syzbot
possible deadlock in throtl_pending_timer_fn (3)
Status:
upstream: reported on 2026/09/17 06:14
Reported-by: syzbot+57d4f59c9de7e9f54572@syzkaller.appspotmail.com
First crash: 35d, last: 1d06h
Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.5.2434/13643 is trying to acquire lock:
ffff888143f900d0 (&q->queue_lock){..-.}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
ffff888143f900d0 (&q->queue_lock){..-.}-{2:2}, at: throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
but task is already holding lock:
ffffc900001e0bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 ((&sq->pending_timer)){+.-.}-{0:0}:
__timer_delete_sync+0xe1/0x2e0 kernel/time/timer.c:1556
del_timer_sync include/linux/timer.h:200 [inline]
throtl_pd_free+0x15/0x40 block/blk-throttle.c:493
blkcg_deactivate_policy+0x35c/0x5c0 block/blk-cgroup.c:1530
blk_throtl_exit+0xa6/0x140 block/blk-throttle.c:2415
blkcg_init_disk+0x37b/0x3f0 block/blk-cgroup.c:1307
__alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
__blk_mq_alloc_disk+0x11e/0x1e0 block/blk-mq.c:4211
null_add_dev+0x10f9/0x1800 drivers/block/null_blk/main.c:2122
nullb_device_power_store+0x23d/0x380 drivers/block/null_blk/main.c:474
flush_write_buffer fs/configfs/file.c:207 [inline]
configfs_write_iter+0x30b/0x400 fs/configfs/file.c:229
call_write_iter include/linux/fs.h:2271 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x482/0x9a0 fs/read_write.c:584
ksys_write+0x14d/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
-> #1 (&blkcg->lock){....}-{2:2}:
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
blkg_create+0xbe9/0x1390 block/blk-cgroup.c:322
blkcg_init_disk+0x28c/0x3f0 block/blk-cgroup.c:1283
__alloc_disk_node+0x2b3/0x570 block/genhd.c:1432
__blk_alloc_disk+0x2c/0x80 block/genhd.c:1471
brd_alloc+0x377/0x760 drivers/block/brd.c:424
brd_init+0x125/0x1a5 drivers/block/brd.c:529
do_one_initcall+0x257/0x800 init/main.c:1271
do_initcall_level+0x13d/0x1ed init/main.c:1344
do_initcalls+0x4b/0x8a init/main.c:1360
kernel_init_freeable+0x401/0x5ab init/main.c:1599
kernel_init+0x19/0x1b0 init/main.c:1487
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #0 (&q->queue_lock){..-.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3162 [inline]
check_prevs_add kernel/locking/lockdep.c:3281 [inline]
validate_chain kernel/locking/lockdep.c:3897 [inline]
__lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171
lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
preempt_schedule_irq+0xb6/0x160 kernel/sched/core.c:6875
irqentry_exit+0x63/0x70 kernel/entry/common.c:442
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:696
lock_acquire+0x226/0x4a0 kernel/locking/lockdep.c:5794
rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
rcu_read_lock include/linux/rcupdate.h:791 [inline]
is_bpf_text_address+0x43/0x2a0 kernel/bpf/core.c:736
kernel_text_address+0x9c/0xd0 kernel/extable.c:125
__kernel_text_address+0x9/0x30 kernel/extable.c:79
unwind_get_return_address+0x49/0x80 arch/x86/kernel/unwind_orc.c:323
arch_stack_walk+0xf2/0x140 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
__kasan_slab_alloc+0x6b/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
slab_alloc_node mm/slub.c:3359 [inline]
kmem_cache_alloc_node+0x1ad/0x310 mm/slub.c:3404
alloc_io_context+0x27/0x290 block/blk-ioc.c:237
__copy_io+0xa7/0x1b0 block/blk-ioc.c:311
copy_io include/linux/iocontext.h:126 [inline]
copy_process+0x19f7/0x4070 kernel/fork.c:2364
kernel_clone+0x24b/0x900 kernel/fork.c:2765
__do_sys_clone3 kernel/fork.c:3064 [inline]
__se_sys_clone3+0x32d/0x3f0 kernel/fork.c:3048
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
other info that might help us debug this:
Chain exists of:
&q->queue_lock --> &blkcg->lock
--> (&sq->pending_timer)
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((&sq->pending_timer));
lock(&blkcg->lock);
lock((&sq->pending_timer));
lock(&q->queue_lock);
*** DEADLOCK ***
2 locks held by syz.5.2434/13643:
#0: ffffffff8d92d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8d92d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8d92d8a0 (rcu_read_lock){....}-{1:2}, at: is_bpf_text_address+0x22/0x2a0 kernel/bpf/core.c:736
#1: ffffc900001e0bc0 ((&sq->pending_timer)){+.-.}-{0:0}, at: call_timer_fn+0xcf/0x670 kernel/time/timer.c:1698
stack backtrace:
CPU: 1 PID: 13643 Comm: syz.5.2434 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
check_noncircular+0x2f8/0x400 kernel/locking/lockdep.c:2215
check_prev_add kernel/locking/lockdep.c:3162 [inline]
check_prevs_add kernel/locking/lockdep.c:3281 [inline]
