Dear Linux Developer, Recently when using our tool to fuzz kernel, the following crash was triggered: HEAD commit: 64570fbc14f8 Linux 5.15-rc5 git tree: upstream compiler: clang 12.0.0 console output: https://drive.google.com/file/d/1dk3H5-D3ppxAONucKu_Vh7uXI2e94HyI/view?usp=sharing Syzlang reproducer: https://drive.google.com/file/d/1dcYG-en7_om3HWtUUMip3vooPxr38is2/view?usp=sharing C reproducer: https://drive.google.com/file/d/15cJ2SBbvNIBJXFux85lmVFz5kbwNsY4w/view?usp=sharing kernel config: https://drive.google.com/file/d/1lNwvovjLNrcuyFGrg05IoSmgO5jaKBBJ/view?usp=sharing IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: Wei Chen <harperchen1110@xxxxxxxxx> INFO: task syz-executor:14691 blocked for more than 143 seconds. Not tainted 5.15.0-rc5+ #14 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:25712 pid:14691 ppid: 6522 flags:0x00004004 Call Trace: __schedule+0xc1a/0x11e0 schedule+0x14b/0x210 io_schedule+0x83/0x100 bit_wait_io+0xe/0xc0 __wait_on_bit+0xbb/0x180 out_of_line_wait_on_bit+0x1c3/0x240 __block_write_begin_int+0x187e/0x1a10 block_write_begin+0x54/0x2c0 generic_perform_write+0x28c/0x5e0 __generic_file_write_iter+0x26d/0x540 blkdev_write_iter+0x3a2/0x560 vfs_write+0x868/0xf50 ksys_write+0x175/0x2b0 do_syscall_64+0x3d/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f08ee707c4d RSP: 002b:00007f08ebc6fc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f08ee82e0a0 RCX: 00007f08ee707c4d RDX: 00000000000006a8 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007f08ee780d80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f08ee82e0a0 R13: 00007ffc57334f2f R14: 00007ffc573350d0 R15: 00007f08ebc6fdc0 Showing all locks held in the system: 2 locks held by kworker/u2:1/10: 1 lock held by khungtaskd/21: #0: ffffffff8cf1c040 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 1 lock held by in:imklog/6329: #0: ffff888016c2dc70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x26c/0x310 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 21 Comm: khungtaskd Not tainted 5.15.0-rc5+ #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x1d8/0x2c4 nmi_cpu_backtrace+0x452/0x480 nmi_trigger_cpumask_backtrace+0x1a3/0x330 watchdog+0xdbe/0xe30 kthread+0x419/0x510 ret_from_fork+0x1f/0x30 Best, Wei
