031775a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz.2.633/9899: #0: ffff8880248f7398 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline] #0: ffff8880248f7398 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6112 [inline] #0: ffff8880248f7398 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x3a9/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.2.633/9900: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888031775fa8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888031775fa8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.0.639/9926: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88805d8bda98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88805d8bda98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.3.785/10581: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888025d2f3e8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888025d2f3e8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz.0.833/10773: #0: ffff888079a21e18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:163 [inline] #0: ffff888079a21e18 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6103 [inline] #0: ffff888079a21e18 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x35/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.0.833/10777: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88806d534658 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88806d534658 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz.4.834/10776: #0: ffff888035284418 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:153 [inline] #0: ffff888035284418 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6112 [inline] #0: ffff888035284418 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x3a9/0x6a0 mm/memory.c:6163 #1: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlb_fault+0x307/0x2fa0 mm/hugetlb.c:6326 3 locks held by syz.4.834/10778: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88806d534b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88806d534b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.1.1096/11856: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88807d058b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88807d058b68 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.3.1102/11877: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff88807d059a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff88807d059a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.2.1140/12045: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888055e42ed8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888055e42ed8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.2.1561/13778: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888051e8da98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888051e8da98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.3.1583/13857: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888050b0f3e8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888050b0f3e8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.1.1601/13939: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff888057355a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff888057355a98 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 3 locks held by syz.2.2038/15728: #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: ksys_fallocate fs/open.c:356 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __do_sys_fallocate fs/open.c:364 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __se_sys_fallocate fs/open.c:362 [inline] #0: ffff8881452ce420 (sb_writers#14){.+.+}-{0:0}, at: __x64_sys_fallocate+0xd9/0x150 fs/open.c:362 #1: ffff8880328c8658 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline] #1: ffff8880328c8658 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x2b6/0xfc0 fs/hugetlbfs/inode.c:828 #2: ffff888141e84458 (&hugetlb_fault_mutex_table[i]){+.+.}-{3:3}, at: hugetlbfs_fallocate+0x577/0xfc0 fs/hugetlbfs/inode.c:872 2 locks held by syz-executor/16547: #0: ffffffff8fee2a68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fee2a68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6672 #1: ffffffff8e1c3c38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock+0x282/0x3b0 kernel/rcu/tree_exp.h:297 1 lock held by syz.3.2282/16728: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xf0c/0x1240 kernel/hung_task.c:379 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 14479 Comm: syz-executor Not tainted 6.12.0-rc5-syzkaller-g819837584309 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:check_preemption_disabled+0x2e/0xe0 lib/smp_processor_id.c:19 Code: 48 83 ec 08 65 8b 1d 4d ce e0 74 65 8b 05 42 ce e0 74 a9 ff ff ff 7f 74 0f 48 83 c4 08 89 d8 5b 5d 41 5c c3 cc cc cc cc 9c 58 c4 02 74 ea 65 48 8b 05 15 ce e0 74 f6 40 2f 04 48 89 fd 74 09 RSP: 0018:ffffc9000d7bf938 EFLAGS: 00000046 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 1ffffffff2dcdffc RDX: 0000000000000000 RSI: ffffffff8b6cd040 RDI: ffffffff8bd1ad40 RBP: ffffffff81f7c7d8 R08: 0000000000000001 R09: fffffbfff2dc559e R10: ffffffff96e2acf7 R11: 0000000000000000 R12: 0000000000000200 R13: ffff8880301e0f80 R14: 0000000000000cc0 R15: 0000000000000001 FS: 000055555d333500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9a2b2656c0 CR3: 000000002a232000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lockdep_hardirqs_on+0x7c/0x110 kernel/locking/lockdep.c:4468 consume_obj_stock mm/memcontrol.c:2760 [inline] obj_cgroup_charge+0x248/0x4d0 mm/memcontrol.c:2882 __memcg_slab_post_alloc_hook+0x1b6/0x9b0 mm/memcontrol.c:2975 memcg_slab_post_alloc_hook mm/slub.c:2156 [inline] slab_post_alloc_hook mm/slub.c:4095 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x2c6/0x2f0 mm/slub.c:4141 vm_area_dup+0x21/0x2f0 kernel/fork.c:487 dup_mmap kernel/fork.c:696 [inline] dup_mm kernel/fork.c:1674 [inline] copy_mm kernel/fork.c:1723 [inline] copy_process+0x7dbf/0x8cb0 kernel/fork.c:2372 kernel_clone+0xfd/0x960 kernel/fork.c:2784 __do_sys_clone+0xba/0x100 kernel/fork.c:2927 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9a2a574853 Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 RSP: 002b:00007ffc26070d78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9a2a574853 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 000055555d3337d0 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000054392 R14: 00000000000542ec R15: 00007ffc26070f00