validate_chain kernel/locking/lockdep.c:3897 [inline]
__lock_acquire+0x3a03/0x7ea0 kernel/locking/lockdep.c:5171
lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
throtl_pending_timer_fn+0x10e/0x1dd0 block/blk-throttle.c:1200
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_schedule_irq+0xb6/0x160 kernel/sched/core.c:6875
Code: 00 00 43 c6 44 37 04 f8 74 0b 0f 0b 48 f7 03 08 00 00 00 74 7f bf 01 00 00 00 e8 65 30 1c f7 e8 e0 21 4c f7 fb bf 01 00 00 00 <e8> 25 ba ff ff 43 c6 44 37 08 00 48 c7 44 24 40 00 00 00 00 9c 8f
RSP: 0000:ffffc900037071c0 EFLAGS: 00000282
RAX: 9c5e2edc58757c00 RBX: 0000000000000000 RCX: 9c5e2edc58757c00
RDX: dffffc0000000000 RSI: ffffffff8a8c19a0 RDI: 0000000000000001
RBP: ffffc90003707260 R08: ffffffff8f00d22f R09: 1ffffffff1e01a45
R10: dffffc0000000000 R11: fffffbfff1e01a46 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920006e0e38
irqentry_exit+0x63/0x70 kernel/entry/common.c:442
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:696
RIP: 0010:lock_acquire+0x226/0x4a0 kernel/locking/lockdep.c:5794
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 ef 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25
RSP: 0000:ffffc90003707320 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 9c5e2edc58757c00
RDX: 0000000000000000 RSI: ffffffff8a8c2b20 RDI: ffffffff8adf7160
RBP: ffffc90003707438 R08: dffffc0000000000 R09: 1ffffffff2326848
R10: dffffc0000000000 R11: fffffbfff2326849 R12: 1ffff920006e0e70
R13: 0000000000000001 R14: 0000000000000246 R15: dffffc0000000000
rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
rcu_read_lock include/linux/rcupdate.h:791 [inline]
is_bpf_text_address+0x43/0x2a0 kernel/bpf/core.c:736
kernel_text_address+0x9c/0xd0 kernel/extable.c:125
__kernel_text_address+0x9/0x30 kernel/extable.c:79
unwind_get_return_address+0x49/0x80 arch/x86/kernel/unwind_orc.c:323
arch_stack_walk+0xf2/0x140 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
__kasan_slab_alloc+0x6b/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
slab_alloc_node mm/slub.c:3359 [inline]
kmem_cache_alloc_node+0x1ad/0x310 mm/slub.c:3404
alloc_io_context+0x27/0x290 block/blk-ioc.c:237
__copy_io+0xa7/0x1b0 block/blk-ioc.c:311
copy_io include/linux/iocontext.h:126 [inline]
copy_process+0x19f7/0x4070 kernel/fork.c:2364
kernel_clone+0x24b/0x900 kernel/fork.c:2765
__do_sys_clone3 kernel/fork.c:3064 [inline]
__se_sys_clone3+0x32d/0x3f0 kernel/fork.c:3048
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9f9b7a0349
Code: 90 b8 01 00 00 00 b9 01 00 00 00 eb ec 0f 1f 40 00 b8 ea ff ff ff 48 85 ff 74 28 48 85 d2 74 23 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 14 74 01 c3 31 ed 4c 89 c7 ff d2 48 89 c7 b8 3c 00 00
RSP: 002b:00007ffd89ac0338 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f9f9b75b8e0 RCX: 00007f9f9b7a0349
RDX: 00007f9f9b75b8e0 RSI: 0000000000000058 RDI: 00007ffd89ac0390
RBP: 00007f9f9c5ff6c0 R08: 00007f9f9c5ff6c0 R09: 00007ffd89ac0477
R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8
R13: 000000000000006e R14: 00007ffd89ac0390 R15: 00007ffd89ac0478
</TASK>
virtqueue callback for ffff8880254fac00 (ffffffff858ab7a0)
wireguard: wg2: Handshake for peer 11 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 2)
wireguard: wg1: Handshake for peer 10 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 3)
net_ratelimit: 48 callbacks suppressed
wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 31 (127.0.0.1:20002)
wireguard: wg0: Sending keepalive packet to peer 37 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 43 ([::1]:20002/0%0)
No more buffers in queue
Receiving skb proto 0x0800 len 52 type 0
Receiving skb proto 0x0800 len 52 type 0
Receiving skb proto 0x0800 len 52 type 0
Receiving skb proto 0x0806 len 28 type 1
Receiving skb proto 0x0800 len 52 type 0
No more buffers in queue
tcp_conntracks:
syn=0 ack=1 fin=1 rst=0 old=3 new=4
tcp_conntracks:
syn=0 ack=1 fin=1 rst=0 old=4 new=6
tcp_conntracks:
syn=0 ack=1 fin=1 rst=0 old=6 new=6
nf_conntrack: normal packet for ffff888020e48480
tcp_conntracks:
syn=0 ack=1 fin=0 rst=0 old=6 new=7
No more buffers in queue
eth0: xmit ffff888078324140 42:01:0a:80:00:01
Added buffer head 12 to ffff888145a72000
virtqueue callback for ffff888145a72000 (ffffffff858ab890)
Sent skb ffff888078324140
No more buffers in queue
eth0: xmit ffff888078324c80 42:01:0a:80:00:01
Added buffer head 12 to ffff888145a72000
virtqueue callback for ffff888145a72000 (ffffffff858ab890)
tcp_conntracks:
syn=0 ack=1 fin=1 rst=0 old=7 new=7
