Extracting prog: 7m13.957129678s
Minimizing prog: 31m4.775646283s
Simplifying prog options: 0s
Extracting C: 3m15.591594502s
Simplifying C: 24m9.667984767s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x48882, 0x0)
sendfile(r0, r0, 0x0, 0x400000000003f)
r1 = dup(r0)
fallocate(r1, 0x11, 0x8000000, 0x8004000000200)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x48882, 0x0)
sendfile(r0, r0, 0x0, 0x400000000003f)
r1 = dup(r0)
fallocate(r1, 0x11, 0x8000000, 0x8004000000200)
program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x48882, 0x0)
sendfile(r0, r0, 0x0, 0x400000000003f)
r1 = dup(r0)
fallocate(r1, 0x11, 0x8000000, 0x8004000000200)
program crashed: INFO: task hung in page_cache_ra_order
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x48882, 0x0)
sendfile(r0, r0, 0x0, 0x400000000003f)
dup(r0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x48882, 0x0)
sendfile(r0, r0, 0x0, 0x400000000003f)
fallocate(0xffffffffffffffff, 0x11, 0x8000000, 0x8004000000200)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x48882, 0x0)
r1 = dup(r0)
fallocate(r1, 0x11, 0x8000000, 0x8004000000200)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendfile-dup-fallocate
detailed listing:
executing program 0:
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x400000000003f)
r0 = dup(0xffffffffffffffff)
fallocate(r0, 0x11, 0x8000000, 0x8004000000200)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
detailed listing:
executing program 0:
r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x48882, 0x0)
sendfile(r0, r0, 0x0, 0x400000000003f)
r1 = dup(r0)
fallocate(r1, 0x11, 0x8000000, 0x8004000000200)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-sendfile-dup-fallocate
program crashed: INFO: task hung in page_cache_ra_order
reproducing took 1h5m43.99237819s
repro crashed as (corrupted=false):
INFO: task syz-executor349:5843 blocked for more than 143 seconds.
Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor349 state:D stack:23784 pid:5843 tgid:5842 ppid:5841 task_flags:0x440040 flags:0x00000006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x1b33/0x51f0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline]
__down_read_common kernel/locking/rwsem.c:1248 [inline]
__down_read kernel/locking/rwsem.c:1261 [inline]
down_read+0x6ff/0xa50 kernel/locking/rwsem.c:1526
filemap_invalidate_lock_shared include/linux/fs.h:922 [inline]
page_cache_ra_order+0x45e/0xca0 mm/readahead.c:491
filemap_readahead mm/filemap.c:2560 [inline]
filemap_get_pages+0x9ec/0x1fc0 mm/filemap.c:2605
filemap_splice_read+0x690/0xef0 mm/filemap.c:2981
do_splice_read fs/splice.c:979 [inline]
splice_direct_to_actor+0x4af/0xc90 fs/splice.c:1083
do_splice_direct_actor fs/splice.c:1201 [inline]
do_splice_direct+0x281/0x3d0 fs/splice.c:1227
do_sendfile+0x582/0x8c0 fs/read_write.c:1368
__do_sys_sendfile64 fs/read_write.c:1429 [inline]
__se_sys_sendfile64+0x17e/0x1e0 fs/read_write.c:1415
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f544901a369
RSP: 002b:00007f5448fd3228 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f54490a4328 RCX: 00007f544901a369
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: 00007f54490a4320 R08: 00007f5448fd36c0 R09: 00007f5448fd36c0
R10: 000400000000003f R11: 0000000000000246 R12: 00007f54490a432c
R13: 0000200000001000 R14: 6c756e2f7665642f R15: 00007ffd842a20e8
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x30/0x180 kernel/locking/lockdep.c:6764
3 locks held by klogd/5191:
2 locks held by getty/5585:
#0: ffff8880320fc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900036cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x5bb/0x1700 drivers/tty/n_tty.c:2222
