[syzbot] [mm?] INFO: task hung in __lru_add_drain_all (2)
14 views
Skip to first unread message
syzbot
May 17, 2024, 6:28:31 PM5/17/24
to ak...@linux-foundation.org, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 1b10b390d945 Merge tag 'efi-next-for-v6.10' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e748cc980000
kernel config: https://syzkaller.appspot.com/x/.config?x=8fb75f90ccfdc0a8
dashboard link: https://syzkaller.appspot.com/bug?extid=5294aa7d73bb0fa85bd0
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a830d644e7f8/disk-1b10b390.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/62c43f86b96f/vmlinux-1b10b390.xz
kernel image: https://storage.googleapis.com/syzbot-assets/41286cbfd37d/bzImage-1b10b390.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5294aa...@syzkaller.appspotmail.com
INFO: task syz-executor.4:5253 blocked for more than 143 seconds.
Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:23840 pid:5253 tgid:5253 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
__lru_add_drain_all+0x69/0x740 mm/swap.c:867
invalidate_bdev+0x9a/0xd0 block/bdev.c:95
ext4_put_super+0x535/0xdd0 fs/ext4/super.c:1361
generic_shutdown_super+0x159/0x3d0 fs/super.c:641
kill_block_super+0x3b/0x90 fs/super.c:1675
ext4_kill_sb+0x6a/0xb0 fs/ext4/super.c:7323
deactivate_locked_super+0xbe/0x1a0 fs/super.c:472
deactivate_super+0xde/0x100 fs/super.c:505
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14e/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x278/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xdc/0x260 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6ccbc7f097
RSP: 002b:00007ffe3c43a6b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6ccbc7f097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3c43a770
RBP: 00007ffe3c43a770 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3c43b830
R13: 00007f6ccbcc9336 R14: 0000000000093374 R15: 0000000000000001
</TASK>
INFO: task syz-executor.1:12673 blocked for more than 143 seconds.
Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:23744 pid:12673 tgid:12673 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
jbd2_log_wait_commit+0x2ef/0x460 fs/jbd2/journal.c:697
ext4_sync_fs+0x694/0x860 fs/ext4/super.c:6338
sync_filesystem+0x1cc/0x290 fs/sync.c:66
ovl_sync_fs+0x142/0x1d0 fs/overlayfs/super.c:232
sync_filesystem+0x1cc/0x290 fs/sync.c:66
generic_shutdown_super+0x7e/0x3d0 fs/super.c:620
kill_anon_super+0x3a/0x60 fs/super.c:1225
deactivate_locked_super+0xbe/0x1a0 fs/super.c:472
deactivate_super+0xde/0x100 fs/super.c:505
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14e/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x278/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xdc/0x260 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f64cc67f097
RSP: 002b:00007fff31ddfad8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f64cc67f097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff31ddfb90
RBP: 00007fff31ddfb90 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff31de0c50
R13: 00007f64cc6c9336 R14: 0000000000092aa7 R15: 0000000000000009
</TASK>
INFO: task syz-executor.2:13585 blocked for more than 144 seconds.
Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:26592 pid:13585 tgid:13584 ppid:10964 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_timeout+0x258/0x2a0 kernel/time/timer.c:2558
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x3de/0x5f0 kernel/sched/completion.c:116
__flush_work+0x5c4/0xb10 kernel/workqueue.c:4218
__lru_add_drain_all+0x52c/0x740 mm/swap.c:912
invalidate_bdev+0x9a/0xd0 block/bdev.c:95
ntfs_loadlog_and_replay+0x239/0x5c0 fs/ntfs3/fsntfs.c:330
ntfs_fill_super+0x1fc9/0x4490 fs/ntfs3/super.c:1284
get_tree_bdev+0x36f/0x610 fs/super.c:1614
vfs_get_tree+0x8f/0x380 fs/super.c:1779
do_new_mount fs/namespace.c:3352 [inline]
path_mount+0x14e6/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount fs/namespace.c:3875 [inline]
__x64_sys_mount+0x297/0x320 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f661167f46a
RSP: 002b:00007f66124c7ef8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f66124c7f80 RCX: 00007f661167f46a
RDX: 0000000020000100 RSI: 00000000200000c0 RDI: 00007f66124c7f40
RBP: 0000000020000100 R08: 00007f66124c7f80 R09: 000000000080c018
R10: 000000000080c018 R11: 0000000000000202 R12: 00000000200000c0
R13: 00007f66124c7f40 R14: 000000000001f234 R15: 0000000020000140
</TASK>
Showing all locks held in the system:
4 locks held by kworker/u8:0/11:
#0: ffff8880162d3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1296/0x1ac0 kernel/workqueue.c:3242
#1: ffffc90000107d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x906/0x1ac0 kernel/workqueue.c:3243
#2: ffffffff8f71a950 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xbb/0xbf0 net/core/net_namespace.c:594
#3: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1b/0x230 drivers/net/wireguard/device.c:414
1 lock held by khungtaskd/31:
#0: ffffffff8dbb1ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8dbb1ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#0: ffffffff8dbb1ae0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6614
3 locks held by kworker/u8:6/955:
#0: ffff88802a04d148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1296/0x1ac0 kernel/workqueue.c:3242
#1: ffffc9000498fd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x906/0x1ac0 kernel/workqueue.c:3243
#2: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4732
2 locks held by getty/4840:
#0: ffff88802adac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc8/0x1490 drivers/tty/n_tty.c:2201
3 locks held by kworker/0:6/5163:
#0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1296/0x1ac0 kernel/workqueue.c:3242
#1: ffffc90003dbfd80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x906/0x1ac0 kernel/workqueue.c:3243
#2: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:276
2 locks held by syz-executor.4/5253:
#0: ffff88805d6480e0 (&type->s_umount_key#52){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805d6480e0 (&type->s_umount_key#52){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805d6480e0 (&type->s_umount_key#52){++++}-{3:3}, at: deactivate_super+0xd6/0x100 fs/super.c:504
#1: ffffffff8dccfb08 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x69/0x740 mm/swap.c:867
2 locks held by syz-executor.3/5663:
#0: ffff88802d0fa0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88802d0fa0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88802d0fa0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: deactivate_super+0xd6/0x100 fs/super.c:504
#1: ffff88802f3220e0 (&type->s_umount_key#52){++++}-{3:3}, at: ovl_sync_fs+0x13a/0x1d0 fs/overlayfs/super.c:231
2 locks held by syz-executor.1/12673:
#0: ffff88805ecbc0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805ecbc0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805ecbc0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: deactivate_super+0xd6/0x100 fs/super.c:504
#1: ffff88802f3220e0 (&type->s_umount_key#52){++++}-{3:3}, at: ovl_sync_fs+0x13a/0x1d0 fs/overlayfs/super.c:231
2 locks held by syz-executor.2/13585:
#0: ffff88805b7460e0 (&type->s_umount_key#95/1){+.+.}-{3:3}, at: alloc_super+0x23d/0xbd0 fs/super.c:343
#1: ffffffff8dccfb08 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x69/0x740 mm/swap.c:867
8 locks held by syz-executor.2/13644:
#0: ffff88802faca420 (sb_writers#9){.+.+}-{0:0}, at: ksys_write+0x12f/0x260 fs/read_write.c:643
#1: ffff8880604e9088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x281/0x500 fs/kernfs/file.c:325
#2: ffff88801f502a58 (kn->active#50){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2a4/0x500 fs/kernfs/file.c:326
#3: ffffffff8ed76688 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd2/0x4b0 drivers/net/netdevsim/bus.c:216
#4: ffff88805f7150e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:990 [inline]