wireguard: wg1: Handshake for peer 9 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 7)
Sent skb ffff888078324c80
No more buffers in queue
No more buffers in queue
wireguard: wg2: Receiving keepalive packet from peer 6 (127.0.0.1:20002)
virtqueue callback for ffff888145a72000 (ffffffff858ab890)
Sent skb ffff88801df29140
No more buffers in queue
virtqueue callback for ffff888145a72000 (ffffffff858ab890)
Sent skb ffff888025958140
No more buffers in queue
percpu_ref_switch_to_atomic_rcu: global 9223372036854775809 percpu 0
percpu_ref_switch_to_atomic_rcu: global 9223372036854775809 percpu 1
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281d1f20 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281d22e0 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281d2a60 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d26a0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d2e20 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281d31e0 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281fe9a0 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff888027632120 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281fed60 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254fac00 (ffffffff858ab7a0)
No more buffers in queue
Receiving skb proto 0x0806 len 28 type 1
No more buffers in queue
No more buffers in queue
eth0: xmit ffff88805d97b280 42:01:0a:80:00:01
Added buffer head 12 to ffff888145a72000
virtqueue callback for ffff888145a72000 (ffffffff858ab890)
Sent skb ffff88805d97b280
No more buffers in queue
net_ratelimit: 59 callbacks suppressed
wireguard: wg0: Sending keepalive packet to peer 37 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 31 (127.0.0.1:20002)
wireguard: wg1: Receiving keepalive packet from peer 39 ([::1]:20001/0%0)
wireguard: wg1: Receiving keepalive packet from peer 33 (127.0.0.1:20001)
wireguard: wg0: Sending keepalive packet to peer 43 ([::1]:20002/0%0)
wireguard: wg1: Receiving keepalive packet from peer 45 ([::1]:20001/0%0)
wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0)
wireguard: wg1: Handshake for peer 10 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 4)
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281d4860 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d40e0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d4c20 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d35a0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d3960 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d3d20 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d44a0 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff8880281d4fe0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281ff120 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff888028200120 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281ff8a0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281d53a0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281ffc60 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880281ff4e0 response 0 status 0x0 sense_len 0
No more buffers in queue
virtqueue callback for ffff8880254de600 (ffffffff85445db0)
sd 0:0:1:0: cmd ffff888028201020 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880282022e0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff888028200c60 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880282008a0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880282013e0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff888028201f20 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880282026a0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff888028201b60 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880282004e0 response 0 status 0x0 sense_len 0
sd 0:0:1:0: cmd ffff8880282017a0 response 0 status 0x0 sense_len 0
No more buffers in queue
wireguard: wg0: Handshake for peer 7 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2)
wireguard: wg0: Handshake for peer 8 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2)
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 43 c6 44 37 04 f8 movb $0xf8,0x4(%r15,%r14,1)
8: 74 0b je 0x15
a: 0f 0b ud2
c: 48 f7 03 08 00 00 00 testq $0x8,(%rbx)
13: 74 7f je 0x94
15: bf 01 00 00 00 mov $0x1,%edi
1a: e8 65 30 1c f7 call 0xf71c3084
1f: e8 e0 21 4c f7 call 0xf74c2204
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 25 ba ff ff call 0xffffba54 <-- trapping instruction
2f: 43 c6 44 37 08 00 movb $0x0,0x8(%r15,%r14,1)
35: 48 c7 44 24 40 00 00 movq $0x0,0x40(%rsp)
3c: 00 00
3e: 9c pushf
3f: 8f .byte 0x8f
Struck through repros no longer work on HEAD.