INFO: task   !:18088 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:  ! state:D stack:25960 pid:18088 tgid:18087 ppid:15126 task_flags:0x400140 flags:0x08080002 Call Trace: context_switch kernel/sched/core.c:5388 [inline] __schedule+0x10e9/0x6820 kernel/sched/core.c:7189 __schedule_loop kernel/sched/core.c:7268 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7283 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121 __flush_work+0x7c7/0xcb0 kernel/workqueue.c:4354 p9_mux_poll_stop net/9p/trans_fd.c:140 [inline] p9_conn_destroy net/9p/trans_fd.c:804 [inline] p9_fd_close+0x299/0x5a0 net/9p/trans_fd.c:840 p9_client_create+0x678/0xd40 net/9p/client.c:937 v9fs_session_init+0x3c/0xd20 fs/9p/v9fs.c:446 v9fs_get_tree+0xb8/0xb50 fs/9p/vfs_super.c:97 vfs_get_tree+0x92/0x320 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline] do_new_mount_fc fs/namespace.c:3758 [inline] do_new_mount fs/namespace.c:3834 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4154 do_mount fs/namespace.c:4167 [inline] __do_sys_mount fs/namespace.c:4383 [inline] __se_sys_mount fs/namespace.c:4360 [inline] __ia32_sys_mount+0x292/0x310 fs/namespace.c:4360 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xe7/0x950 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f07fcc RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000080000680 RDX: 00000000800006c0 RSI: 0000000000008010 RDI: 0000000080000080 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Showing all locks held in the system: 2 locks held by kworker/3:0/34: #0: ffff88801b8aa940 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc900005cfd08 (p9_poll_work){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 1 lock held by khungtaskd/41: #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e7e52e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 2 locks held by getty/5542: #0: ffff88804bc210a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000019b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211 2 locks held by sshd-session/5699: 2 locks held by syz-executor/5700: 2 locks held by kworker/u32:5/12184: #0: ffff88801b8e4940 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc90003da7d08 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 2 locks held by kworker/u32:13/12187: #0: ffff88801b8e4940 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3277 #1: ffffc90003dd7d08 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3278 2 locks held by syz-executor/16125: 2 locks held by udevd/19241: 1 lock held by syz.0.3637/19256: 2 locks held by syz.9.3638/19259: 1 lock held by syz.7.3639/19261: 2 locks held by modprobe/19283: 2 locks held by modprobe/19285: ============================================= NMI backtrace for cpu 2 CPU: 2 UID: 0 PID: 41 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 2 to CPUs 0-1,3: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 19259 Comm: syz.9.3638 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:100 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:115 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:140 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:172 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:191 [inline] RIP: 0010:kasan_check_range+0x170/0x1e0 mm/kasan/generic.c:200 Code: 48 85 c0 75 9d 48 89 da 4c 89 d8 4c 29 da e9 32 ff ff ff 48 85 d2 74 98 48 01 ea eb 1a 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 83 c0 01 48 39 d0 0f 84 79 ff ff ff 80 38 00 74 ee e9 57 ff ff RSP: 0000:ffffc900036de9b8 EFLAGS: 00000246 RAX: fffff940003bb818 RBX: fffff940003bb819 RCX: ffffffff824bf0e9 RDX: fffff940003bb819 RSI: 0000000000000008 RDI: ffffea0001ddc0c0 RBP: fffff940003bb818 R08: 0000000000000001 R09: fffff940003bb818 R10: ffffea0001ddc0c7 R11: 0000000000000000 R12: ffffea0001ddc0d0 R13: 0000000000000000 R14: ffffea0001ddc0c0 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff88809717d000(0063) knlGS:00000000579b7480 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00007fd2c94037a9 CR3: 000000004a79e000 CR4: 0000000000352ef0 Call Trace: instrument_atomic_write include/linux/instrumented.h:97 [inline] set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline] folio_set_active include/linux/page-flags.h:554 [inline] shrink_folio_list+0x1a49/0x60c0 mm/vmscan.c:1537 evict_folios+0x846/0x20c0 mm/vmscan.c:4854 try_to_shrink_lruvec+0x57c/0xa20 mm/vmscan.c:5009 shrink_one+0x307/0x7f0 mm/vmscan.c:5069 shrink_many mm/vmscan.c:5132 [inline] lru_gen_shrink_node mm/vmscan.c:5210 [inline] shrink_node+0x2673/0x3dc0 mm/vmscan.c:6198 shrink_zones mm/vmscan.c:6454 [inline] do_try_to_free_pages+0x33e/0x16d0 mm/vmscan.c:6516 try_to_free_pages+0x294/0x750 mm/vmscan.c:6755 __perform_reclaim mm/page_alloc.c:4401 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4423 [inline] __alloc_pages_slowpath mm/page_alloc.c:4823 [inline] __alloc_frozen_pages_noprof+0x128f/0x2bc0 mm/page_alloc.c:5239 alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490 alloc_pages_noprof mm/mempolicy.c:2581 [inline] folio_alloc_noprof+0x22/0x250 mm/mempolicy.c:2591 filemap_alloc_folio_noprof.part.0+0x377/0x450 mm/filemap.c:1014 filemap_alloc_folio_noprof+0x5e/0x80 mm/filemap.c:1015 ractl_alloc_folio+0x1d/0x100 mm/readahead.c:189 page_cache_ra_unbounded+0x355/0xa10 mm/readahead.c:277 do_page_cache_ra+0x10c/0x160 mm/readahead.c:334 page_cache_ra_order+0xc2f/0xf10 mm/readahead.c:538 do_sync_mmap_readahead mm/filemap.c:3406 [inline] filemap_fault+0x1900/0x2e90 mm/filemap.c:3555 __do_fault+0x10b/0x440 mm/memory.c:5458 do_shared_fault mm/memory.c:5957 [inline] do_fault+0x2db/0x1750 mm/memory.c:6031 do_pte_missing mm/memory.c:4550 [inline] handle_pte_fault mm/memory.c:6411 [inline] __handle_mm_fault+0x187d/0x2a00 mm/memory.c:6549 handle_mm_fault+0x36d/0xa20 mm/memory.c:6718 do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0023:0xf704df9e Code: 18 01 00 00 ba 08 00 00 00 89 e8 e8 fc a3 fe ff 8b 45 20 8b 4c 24 08 8b 5c 24 0c 83 44 24 14 01 8d 50 f8 83 45 18 08 89 55 20 <89> 48 f8 89 58 fc 83 c6 01 3b 77 04 0f 82 b0 fe ff ff 80 7d 34 00 RSP: 002b:00000000ff94dd10 EFLAGS: 00010202 RAX: 0000000034f13000 RBX: 00000000ffffffff RCX: 000000008249fb0a RDX: 0000000034f12ff8 RSI: 00000000000003ae RDI: 00000000f7405080 RBP: 00000000f7f35610 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:63 Code: 76 95 02 e9 c3 42 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 83 2f 24 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 RSP: 0000:ffffc9000046fdf0 EFLAGS: 00000206 RAX: 0000000003e476d1 RBX: ffff88801c32a500 RCX: ffffffff8b876045 RDX: 0000000000000000 RSI: ffffffff8df1b194 RDI: ffffffff8c1c2480 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10056667b5 R10: ffff88802b333dab R11: 0000000000000000 R12: 0000000000000001 R13: ffffed10038654a0 R14: 0000000000000001 R15: ffffffff90d7c750 FS: 0000000000000000(0000) GS:ffff88809727d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7492054 CR3: 0000000055ddc000 CR4: 0000000000352ef0 Call Trace: arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline] default_idle+0x9/0x10 arch/x86/kernel/process.c:767 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x464/0x590 kernel/sched/idle.c:352 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:451 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x148 NMI backtrace for cpu 3 CPU: 3 UID: 0 PID: 19285 Comm: modprobe Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:clockevents_program_event+0x1e8/0x820 kernel/time/clockevents.c:350 Code: ff 31 ff 41 89 c5 89 c6 e8 25 0d 10 00 45 84 ed 74 5f e8 cb 12 10 00 48 8b 44 24 70 b9 e0 06 00 00 48 89 c2 48 c1 ea 20 0f 30 <31> db e8 b1 12 10 00 48 b8 00 00 00 00 00 fc ff df 49 c7 04 04 00 RSP: 0000:ffffc90003a561f8 EFLAGS: 00000007 RAX: 0000027eb985896d RBX: ffff88802b523f80 RCX: 00000000000006e0 RDX: 000000000000027e RSI: ffffffff81f7d515 RDI: ffff88805b6e4a00 RBP: 000000f529acd112 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 1ffff9200074ac49 R13: 0000000000000001 R14: 0000000000000001 R15: ffff88802b523fc0 FS: 00007f463f0acc80(0000) GS:ffff88809747d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f463f417500 CR3: 000000005a4fe000 CR4: 0000000000352ef0 Call Trace: tick_program_event+0xa9/0x140 kernel/time/tick-oneshot.c:48 hrtimer_rearm_event kernel/time/hrtimer.c:707 [inline] __hrtimer_reprogram kernel/time/hrtimer.c:735 [inline] __hrtimer_reprogram kernel/time/hrtimer.c:710 [inline] hrtimer_reprogram+0x460/0x6c0 kernel/time/hrtimer.c:899 hrtimer_start_range_ns+0x85b/0x1a50 kernel/time/hrtimer.c:1492 hrtimer_start include/linux/hrtimer.h:220 [inline] hrtick_cond_restart kernel/sched/core.c:924 [inline] hrtick_schedule_exit kernel/sched/core.c:986 [inline] finish_lock_switch kernel/sched/core.c:5124 [inline] finish_task_switch.isra.0+0xa3f/0x1010 kernel/sched/core.c:5243 context_switch kernel/sched/core.c:5391 [inline] __schedule+0x10f1/0x6820 kernel/sched/core.c:7189 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7513 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:476 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:547 [inline] irqentry_exit+0x1fe/0x790 kernel/entry/common.c:164 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:get_entry mm/page_ext.c:158 [inline] RIP: 0010:lookup_page_ext+0xc8/0x100 mm/page_ext.c:267 Code: ff 4d 85 e4 74 17 31 ed e8 75 3f 87 ff 48 89 e8 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc e8 60 3f 87 ff 48 0f af 1d 18 4b 9c 18 <48> 01 dd eb d9 e8 4e 3f 87 ff 90 0f 0b 90 eb a7 48 c7 c7 50 2f 1c RSP: 0000:ffffc90003a566d0 EFLAGS: 00000206 RAX: 0000000000000000 RBX: 0000000002422e60 RCX: ffffffff8280a85f RDX: ffff88805b6e4a00 RSI: ffffffff8280a880 RDI: ffff88805b6e4a00 RBP: ffff88803f900000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000005f205aa R14: 0000000000000000 R15: 0000000007d005ab page_ext_iter_begin include/linux/page_ext.h:133 [inline] __update_page_owner_free_handle.isra.0+0xa4/0x4d0 mm/page_owner.c:284 __reset_page_owner+0x93/0x190 mm/page_owner.c:321 reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1402 [inline] free_unref_folios+0xa0d/0x16f0 mm/page_alloc.c:3004 shrink_folio_list+0x2fc5/0x60c0 mm/vmscan.c:1585 evict_folios+0x846/0x20c0 mm/vmscan.c:4854 try_to_shrink_lruvec+0x57c/0xa20 mm/vmscan.c:5009 shrink_one+0x307/0x7f0 mm/vmscan.c:5069 shrink_many mm/vmscan.c:5132 [inline] lru_gen_shrink_node mm/vmscan.c:5210 [inline] shrink_node+0x2673/0x3dc0 mm/vmscan.c:6198 shrink_zones mm/vmscan.c:6454 [inline] do_try_to_free_pages+0x33e/0x16d0 mm/vmscan.c:6516 try_to_free_pages+0x294/0x750 mm/vmscan.c:6755 __perform_reclaim mm/page_alloc.c:4401 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4423 [inline] __alloc_pages_slowpath mm/page_alloc.c:4823 [inline] __alloc_frozen_pages_noprof+0x128f/0x2bc0 mm/page_alloc.c:5239 alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490 folio_alloc_mpol_noprof+0x36/0x260 mm/mempolicy.c:2509 swap_cache_alloc_folio+0x1a8/0x300 mm/swap_state.c:548 swap_cluster_readahead+0x53b/0x770 mm/swap_state.c:745 swapin_readahead+0x160/0x12c0 mm/swap_state.c:901 do_swap_page+0x931/0x6180 mm/memory.c:4875 handle_pte_fault mm/memory.c:6414 [inline] __handle_mm_fault+0x192f/0x2a00 mm/memory.c:6549 handle_mm_fault+0x36d/0xa20 mm/memory.c:6718 do_user_addr_fault+0x5a3/0x12f0 arch/x86/mm/fault.c:1334 handle_page_fault arch/x86/mm/fault.c:1474 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7f463f42ea13 Code: 01 00 00 41 0f b6 44 24 04 89 c7 40 c0 ef 04 0f 84 22 07 00 00 41 0f b6 54 24 05 83 e2 03 83 ea 01 83 fa 01 0f 86 0d 07 00 00 <4d> 3b a5 40 04 00 00 0f 84 90 07 00 00 49 83 ff 12 0f 87 5e 07 00 RSP: 002b:00007ffdab8812f0 EFLAGS: 00010282 RAX: 0000000000000012 RBX: 00007f463f361cc0 RCX: 000000000000000c RDX: 00000000ffffffff RSI: 00007f463f415020 RDI: 0000000000000001 RBP: 00007ffdab881410 R08: 0000000000000000 R09: 00007f463f3cabd2 R10: 00007f463f11af38 R11: 00007f463f4170c0 R12: 00007f463f357bb8 R13: 00007f463f4170c0 R14: 0000009f00000001 R15: 0000000000000001 ---------------- Code disassembly (best guess): 0: 48 85 c0 test %rax,%rax 3: 75 9d jne 0xffffffa2 5: 48 89 da mov %rbx,%rdx 8: 4c 89 d8 mov %r11,%rax b: 4c 29 da sub %r11,%rdx e: e9 32 ff ff ff jmp 0xffffff45 13: 48 85 d2 test %rdx,%rdx 16: 74 98 je 0xffffffb0 18: 48 01 ea add %rbp,%rdx 1b: eb 1a jmp 0x37 1d: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 24: 00 00 00 00 28: 66 90 xchg %ax,%ax * 2a: 48 83 c0 01 add $0x1,%rax <-- trapping instruction 2e: 48 39 d0 cmp %rdx,%rax 31: 0f 84 79 ff ff ff je 0xffffffb0 37: 80 38 00 cmpb $0x0,(%rax) 3a: 74 ee je 0x2a 3c: e9 .byte 0xe9 3d: 57 push %rdi 3e: ff (bad) 3f: ff .byte 0xff