#4: ffff88805f7150e8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1093 [inline]
#4: ffff88805f7150e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa4/0x610 drivers/base/dd.c:1290
#5: ffff88805e51c250 (&devlink->lock_key#14){+.+.}-{3:3}, at: nsim_drv_remove+0x4a/0x1d0 drivers/net/netdevsim/dev.c:1672
#6: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x35/0x2f0 drivers/net/netdevsim/netdev.c:451
#7: ffffffff8f8281a8 (flowtable_lock){+.+.}-{3:3}, at: nf_flow_table_cleanup+0x81/0x3d0 net/netfilter/nf_flow_table_core.c:597
1 lock held by syz-executor.2/13654:
#0: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xe60 net/core/rtnetlink.c:6592
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 31 Comm: khungtaskd Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xf86/0x1240 kernel/hung_task.c:380
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 13554 Comm: syz-executor.0 Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:3762 [inline]
RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3782 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3837 [inline]
RIP: 0010:__lock_acquire+0x1594/0x3b30 kernel/locking/lockdep.c:5137
Code: 48 c1 e8 03 80 3c 28 00 0f 85 bc 18 00 00 48 8b 43 18 49 39 c5 0f 84 a2 f7 ff ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 80 3c 28 00 <0f> 85 90 18 00 00 48 8b 5b 08 48 85 db 75 b7 e8 f8 48 ff ff 48 c7
RSP: 0018:ffffc900034ffac8 EFLAGS: 00000046
RAX: 1ffffffff264bc71 RBX: ffffffff9325e380 RCX: ffffffff816b34fe
RDX: 1ffffffff28398a0 RSI: 0000000000000008 RDI: ffffffff9325e388
RBP: dffffc0000000000 R08: 0000000000000000 R09: fffffbfff2843652
R10: ffffffff9421b297 R11: 0000000000000000 R12: 0000000000019264
R13: e91b78abf4a04936 R14: ffff8880657128e0 R15: 0000000000000004
FS: 00007fa93e22d6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d029000 CR3: 0000000065006000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
__set_current_blocked kernel/signal.c:3099 [inline]
set_current_blocked kernel/signal.c:3085 [inline]
signal_delivered kernel/signal.c:2947 [inline]
signal_setup_done+0x27d/0x570 kernel/signal.c:2959
handle_signal arch/x86/kernel/signal.c:285 [inline]
arch_do_signal_or_restart+0x4bb/0x7e0 arch/x86/kernel/signal.c:312
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x14a/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xdc/0x260 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa93d4a54f0
Code: 83 c0 16 83 e0 f7 74 12 50 48 8d 3d da 9c 04 00 e8 15 78 fa ff 0f 1f 44 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <83> ff 21 74 0b c3 66 2e 0f 1f 84 00 00 00 00 00 55 53 48 89 f3 48
RSP: 002b:00007fa93e22cb38 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007fa93d5abf80 RCX: 00007fa93d47dd69
RDX: 00007fa93e22cb40 RSI: 00007fa93e22cc70 RDI: 0000000000000021
RBP: 00007fa93d4ca49e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fa93d5abf80 R15: 00007ffd26f52418
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1b10b390d945 Merge tag 'efi-next-for-v6.10' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e748cc980000
kernel config: https://syzkaller.appspot.com/x/.config?x=8fb75f90ccfdc0a8
dashboard link: https://syzkaller.appspot.com/bug?extid=5294aa7d73bb0fa85bd0
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a830d644e7f8/disk-1b10b390.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/62c43f86b96f/vmlinux-1b10b390.xz
kernel image: https://storage.googleapis.com/syzbot-assets/41286cbfd37d/bzImage-1b10b390.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5294aa...@syzkaller.appspotmail.com
INFO: task syz-executor.4:5253 blocked for more than 143 seconds.
Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:23840 pid:5253 tgid:5253 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
__lru_add_drain_all+0x69/0x740 mm/swap.c:867
invalidate_bdev+0x9a/0xd0 block/bdev.c:95
ext4_put_super+0x535/0xdd0 fs/ext4/super.c:1361
generic_shutdown_super+0x159/0x3d0 fs/super.c:641
kill_block_super+0x3b/0x90 fs/super.c:1675
ext4_kill_sb+0x6a/0xb0 fs/ext4/super.c:7323
deactivate_locked_super+0xbe/0x1a0 fs/super.c:472
deactivate_super+0xde/0x100 fs/super.c:505
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14e/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x278/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xdc/0x260 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6ccbc7f097
RSP: 002b:00007ffe3c43a6b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f6ccbc7f097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe3c43a770
RBP: 00007ffe3c43a770 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe3c43b830
R13: 00007f6ccbcc9336 R14: 0000000000093374 R15: 0000000000000001
</TASK>
INFO: task syz-executor.1:12673 blocked for more than 143 seconds.
Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.1 state:D stack:23744 pid:12673 tgid:12673 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
jbd2_log_wait_commit+0x2ef/0x460 fs/jbd2/journal.c:697
ext4_sync_fs+0x694/0x860 fs/ext4/super.c:6338
sync_filesystem+0x1cc/0x290 fs/sync.c:66
ovl_sync_fs+0x142/0x1d0 fs/overlayfs/super.c:232
sync_filesystem+0x1cc/0x290 fs/sync.c:66
generic_shutdown_super+0x7e/0x3d0 fs/super.c:620
kill_anon_super+0x3a/0x60 fs/super.c:1225
deactivate_locked_super+0xbe/0x1a0 fs/super.c:472
deactivate_super+0xde/0x100 fs/super.c:505
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14e/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x278/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xdc/0x260 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f64cc67f097
RSP: 002b:00007fff31ddfad8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f64cc67f097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff31ddfb90
RBP: 00007fff31ddfb90 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff31de0c50
R13: 00007f64cc6c9336 R14: 0000000000092aa7 R15: 0000000000000009
</TASK>
INFO: task syz-executor.2:13585 blocked for more than 144 seconds.
Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2 state:D stack:26592 pid:13585 tgid:13584 ppid:10964 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_timeout+0x258/0x2a0 kernel/time/timer.c:2558
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x3de/0x5f0 kernel/sched/completion.c:116
__flush_work+0x5c4/0xb10 kernel/workqueue.c:4218
__lru_add_drain_all+0x52c/0x740 mm/swap.c:912
invalidate_bdev+0x9a/0xd0 block/bdev.c:95
ntfs_loadlog_and_replay+0x239/0x5c0 fs/ntfs3/fsntfs.c:330
ntfs_fill_super+0x1fc9/0x4490 fs/ntfs3/super.c:1284
get_tree_bdev+0x36f/0x610 fs/super.c:1614
vfs_get_tree+0x8f/0x380 fs/super.c:1779
do_new_mount fs/namespace.c:3352 [inline]
path_mount+0x14e6/0x1f20 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount fs/namespace.c:3875 [inline]
__x64_sys_mount+0x297/0x320 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f661167f46a
RSP: 002b:00007f66124c7ef8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f66124c7f80 RCX: 00007f661167f46a
RDX: 0000000020000100 RSI: 00000000200000c0 RDI: 00007f66124c7f40
RBP: 0000000020000100 R08: 00007f66124c7f80 R09: 000000000080c018
R10: 000000000080c018 R11: 0000000000000202 R12: 00000000200000c0
R13: 00007f66124c7f40 R14: 000000000001f234 R15: 0000000020000140
</TASK>
Showing all locks held in the system:
4 locks held by kworker/u8:0/11:
#0: ffff8880162d3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1296/0x1ac0 kernel/workqueue.c:3242
#1: ffffc90000107d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x906/0x1ac0 kernel/workqueue.c:3243
#2: ffffffff8f71a950 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xbb/0xbf0 net/core/net_namespace.c:594
#3: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1b/0x230 drivers/net/wireguard/device.c:414
1 lock held by khungtaskd/31:
#0: ffffffff8dbb1ae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
#0: ffffffff8dbb1ae0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
#0: ffffffff8dbb1ae0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6614
3 locks held by kworker/u8:6/955:
#0: ffff88802a04d148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1296/0x1ac0 kernel/workqueue.c:3242
#1: ffffc9000498fd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x906/0x1ac0 kernel/workqueue.c:3243
#2: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4732
2 locks held by getty/4840:
#0: ffff88802adac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc8/0x1490 drivers/tty/n_tty.c:2201
3 locks held by kworker/0:6/5163:
#0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1296/0x1ac0 kernel/workqueue.c:3242
#1: ffffc90003dbfd80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x906/0x1ac0 kernel/workqueue.c:3243
#2: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:276
2 locks held by syz-executor.4/5253:
#0: ffff88805d6480e0 (&type->s_umount_key#52){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805d6480e0 (&type->s_umount_key#52){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805d6480e0 (&type->s_umount_key#52){++++}-{3:3}, at: deactivate_super+0xd6/0x100 fs/super.c:504
#1: ffffffff8dccfb08 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x69/0x740 mm/swap.c:867
