From: syzbot <syzbot+39a2135de1558208d3b3@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
varun.singh10011@gmail.com
Subject: Re: [syzbot] [serial?] KASAN: slab-use-after-free Read in check_tty_count
Date: Sun, 01 Nov 2026 07:15:01 -0800 [thread overview]
Message-ID: <6ae75775.6552420f.2a0efc.0058.GAE@google.com> (raw)
In-Reply-To: <CAD8CXUkW04biA+gmiBbKRCn7FsXqyQUse1orNKytFn09QBG1bg@mail.gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in gserial_free_port
INFO: task syz-executor106:10885 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:27992 pid:10885 tgid:10880 ppid:10849 task_flags:0x400040 flags:0x00080802
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
gserial_free_port+0x1fd/0x2e0 drivers/usb/gadget/function/u_serial.c:1292
gserial_free_line+0x107/0x1e0 drivers/usb/gadget/function/u_serial.c:1312
acm_free_instance+0x3b/0x60 drivers/usb/gadget/function/f_acm.c:875
usb_put_function_instance+0x97/0xc0 drivers/usb/gadget/functions.c:77
config_item_cleanup+0x146/0x240 fs/configfs/item.c:128
config_item_release fs/configfs/item.c:137 [inline]
kref_put include/linux/kref.h:65 [inline]
config_item_put fs/configfs/item.c:149 [inline]
config_item_put+0x93/0xb0 fs/configfs/item.c:146
configfs_rmdir+0x5e3/0x950 fs/configfs/dir.c:1580
vfs_rmdir fs/namei.c:5533 [inline]
vfs_rmdir+0x328/0x8e0 fs/namei.c:5506
filename_rmdir+0x31a/0x610 fs/namei.c:5590
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
</TASK>
INFO: task syz-executor106:10886 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28664 pid:10886 tgid:10883 ppid:10854 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 34203a6b63617473 R09: 34203a6b63617473
R10: 34203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
</TASK>
INFO: task syz.1.1632:10888 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1632 state:D stack:28728 pid:10888 tgid:10887 ppid:6233 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_create+0x1c0/0x400 fs/namei.c:5108
filename_mkdirat+0xb9/0x630 fs/namei.c:5454
__do_sys_mkdirat fs/namei.c:5482 [inline]
__se_sys_mkdirat fs/namei.c:5479 [inline]
__x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f100bb9e0d9
RSP: 002b:00007f100c9c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f100be25fa0 RCX: 00007f100bb9e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007f100bc35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f100be26038 R14: 00007f100be25fa0 R15: 00007fff66dc0bb8
</TASK>
INFO: task syz.1.1632:10899 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1632 state:D stack:28728 pid:10899 tgid:10887 ppid:6233 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f100bb9e0d9
RSP: 002b:00007f100c9a0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f100be26090 RCX: 00007f100bb9e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f100bc35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f100be26128 R14: 00007f100be26090 R15: 00007fff66dc0bb8
</TASK>
INFO: task syz.2.1633:10891 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1633 state:D stack:28664 pid:10891 tgid:10889 ppid:6240 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_create+0x1c0/0x400 fs/namei.c:5108
filename_mkdirat+0xb9/0x630 fs/namei.c:5454
__do_sys_mkdirat fs/namei.c:5482 [inline]
__se_sys_mkdirat fs/namei.c:5479 [inline]
__x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa118b9e0d9
RSP: 002b:00007fa119b30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fa118e25fa0 RCX: 00007fa118b9e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007fa118c35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa118e26038 R14: 00007fa118e25fa0 R15: 00007ffe9a94aa68
</TASK>
INFO: task syz.2.1633:10900 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1633 state:D stack:28728 pid:10900 tgid:10889 ppid:6240 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa118b9e0d9
RSP: 002b:00007fa119b0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007fa118e26090 RCX: 00007fa118b9e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007fa118c35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa118e26128 R14: 00007fa118e26090 R15: 00007ffe9a94aa68
</TASK>
INFO: task syz.0.1635:10894 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1635 state:D stack:26744 pid:10894 tgid:10890 ppid:6231 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f009799e0d9
