Hello, When using Healer to fuzz the latest Linux kernel, the following crash was triggered. HEAD commit: 4b93c544e90e-thunderbolt: test: split up test cases git tree: upstream console output: https://drive.google.com/file/d/1maGu7OQMMnheEq18g-XJRrSvPIRLyIae/view?usp=sharing kernel config: https://drive.google.com/file/d/1c0u2EeRDhRO-ZCxr9MP2VvAtJd6kfg-p/view?usp=sharing C reproducer: https://drive.google.com/file/d/1pf2nzNzl2hUxO6EJ1Vp4uqeAmr9tG4Pw/view?usp=sharing Syzlang reproducer: https://drive.google.com/file/d/1CZekMFes8O7FmLULOkxLnovMGWNFtI47/view?usp=sharing Similar report: https://groups.google.com/g/syzkaller-bugs/c/mt4E4qKbC5c/m/m-gbLPjIAgAJ If you fix this issue, please add the following tag to the commit: Reported-by: Hao Sun <sunhao.th@xxxxxxxxx> INFO: task systemd-udevd:8866 blocked for more than 143 seconds. Not tainted 5.14.0+ #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:systemd-udevd state:D stack:27760 pid: 8866 ppid: 4957 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xcd9/0x2530 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 io_schedule+0x17/0x70 kernel/sched/core.c:8389 wait_on_page_bit_common+0x57c/0xf10 mm/filemap.c:1356 wait_on_page_bit mm/filemap.c:1417 [inline] wait_on_page_locked include/linux/pagemap.h:689 [inline] do_read_cache_page+0x26d/0x1440 mm/filemap.c:3504 read_mapping_page include/linux/pagemap.h:515 [inline] read_part_sector+0xfa/0x610 block/partitions/core.c:725 adfspart_check_ICS+0x9d/0xc90 block/partitions/acorn.c:360 check_partition block/partitions/core.c:147 [inline] blk_add_partitions block/partitions/core.c:610 [inline] bdev_disk_changed block/partitions/core.c:696 [inline] bdev_disk_changed+0x778/0x1140 block/partitions/core.c:663 blkdev_get_whole+0x206/0x270 fs/block_dev.c:1092 blkdev_get_by_dev fs/block_dev.c:1234 [inline] blkdev_get_by_dev+0x456/0x900 fs/block_dev.c:1200 blkdev_open+0x154/0x2b0 fs/block_dev.c:1329 do_dentry_open+0x4c8/0x11d0 fs/open.c:822 do_open fs/namei.c:3426 [inline] path_openat+0x1c99/0x2710 fs/namei.c:3559 do_filp_open+0x1c1/0x290 fs/namei.c:3586 do_sys_openat2+0x61b/0x9a0 fs/open.c:1200 do_sys_open+0xc3/0x140 fs/open.c:1216 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f93afce1840 RSP: 002b:00007fffa94a51e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000561916cb8c20 RCX: 00007f93afce1840 RDX: 0000561914d49fe3 RSI: 00000000000a0800 RDI: 0000561916cb9af0 RBP: 00007fffa94a5360 R08: 0000561914d49670 R09: 0000000000000010 R10: 00007f93afa5bd70 R11: 0000000000000246 R12: 00007fffa94a52b0 R13: 0000561916cb51f0 R14: 0000000000000003 R15: 000000000000000e INFO: task syz-executor:9701 blocked for more than 143 seconds. Not tainted 5.14.0+ #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:28568 pid: 9701 ppid: 5747 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xcd9/0x2530 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6425 __mutex_lock_common kernel/locking/mutex.c:669 [inline] __mutex_lock+0xc96/0x1680 kernel/locking/mutex.c:729 blkdev_put+0x98/0x6f0 fs/block_dev.c:1351 blkdev_close+0x8c/0xb0 fs/block_dev.c:1403 __fput+0x288/0x9f0 fs/file_table.c:280 task_work_run+0xe0/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:175 [inline] exit_to_user_mode_prepare+0x28d/0x2a0 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x41a04b RSP: 002b:00007ffc87900cd0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 000000000041a04b RDX: 0000001b32e20000 RSI: ffffffff81649386 RDI: 0000000000000004 RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000001d16 R10: 00000000851efd1a R11: 0000000000000293 R12: 000000000059cc20 R13: 000000000059cc20 R14: 00000000005a0588 R15: 000000000012a34a INFO: lockdep is turned off. NMI backtrace for cpu 1 CPU: 1 PID: 1236 Comm: khungtaskd Not tainted 5.14.