2 locks held by syz-executor.3/5663:
#0: ffff88802d0fa0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88802d0fa0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88802d0fa0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: deactivate_super+0xd6/0x100 fs/super.c:504
#1: ffff88802f3220e0 (&type->s_umount_key#52){++++}-{3:3}, at: ovl_sync_fs+0x13a/0x1d0 fs/overlayfs/super.c:231
2 locks held by syz-executor.1/12673:
#0: ffff88805ecbc0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805ecbc0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805ecbc0e0 (&type->s_umount_key#83){+.+.}-{3:3}, at: deactivate_super+0xd6/0x100 fs/super.c:504
#1: ffff88802f3220e0 (&type->s_umount_key#52){++++}-{3:3}, at: ovl_sync_fs+0x13a/0x1d0 fs/overlayfs/super.c:231
2 locks held by syz-executor.2/13585:
#0: ffff88805b7460e0 (&type->s_umount_key#95/1){+.+.}-{3:3}, at: alloc_super+0x23d/0xbd0 fs/super.c:343
#1: ffffffff8dccfb08 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x69/0x740 mm/swap.c:867
8 locks held by syz-executor.2/13644:
#0: ffff88802faca420 (sb_writers#9){.+.+}-{0:0}, at: ksys_write+0x12f/0x260 fs/read_write.c:643
#1: ffff8880604e9088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x281/0x500 fs/kernfs/file.c:325
#2: ffff88801f502a58 (kn->active#50){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2a4/0x500 fs/kernfs/file.c:326
#3: ffffffff8ed76688 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd2/0x4b0 drivers/net/netdevsim/bus.c:216
#4: ffff88805f7150e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:990 [inline]
#4: ffff88805f7150e8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1093 [inline]
#4: ffff88805f7150e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa4/0x610 drivers/base/dd.c:1290
#5: ffff88805e51c250 (&devlink->lock_key#14){+.+.}-{3:3}, at: nsim_drv_remove+0x4a/0x1d0 drivers/net/netdevsim/dev.c:1672
#6: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x35/0x2f0 drivers/net/netdevsim/netdev.c:451
#7: ffffffff8f8281a8 (flowtable_lock){+.+.}-{3:3}, at: nf_flow_table_cleanup+0x81/0x3d0 net/netfilter/nf_flow_table_core.c:597
1 lock held by syz-executor.2/13654:
#0: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8f72f748 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xe60 net/core/rtnetlink.c:6592
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 31 Comm: khungtaskd Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
watchdog+0xf86/0x1240 kernel/hung_task.c:380
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 13554 Comm: syz-executor.0 Not tainted 6.9.0-syzkaller-02713-g1b10b390d945 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:3762 [inline]
RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3782 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3837 [inline]
RIP: 0010:__lock_acquire+0x1594/0x3b30 kernel/locking/lockdep.c:5137
Code: 48 c1 e8 03 80 3c 28 00 0f 85 bc 18 00 00 48 8b 43 18 49 39 c5 0f 84 a2 f7 ff ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 80 3c 28 00 <0f> 85 90 18 00 00 48 8b 5b 08 48 85 db 75 b7 e8 f8 48 ff ff 48 c7
RSP: 0018:ffffc900034ffac8 EFLAGS: 00000046
RAX: 1ffffffff264bc71 RBX: ffffffff9325e380 RCX: ffffffff816b34fe
RDX: 1ffffffff28398a0 RSI: 0000000000000008 RDI: ffffffff9325e388
RBP: dffffc0000000000 R08: 0000000000000000 R09: fffffbfff2843652
R10: ffffffff9421b297 R11: 0000000000000000 R12: 0000000000019264
R13: e91b78abf4a04936 R14: ffff8880657128e0 R15: 0000000000000004
FS: 00007fa93e22d6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d029000 CR3: 0000000065006000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
_raw_spin_lock_irq+0x36/0x50 kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:376 [inline]
__set_current_blocked kernel/signal.c:3099 [inline]
set_current_blocked kernel/signal.c:3085 [inline]
signal_delivered kernel/signal.c:2947 [inline]
signal_setup_done+0x27d/0x570 kernel/signal.c:2959
handle_signal arch/x86/kernel/signal.c:285 [inline]
arch_do_signal_or_restart+0x4bb/0x7e0 arch/x86/kernel/signal.c:312
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x14a/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xdc/0x260 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa93d4a54f0
Code: 83 c0 16 83 e0 f7 74 12 50 48 8d 3d da 9c 04 00 e8 15 78 fa ff 0f 1f 44 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <83> ff 21 74 0b c3 66 2e 0f 1f 84 00 00 00 00 00 55 53 48 89 f3 48