RSP: 002b:00007f00988e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f0097c25fa0 RCX: 00007f009799e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f0097a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0097c26038 R14: 00007f0097c25fa0 R15: 00007ffce222f5b8
</TASK>
INFO: task syz.3.1634:10893 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1634 state:D stack:28728 pid:10893 tgid:10892 ppid:6243 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_create+0x1c0/0x400 fs/namei.c:5108
filename_mkdirat+0xb9/0x630 fs/namei.c:5454
__do_sys_mkdirat fs/namei.c:5482 [inline]
__se_sys_mkdirat fs/namei.c:5479 [inline]
__x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f647799e0d9
RSP: 002b:00007f647883f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f6477c25fa0 RCX: 00007f647799e0d9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007f6477a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6477c26038 R14: 00007f6477c25fa0 R15: 00007fff36631a88
</TASK>
INFO: task syz.3.1634:10901 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1634 state:D stack:28728 pid:10901 tgid:10892 ppid:6243 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f647799e0d9
RSP: 002b:00007f647881e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f6477c26090 RCX: 00007f647799e0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f6477a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6477c26128 R14: 00007f6477c26090 R15: 00007fff36631a88
</TASK>
INFO: task syz-executor106:10897 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10897 tgid:10895 ppid:10852 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_create+0x1c0/0x400 fs/namei.c:5108
filename_mkdirat+0xb9/0x630 fs/namei.c:5454
__do_sys_mkdirat fs/namei.c:5482 [inline]
__se_sys_mkdirat fs/namei.c:5479 [inline]
__x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197d0f1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f5197deab28 RCX: 00007f5197d3a0b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f5197deab20 R08: 36203a6b63617473 R09: 36203a6b63617473
R10: 36203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
</TASK>
INFO: task syz-executor106:10902 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10902 tgid:10895 ppid:10852 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 37203a6b63617473 R09: 37203a6b63617473
R10: 37203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
</TASK>
INFO: task syz-executor106:10898 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10898 tgid:10896 ppid:10853 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_create+0x1c0/0x400 fs/namei.c:5108
filename_mkdirat+0xb9/0x630 fs/namei.c:5454
__do_sys_mkdirat fs/namei.c:5482 [inline]
__se_sys_mkdirat fs/namei.c:5479 [inline]
__x64_sys_mkdirat+0x89/0xc0 fs/namei.c:5479
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197d0f1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f5197deab28 RCX: 00007f5197d3a0b9
RDX: 00000000000001ff RSI: 0000200000000200 RDI: 00000000ffffff9c
RBP: 00007f5197deab20 R08: 36203a6b63617473 R09: 36203a6b63617473
R10: 36203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
</TASK>
INFO: task syz-executor106:10903 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor106 state:D stack:28728 pid:10903 tgid:10896 ppid:10853 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5583 [inline]
__schedule+0x125e/0x6990 kernel/sched/core.c:7382
__schedule_loop kernel/sched/core.c:7459 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7474
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
__down_write_common kernel/locking/rwsem.c:1347 [inline]
__down_write kernel/locking/rwsem.c:1356 [inline]
down_write_nested+0x1c6/0x1f0 kernel/locking/rwsem.c:1758
inode_lock_nested include/linux/fs.h:1071 [inline]
__start_dirop fs/namei.c:2924 [inline]
start_dirop fs/namei.c:2948 [inline]
filename_rmdir+0x258/0x610 fs/namei.c:5583
__do_sys_rmdir fs/namei.c:5613 [inline]
__se_sys_rmdir fs/namei.c:5610 [inline]
__x64_sys_rmdir+0x46/0x70 fs/namei.c:5610
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5197d3a0b9
RSP: 002b:00007f5197cee1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f5197deab38 RCX: 00007f5197d3a0b9
RDX: 00007f5197d3a0b9 RSI: 0000000000000000 RDI: 0000200000000100
RBP: 00007f5197deab30 R08: 37203a6b63617473 R09: 37203a6b63617473
R10: 37203a6b63617473 R11: 0000000000000246 R12: 00007f5197db7720