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1e1/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xcc8/0x1010 kernel/hung_task.c:295 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0,2-3: NMI backtrace for cpu 3 CPU: 3 PID: 12169 Comm: systemd-journal Not tainted 5.14.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:jhash2 include/linux/jhash.h:129 [inline] RIP: 0010:hash_stack lib/stackdepot.c:181 [inline] RIP: 0010:stack_depot_save+0xc6/0x510 lib/stackdepot.c:273 Code: 04 41 31 f8 44 89 c7 44 29 c0 41 01 d8 c1 c7 06 31 f8 89 df 89 c3 29 c7 44 01 c0 c1 c3 08 31 fb 89 df 41 29 d8 01 c3 c1 c7 10 <41> 31 f8 44 29 c0 89 c7 44 89 c0 41 01 d8 c1 c8 0d 31 f8 89 c7 29 RSP: 0018:ffffc9000236fb00 EFLAGS: 00000a07 RAX: 000000005088c019 RBX: 000000007c4037db RCX: ffffc9000236fb88 RDX: 0000000000000cc0 RSI: 000000000000000a RDI: 0000000077c22bb7 RBP: 0000000000000008 R08: 00000000eca356b5 R09: fffffbfff1adbb1b R10: ffffffff8d6dd8d7 R11: fffffbfff1adbb1a R12: ffffc9000236fb70 R13: 0000000000000cc0 R14: 0000000000000001 R15: 0000000000000cc0 FS: 00007fc8786ad8c0(0000) GS:ffff888135d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc874c2b000 CR3: 000000010e66a000 CR4: 0000000000350ee0 Call Trace: kasan_save_stack+0x32/0x40 mm/kasan/common.c:40 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x83/0xb0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4d/0x4b0 mm/slab.h:519 slab_alloc_node mm/slub.c:2959 [inline] slab_alloc mm/slub.c:2967 [inline] kmem_cache_alloc+0x15d/0x350 mm/slub.c:2972 prepare_creds+0x3f/0x7b0 kernel/cred.c:262 access_override_creds fs/open.c:351 [inline] do_faccessat+0x3f4/0x850 fs/open.c:415 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc8779699c7 Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffce5c6d768 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffce5c70790 RCX: 00007fc8779699c7 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000558daf0c49a3 RBP: 00007ffce5c6d8b0 R08: 0000558daf0ba3e5 R09: 0000000000000018 R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000558dafce8d60 R15: 00007ffce5c6dda0 NMI backtrace for cpu 0 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] NMI backtrace for cpu 0 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] NMI backtrace for cpu 0 skipped: idling at default_idle+0xb/0x10 arch/x86/kernel/process.c:716 NMI backtrace for cpu 2 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] NMI backtrace for cpu 2 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] NMI backtrace for cpu 2 skipped: idling at default_idle+0xb/0x10 arch/x86/kernel/process.c:716 ---------------- Code disassembly (best guess): 0: 04 41 add $0x41,%al 2: 31 f8 xor %edi,%eax 4: 44 89 c7 mov %r8d,%edi 7: 44 29 c0 sub %r8d,%eax a: 41 01 d8 add %ebx,%r8d d: c1 c7 06 rol $0x6,%edi 10: 31 f8 xor %edi,%eax 12: 89 df mov %ebx,%edi 14: 89 c3 mov %eax,%ebx 16: 29 c7 sub %eax,%edi 18: 44 01 c0 add %r8d,%eax 1b: c1 c3 08 rol $0x8,%ebx 1e: 31 fb xor %edi,%ebx 20: 89 df mov %ebx,%edi 22: 41 29 d8 sub %ebx,%r8d 25: 01 c3 add %eax,%ebx 27: c1 c7 10 rol $0x10,%edi * 2a: 41 31 f8 xor %edi,%r8d <-- trapping instruction 2d: 44 29 c0 sub %r8d,%eax 30: 89 c7 mov %eax,%edi 32: 44 89 c0 mov %r8d,%eax 35: 41 01 d8 add %ebx,%r8d 38: c1 c8 0d ror $0xd,%eax 3b: 31 f8 xor %edi,%eax 3d: 89 c7 mov %eax,%edi 3f: 29 .byte 0x29%