RSP: 002b:00007fa93e22cb38 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007fa93d5abf80 RCX: 00007fa93d47dd69
RDX: 00007fa93e22cb40 RSI: 00007fa93e22cc70 RDI: 0000000000000021
RBP: 00007fa93d4ca49e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fa93d5abf80 R15: 00007ffd26f52418
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Dec 18, 2024, 1:31:21 AM12/18/24
to ak...@linux-foundation.org, crashf...@gmail.com, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 59dbb9d81adf Merge tag 'xsa465+xsa466-6.13-tag' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=164ff4f8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1234f097ee657d8b
dashboard link: https://syzkaller.appspot.com/bug?extid=5294aa7d73bb0fa85bd0
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1649d7e8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/235f123641b6/disk-59dbb9d8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/739d8d2f0615/vmlinux-59dbb9d8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6cb338ffd7a7/bzImage-59dbb9d8.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/346ce4b8e425/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/ff16fd187e15/mount_1.gz
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/d04047a87b7d/mount_2.gz
mounted in repro #4: https://storage.googleapis.com/syzbot-assets/81c4fcd3a27a/mount_11.gz
mounted in repro #5: https://storage.googleapis.com/syzbot-assets/593b919eb65c/mount_16.gz
mounted in repro #6: https://storage.googleapis.com/syzbot-assets/429aaeb5fd39/mount_21.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5294aa...@syzkaller.appspotmail.com
INFO: task syz-executor:5996 blocked for more than 143 seconds.
Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
__mutex_lock_common kernel/locking/mutex.c:665 [inline]
__mutex_lock+0x7e7/0xee0 kernel/locking/mutex.c:735
__lru_add_drain_all+0x66/0x560 mm/swap.c:798
invalidate_bdev+0x76/0xa0 block/bdev.c:101
generic_shutdown_super+0x139/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1710
xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2089
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
task_work_run+0x24f/0x310 kernel/task_work.c:239
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36baf87057
RSP: 002b:00007ffd594f4c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f36baf87057
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd594f4cf0
RBP: 00007ffd594f4cf0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd594f5d70
R13: 00007f36bb00180c R14: 00007ffd594f5db0 R15: 0000000000000024
</TASK>
INFO: task syz-executor:5997 blocked for more than 146 seconds.
Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
__flush_work+0xa37/0xc50 kernel/workqueue.c:4231
__lru_add_drain_all+0x4f6/0x560 mm/swap.c:843
invalidate_bdev+0x76/0xa0 block/bdev.c:101
generic_shutdown_super+0x139/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1710
xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2089
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
task_work_run+0x24f/0x310 kernel/task_work.c:239
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5877f87057
RSP: 002b:00007ffd3d19dce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5877f87057
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3d19dda0
RBP: 00007ffd3d19dda0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd3d19ee20
R13: 00007f587800180c R14: 00007ffd3d19ee60 R15: 0000000000000023
#0: ffffffff8e937ae0 (rcu_read_lock){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
4 locks held by kworker/u8:2/35:
1 lock held by udevd/5193:
2 locks held by getty/5578:
#0: ffff88803530a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5996:
#0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
#1: ffffffff8e9f9ce8 (lock#3){+.+.}-{4:4}, at: __lru_add_drain_all+0x66/0x560 mm/swap.c:798
2 locks held by syz-executor/5997:
#0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
#1: ffffffff8e9f9ce8 (lock#3){+.+.}-{4:4}, at: __lru_add_drain_all+0x66/0x560 mm/swap.c:798
2 locks held by syz.2.358/10421:
4 locks held by syz.0.359/10425:
2 locks held by syz.5.360/10432:
2 locks held by syz.1.361/10438:
1 lock held by syz.1.361/10439:
4 locks held by rm/10442:
1 lock held by syz.6.362/10444:
2 locks held by syz.6.362/10445:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xff6/0x1040 kernel/hung_task.c:397