R13: 0000200000000100 R14: 0000200000000800 R15: 74742f7665642f2e
</TASK>
Showing all locks held in the system:
locks held by pr/ttyS0/44: 2, last CPU#2:
#0: ffffffff8efd74d8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline]
#0: ffffffff8efd74d8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline]
#0: ffffffff8efd74d8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291
#1: ffffffff9becc958 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline]
#1: ffffffff9becc958 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x64/0xc0 drivers/tty/serial/8250/8250_core.c:413
locks held by khungtaskd/45: 1, last CPU#1:
#0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8efeb2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by syslogd/5114: 2, last CPU#3:
#0: ffff888026059f78 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x298/0xd40 net/unix/af_unix.c:2591
#1: ffff888026059a98 (rlock-AF_UNIX){+.+.}-{3:3}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
#1: ffff888026059a98 (rlock-AF_UNIX){+.+.}-{3:3}, at: __schedule+0x2b79/0x6990 kernel/sched/core.c:7376
locks held by getty/5531: 2, on CPU#2:
#0: ffff88802922d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000337b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 drivers/tty/n_tty.c:2211
locks held by syz-executor106/10885: 3, on CPU#0:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
#2: ffff88802941f800 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1026 [inline]
#2: ffff88802941f800 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_rmdir fs/namei.c:5518 [inline]
#2: ffff88802941f800 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_rmdir+0xed/0x8e0 fs/namei.c:5506
locks held by syz-executor106/10886: 2, on CPU#1:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.1.1632/10888: 2, on CPU#0:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.1.1632/10899: 2, on CPU#3:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.2.1633/10891: 2, on CPU#0:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.2.1633/10900: 2, on CPU#0:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.0.1635/10894: 2, on CPU#1:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz.3.1634/10893: 2, on CPU#3:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz.3.1634/10901: 2, on CPU#3:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor106/10897: 2, on CPU#2:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor106/10902: 2, on CPU#0:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
locks held by syz-executor106/10898: 2, on CPU#1:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 fs/namei.c:5101
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 fs/namei.c:5108
locks held by syz-executor106/10903: 2, on CPU#3:
#0: ffff8880241a2478 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x610 fs/namei.c:5579
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1071 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2924 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2948 [inline]
#1: ffff88803ff0bf00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x610 fs/namei.c:5583
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 45 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline]
watchdog+0xd0f/0x10c0 kernel/hung_task.c:598
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0,2-3:
NMI backtrace for cpu 2
CPU: 2 UID: 0 PID: 44 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:432
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d e9 96 f6 23 06 e8 e1 2d c6 fc eb a0 e8 6a 2e c6
RSP: 0018:ffffc900007cf9d8 EFLAGS: 00000002
RAX: 0000000000000039 RBX: 00000000000003f8 RCX: 0000000000000000
RDX: 00000000000003f8 RSI: ffffffff85c04215 RDI: ffffffff9becc980
RBP: ffffffff9becc940 R08: 000000000000001f R09: 0000000000000000
R10: 0000000000000003 R11: 6f4e202020202020 R12: 0000000000000000
R13: 0000000000000039 R14: 0000000000000009 R15: ffffc900007cfda8
FS: 0000000000000000(0000) GS:ffff8880d58fc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ba56071168 CR3: 000000000ed96000 CR4: 0000000000352ef0
Call Trace:
<TASK>
serial_port_out include/linux/serial_core.h:817 [inline]
serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3311 [inline]
__serial8250_console_fifo_write+0xd6/0x290 drivers/tty/serial/8250/8250_port.c:3383
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline]
__serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline]
serial8250_console_write+0x1108/0x14f0 drivers/tty/serial/8250/8250_port.c:3520
nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070
nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157
nbcon_kthread_func+0x5ef/0x7f0 kernel/printk/nbcon.c:1271
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 77 a5 02 e9 43 61 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 cd 2a 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff8ec07cf0 EFLAGS: 00000202
RAX: 0000000000542de9 RBX: ffffffff8ec91540 RCX: ffffffff8be0f325
RDX: 0000000000000001 RSI: ffffffff8e599301 RDI: ffffffff8c832080
RBP: fffffbfff1d922a8 R08: 0000000000000001 R09: ffffed100d446825
R10: ffff88806a23412b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffffffff1d80fa2 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880d56fc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ba40e20660 CR3: 000000000ed96000 CR4: 0000000000352ef0
Call Trace:
<TASK>
arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
default_idle+0x9/0x10 arch/x86/kernel/process.c:768
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
rest_init+0x2d3/0x2e0 init/main.c:789
start_kernel+0x48e/0x490 init/main.c:1247
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x158
</TASK>
NMI backtrace for cpu 3
CPU: 3 UID: 0 PID: 5121 Comm: klogd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__sanitizer_cov_trace_pc+0x6b/0x70 kernel/kcov.c:241
Code: 82 18 17 00 00 83 f8 02 75 20 48 8b 8a 20 17 00 00 8b 92 1c 17 00 00 48 8b 01 48 83 c0 01 48 39 d0 73 07 48 89 01 48 89 34 c1 <c3> cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
RSP: 0018:ffffc900035ffad0 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff920006bff5d RCX: 0000000000000000
RDX: ffff8880284b8000 RSI: ffffffff84ea2310 RDI: 0000000000000005
RBP: 0000000000000019 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000004
R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000004e
FS: 00007fb3ca47cc80(0000) GS:ffff8880d59fc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2b7092b708 CR3: 00000000378d6000 CR4: 0000000000352ef0
Call Trace:
<TASK>
avc_audit_required security/selinux/include/avc.h:94 [inline]
avc_audit security/selinux/include/avc.h:129 [inline]
avc_has_perm+0x100/0x1e0 security/selinux/avc.c:1205
sock_has_perm+0x24d/0x320 security/selinux/hooks.c:5061
selinux_socket_sendmsg+0x8f/0x2f0 security/selinux/hooks.c:5409
security_socket_sendmsg+0xfb/0x230 security/security.c:4391
__sock_sendmsg net/socket.c:815 [inline]
__sys_sendto+0x278/0x4e0 net/socket.c:2283
__do_sys_sendto net/socket.c:2290 [inline]
__se_sys_sendto net/socket.c:2286 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2286
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb3ca5cc407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffcd43b78c0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fb3ca47cc80 RCX: 00007fb3ca5cc407
RDX: 00000000000000a0 RSI: 00007ffcd43b7a00 RDI: 0000000000000003
RBP: 00007ffcd43b7e30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffcd43b7e48
R13: 00007ffcd43b7a00 R14: 0000000000000085 R15: 00007ffcd43b7a00
</TASK>
Tested on:
commit: cbbddb6b Merge tag 'power-utilities-2026.10.31' of git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d3b935580000
kernel config: https://syzkaller.appspot.com/x/.config?x=245a52f53bb4b06b
dashboard link: https://syzkaller.appspot.com/bug?extid=39a2135de1558208d3b3
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=1256b5e1580000
next parent reply other threads:[~2026-11-01 15:15 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAD8CXUkW04biA+gmiBbKRCn7FsXqyQUse1orNKytFn09QBG1bg@mail.gmail.com>
2026-11-01 15:15 ` syzbot [this message]
[not found] <CAD8CXU=YL+6KG+ny7DfRKqAEqBp0Qeu2y8Ej97+bB+xM1JcksQ@mail.gmail.com>
2026-11-01 17:23 ` syzbot
[not found] <CAD8CXU=ceJ1wD00HKsdhRE5yzOxGiOQiUBso9UAX0K96G6E8ew@mail.gmail.com>
2026-11-01 7:39 ` syzbot
[not found] <CAD8CXUk_NjipxtM_+BjrQc7fYebgxn+CCij+Q_t8AW8MyeJTLw@mail.gmail.com>
2026-11-01 6:25 ` syzbot
2026-08-17 13:05 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ae75775.6552420f.2a0efc.0058.GAE@google.com \
--to=syzbot+39a2135de1558208d3b3@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=varun.singh10011@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®