1 lock held by syz-executor349/5843:
#0: ffff88802382b740 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:922 [inline]
#0: ffff88802382b740 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_order+0x45e/0xca0 mm/readahead.c:491
3 locks held by syz-executor349/5844:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x4ab/0x4e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0x1058/0x10a0 kernel/hung_task.c:437
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5191 Comm: klogd Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:check_preemption_disabled+0x38/0x120 lib/smp_processor_id.c:-1
Code: 8d 25 3c 41 3d 07 65 49 8b 04 24 48 89 44 24 08 65 8b 1d 3f 41 3d 07 65 8b 05 34 41 3d 07 a9 ff ff ff 7f 74 24 65 49 8b 04 24 <48> 3b 44 24 08 0f 85 cc 00 00 00 89 d8 48 83 c4 10 5b 41 5c 41 5d
RSP: 0018:ffffc90003c6efe0 EFLAGS: 00000202
RAX: 06b5cf09753aaa00 RBX: 0000000000000001 RCX: ffff88805518bc00
RDX: dffffc0000000000 RSI: ffffffff8ca0e160 RDI: ffffffff8ca0e120
RBP: ffffffff816d9bc8 R08: ffffc90003c6f4e0 R09: 0000000000000000
R10: ffffc90003c6f1d0 R11: fffff5200078de3c R12: ffffffff93651020
R13: dffffc0000000000 R14: ffffc90003c6f4f0 R15: ffffffff8ed3df20
FS: 00007ff051823380(0000) GS:ffff8881250cf000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005565d7782600 CR3: 0000000033698000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
rcu_is_watching+0x15/0xb0 kernel/rcu/tree.c:736
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0x4e/0x3e0 kernel/locking/lockdep.c:5877
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock include/linux/rcupdate.h:871 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0x1a9f/0x23b0 arch/x86/kernel/unwind_orc.c:680
arch_stack_walk+0x11e/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x11a/0x1d0 kernel/stacktrace.c:122
save_stack+0xfc/0x1f0 mm/page_owner.c:156
__reset_page_owner+0x76/0x1e0 mm/page_owner.c:308
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_frozen_pages+0xddf/0x10a0 mm/page_alloc.c:2725
discard_slab mm/slub.c:2730 [inline]
__put_partials+0x160/0x1c0 mm/slub.c:3199
put_cpu_partial+0x17e/0x250 mm/slub.c:3274
__slab_free+0x294/0x390 mm/slub.c:4526
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_kmalloc+0x23/0xb0 mm/kasan/common.c:385
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4341 [inline]
__kmalloc_node_track_caller_noprof+0x295/0x4d0 mm/slub.c:4360
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599
__alloc_skb+0x1f2/0x480 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1340 [inline]
alloc_skb_with_frags+0xc3/0x830 net/core/skbuff.c:6639
sock_alloc_send_pskb+0x91c/0xa70 net/core/sock.c:2954
unix_dgram_sendmsg+0x6d4/0x1ea0 net/unix/af_unix.c:2007
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:727
__sys_sendto+0x365/0x4c0 net/socket.c:2180
__do_sys_sendto net/socket.c:2187 [inline]
__se_sys_sendto net/socket.c:2183 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2183
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff0519859b5
Code: 8b 44 24 08 48 83 c4 28 48 98 c3 48 98 c3 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 26 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 7a 48 8b 15 44 c4 0c 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffdddd19418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff0519859b5
RDX: 0000000000000073 RSI: 0000564e23887900 RDI: 0000000000000003
RBP: 0000564e23883910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000013
R13: 00007ff051b13212 R14: 00007ffdddd19518 R15: 0000000000000000
</TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.602 msecs
final repro crashed as (corrupted=false):
INFO: task syz-executor349:5843 blocked for more than 143 seconds.
Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor349 state:D stack:23784 pid:5843 tgid:5842 ppid:5841 task_flags:0x440040 flags:0x00000006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x1b33/0x51f0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline]
__down_read_common kernel/locking/rwsem.c:1248 [inline]
__down_read kernel/locking/rwsem.c:1261 [inline]
down_read+0x6ff/0xa50 kernel/locking/rwsem.c:1526
filemap_invalidate_lock_shared include/linux/fs.h:922 [inline]
page_cache_ra_order+0x45e/0xca0 mm/readahead.c:491
filemap_readahead mm/filemap.c:2560 [inline]
filemap_get_pages+0x9ec/0x1fc0 mm/filemap.c:2605
filemap_splice_read+0x690/0xef0 mm/filemap.c:2981
do_splice_read fs/splice.c:979 [inline]
splice_direct_to_actor+0x4af/0xc90 fs/splice.c:1083
do_splice_direct_actor fs/splice.c:1201 [inline]
do_splice_direct+0x281/0x3d0 fs/splice.c:1227
do_sendfile+0x582/0x8c0 fs/read_write.c:1368
__do_sys_sendfile64 fs/read_write.c:1429 [inline]
__se_sys_sendfile64+0x17e/0x1e0 fs/read_write.c:1415
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f544901a369
RSP: 002b:00007f5448fd3228 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f54490a4328 RCX: 00007f544901a369
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: 00007f54490a4320 R08: 00007f5448fd36c0 R09: 00007f5448fd36c0
R10: 000400000000003f R11: 0000000000000246 R12: 00007f54490a432c
R13: 0000200000001000 R14: 6c756e2f7665642f R15: 00007ffd842a20e8
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x30/0x180 kernel/locking/lockdep.c:6764
3 locks held by klogd/5191:
2 locks held by getty/5585:
#0: ffff8880320fc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900036cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x5bb/0x1700 drivers/tty/n_tty.c:2222
1 lock held by syz-executor349/5843:
#0: ffff88802382b740 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:922 [inline]
#0: ffff88802382b740 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_order+0x45e/0xca0 mm/readahead.c:491
3 locks held by syz-executor349/5844:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x4ab/0x4e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0x1058/0x10a0 kernel/hung_task.c:437
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5191 Comm: klogd Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:check_preemption_disabled+0x38/0x120 lib/smp_processor_id.c:-1
Code: 8d 25 3c 41 3d 07 65 49 8b 04 24 48 89 44 24 08 65 8b 1d 3f 41 3d 07 65 8b 05 34 41 3d 07 a9 ff ff ff 7f 74 24 65 49 8b 04 24 <48> 3b 44 24 08 0f 85 cc 00 00 00 89 d8 48 83 c4 10 5b 41 5c 41 5d
RSP: 0018:ffffc90003c6efe0 EFLAGS: 00000202
RAX: 06b5cf09753aaa00 RBX: 0000000000000001 RCX: ffff88805518bc00
RDX: dffffc0000000000 RSI: ffffffff8ca0e160 RDI: ffffffff8ca0e120
RBP: ffffffff816d9bc8 R08: ffffc90003c6f4e0 R09: 0000000000000000
R10: ffffc90003c6f1d0 R11: fffff5200078de3c R12: ffffffff93651020
R13: dffffc0000000000 R14: ffffc90003c6f4f0 R15: ffffffff8ed3df20
FS: 00007ff051823380(0000) GS:ffff8881250cf000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005565d7782600 CR3: 0000000033698000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
rcu_is_watching+0x15/0xb0 kernel/rcu/tree.c:736
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0x4e/0x3e0 kernel/locking/lockdep.c:5877
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock include/linux/rcupdate.h:871 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0x1a9f/0x23b0 arch/x86/kernel/unwind_orc.c:680
arch_stack_walk+0x11e/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x11a/0x1d0 kernel/stacktrace.c:122
save_stack+0xfc/0x1f0 mm/page_owner.c:156
__reset_page_owner+0x76/0x1e0 mm/page_owner.c:308
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1262 [inline]
__free_frozen_pages+0xddf/0x10a0 mm/page_alloc.c:2725
discard_slab mm/slub.c:2730 [inline]
__put_partials+0x160/0x1c0 mm/slub.c:3199
put_cpu_partial+0x17e/0x250 mm/slub.c:3274
__slab_free+0x294/0x390 mm/slub.c:4526
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_kmalloc+0x23/0xb0 mm/kasan/common.c:385
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4341 [inline]
__kmalloc_node_track_caller_noprof+0x295/0x4d0 mm/slub.c:4360
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599
__alloc_skb+0x1f2/0x480 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1340 [inline]
alloc_skb_with_frags+0xc3/0x830 net/core/skbuff.c:6639
sock_alloc_send_pskb+0x91c/0xa70 net/core/sock.c:2954
unix_dgram_sendmsg+0x6d4/0x1ea0 net/unix/af_unix.c:2007
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:727
__sys_sendto+0x365/0x4c0 net/socket.c:2180
__do_sys_sendto net/socket.c:2187 [inline]
__se_sys_sendto net/socket.c:2183 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2183
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff0519859b5
Code: 8b 44 24 08 48 83 c4 28 48 98 c3 48 98 c3 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 26 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 7a 48 8b 15 44 c4 0c 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffdddd19418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007ff0519859b5
RDX: 0000000000000073 RSI: 0000564e23887900 RDI: 0000000000000003
RBP: 0000564e23883910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000013
R13: 00007ff051b13212 R14: 00007ffdddd19518 R15: 0000000000000000
</TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.602 msecs