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Workqueue: events_unbound macvlan_process_broadcast
RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:409
Code: 30 33 57 fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 b1 10 bb fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c
RSP: 0018:ffffc90000a17f78 EFLAGS: 00000002
RAX: 1ffffffff34d7a00 RBX: ffffffff9a6bd5e0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff85484066 R09: 1ffff1100497a046
R10: dffffc0000000000 R11: ffffffff85484020 R12: dffffc0000000000
R13: ffffffff9a3b7f70 R14: 00000000000003fd R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
serial_in drivers/tty/serial/8250/8250.h:137 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline]
wait_for_lsr drivers/tty/serial/8250/8250_port.c:2088 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3335 [inline]
serial8250_console_write+0x1373/0x1ed0 drivers/tty/serial/8250/8250_port.c:3413
console_emit_next_record kernel/printk/printk.c:3122 [inline]
console_flush_all+0x869/0xeb0 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
lapbeth_xmit+0x1dc/0x260 drivers/net/wan/lapbether.c:225
__netdev_start_xmit include/linux/netdevice.h:5002 [inline]
netdev_start_xmit include/linux/netdevice.h:5011 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606
__dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
x25_link_control+0x626/0xb50
x25_receive_data net/x25/x25_dev.c:43 [inline]
x25_lapb_receive_frame+0x3d0/0x1010 net/x25/x25_dev.c:127
__netif_receive_skb_one_core net/core/dev.c:5672 [inline]
netif_receive_skb_core+0x3f0/0x400 net/core/dev.c:5697
lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:99
__napi_poll+0xcb/0x490 net/core/dev.c:6883
napi_poll net/core/dev.c:6952 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:7074
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
do_softirq+0x11b/0x1e0 kernel/softirq.c:462
</IRQ>
<TASK>
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:389
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx+0x83/0x90 net/core/dev.c:5257
macvlan_broadcast+0x3c4/0x670 drivers/net/macvlan.c:290
macvlan_process_broadcast+0x50e/0x7f0 drivers/net/macvlan.c:338
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 59dbb9d81adf Merge tag 'xsa465+xsa466-6.13-tag' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=164ff4f8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1234f097ee657d8b
dashboard link: https://syzkaller.appspot.com/bug?extid=5294aa7d73bb0fa85bd0
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1649d7e8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/235f123641b6/disk-59dbb9d8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/739d8d2f0615/vmlinux-59dbb9d8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6cb338ffd7a7/bzImage-59dbb9d8.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/346ce4b8e425/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/ff16fd187e15/mount_1.gz
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/d04047a87b7d/mount_2.gz
mounted in repro #4: https://storage.googleapis.com/syzbot-assets/81c4fcd3a27a/mount_11.gz
mounted in repro #5: https://storage.googleapis.com/syzbot-assets/593b919eb65c/mount_16.gz
mounted in repro #6: https://storage.googleapis.com/syzbot-assets/429aaeb5fd39/mount_21.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5294aa...@syzkaller.appspotmail.com
Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:19616 pid:5996 tgid:5996 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
__mutex_lock_common kernel/locking/mutex.c:665 [inline]
__mutex_lock+0x7e7/0xee0 kernel/locking/mutex.c:735
__lru_add_drain_all+0x66/0x560 mm/swap.c:798
invalidate_bdev+0x76/0xa0 block/bdev.c:101
generic_shutdown_super+0x139/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1710
xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2089
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
task_work_run+0x24f/0x310 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36baf87057
RSP: 002b:00007ffd594f4c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f36baf87057
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd594f4cf0
RBP: 00007ffd594f4cf0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd594f5d70
R13: 00007f36bb00180c R14: 00007ffd594f5db0 R15: 0000000000000024
</TASK>
INFO: task syz-executor:5997 blocked for more than 146 seconds.
Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:20024 pid:5997 tgid:5997 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x17fb/0x4be0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
__flush_work+0xa37/0xc50 kernel/workqueue.c:4231
__lru_add_drain_all+0x4f6/0x560 mm/swap.c:843
invalidate_bdev+0x76/0xa0 block/bdev.c:101
generic_shutdown_super+0x139/0x2d0 fs/super.c:642
kill_block_super+0x44/0x90 fs/super.c:1710
xfs_kill_sb+0x15/0x50 fs/xfs/xfs_super.c:2089
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
task_work_run+0x24f/0x310 kernel/task_work.c:239
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5877f87057
RSP: 002b:00007ffd3d19dce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5877f87057
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3d19dda0
RBP: 00007ffd3d19dda0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd3d19ee20
R13: 00007f587800180c R14: 00007ffd3d19ee60 R15: 0000000000000023
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/30:
Showing all locks held in the system:
#0: ffffffff8e937ae0 (rcu_read_lock){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
4 locks held by kworker/u8:2/35:
1 lock held by udevd/5193:
2 locks held by getty/5578:
#0: ffff88803530a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5996:
#0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805fb060e0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
#1: ffffffff8e9f9ce8 (lock#3){+.+.}-{4:4}, at: __lru_add_drain_all+0x66/0x560 mm/swap.c:798
2 locks held by syz-executor/5997:
#0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88805fcb40e0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 fs/super.c:505
#1: ffffffff8e9f9ce8 (lock#3){+.+.}-{4:4}, at: __lru_add_drain_all+0x66/0x560 mm/swap.c:798
2 locks held by syz.2.358/10421:
4 locks held by syz.0.359/10425:
2 locks held by syz.5.360/10432:
2 locks held by syz.1.361/10438:
1 lock held by syz.1.361/10439:
4 locks held by rm/10442:
1 lock held by syz.6.362/10444:
2 locks held by syz.6.362/10445:
=============================================
NMI backtrace for cpu 0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xff6/0x1040 kernel/hung_task.c:397
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 0 to CPUs 1:
lapbether: lapb_data_request error - 4
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Workqueue: events_unbound macvlan_process_broadcast
RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:409
Code: 30 33 57 fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 b1 10 bb fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c
RSP: 0018:ffffc90000a17f78 EFLAGS: 00000002
RAX: 1ffffffff34d7a00 RBX: ffffffff9a6bd5e0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff85484066 R09: 1ffff1100497a046
R10: dffffc0000000000 R11: ffffffff85484020 R12: dffffc0000000000
R13: ffffffff9a3b7f70 R14: 00000000000003fd R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fea64077ff8 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<IRQ>
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
serial_in drivers/tty/serial/8250/8250.h:137 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline]
wait_for_lsr drivers/tty/serial/8250/8250_port.c:2088 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3335 [inline]
serial8250_console_write+0x1373/0x1ed0 drivers/tty/serial/8250/8250_port.c:3413
console_emit_next_record kernel/printk/printk.c:3122 [inline]
console_flush_all+0x869/0xeb0 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
lapbeth_xmit+0x1dc/0x260 drivers/net/wan/lapbether.c:225
__netdev_start_xmit include/linux/netdevice.h:5002 [inline]
netdev_start_xmit include/linux/netdevice.h:5011 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606
__dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
x25_link_control+0x626/0xb50
x25_receive_data net/x25/x25_dev.c:43 [inline]
x25_lapb_receive_frame+0x3d0/0x1010 net/x25/x25_dev.c:127
__netif_receive_skb_one_core net/core/dev.c:5672 [inline]
netif_receive_skb_core+0x3f0/0x400 net/core/dev.c:5697
lapbeth_napi_poll+0x42/0x90 drivers/net/wan/lapbether.c:99
__napi_poll+0xcb/0x490 net/core/dev.c:6883
napi_poll net/core/dev.c:6952 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:7074
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
do_softirq+0x11b/0x1e0 kernel/softirq.c:462
</IRQ>
<TASK>
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:389
local_bh_enable include/linux/bottom_half.h:33 [inline]
netif_rx+0x83/0x90 net/core/dev.c:5257
macvlan_broadcast+0x3c4/0x670 drivers/net/macvlan.c:290
macvlan_process_broadcast+0x50e/0x7f0 drivers/net/macvlan.c:338
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
lapbether: lapb_data_request error - 4
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Jun 29, 2025, 2:01:24 PM6/29/25
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages