INFO: task syz-executor:7262 blocked for more than 143 seconds.
Not tainted 5.15.165-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:20504 pid: 7262 ppid: 1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
blk_mq_freeze_queue_wait+0xfa/0x180 block/blk-mq.c:151
__loop_clr_fd+0x21b/0xbe0 drivers/block/loop.c:1381
blkdev_put_whole block/bdev.c:692 [inline]
blkdev_put+0x455/0x790 block/bdev.c:954
deactivate_locked_super+0xa0/0x110 fs/super.c:335
cleanup_mnt+0x44e/0x500 fs/namespace.c:1143
task_work_run+0x129/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7e234ab1e7
RSP: 002b:00007ffc3ce0b2b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f7e235177dc RCX: 00007f7e234ab1e7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc3ce0b370
RBP: 00007ffc3ce0b370 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffc3ce0c3f0
R13: 00007f7e235177dc R14: 00000000000b2d61 R15: 00007ffc3ce0c430
</TASK>
INFO: task udevd:9147 blocked for more than 143 seconds.
Not tainted 5.15.165-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:23168 pid: 9147 ppid: 3027 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
blk_mq_freeze_queue_wait+0xfa/0x180 block/blk-mq.c:151
lo_release+0x116/0x1f0 drivers/block/loop.c:2090
blkdev_put_whole block/bdev.c:692 [inline]
blkdev_put+0x455/0x790 block/bdev.c:954
blkdev_close+0x7c/0xa0 block/fops.c:475
__fput+0x3fe/0x8e0 fs/file_table.c:280
task_work_run+0x129/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f282551d0a8
RSP: 002b:00007ffc8a5c9b38 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007f28253f1ae0 RCX: 00007f282551d0a8
RDX: 0000564185e8aec9 RSI: 00007ffc8a5c9338 RDI: 0000000000000008
RBP: 00005644e1a482c0 R08: 0000000000000006 R09: 39ff5b4a7cff1283
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000002
R13: 00005644e1a50af0 R14: 0000000000000008 R15: 00005644e1a47910
</TASK>
INFO: task udevd:9367 blocked for more than 144 seconds.
Not tainted 5.15.165-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:24216 pid: 9367 ppid: 3027 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515
__mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
blkdev_get_by_dev+0x14d/0xa50 block/bdev.c:817
blkdev_open+0x138/0x2d0 block/fops.c:463
do_dentry_open+0x807/0xfb0 fs/open.c:826
do_open fs/namei.c:3608 [inline]
path_openat+0x2705/0x2f20 fs/namei.c:3742
do_filp_open+0x21c/0x460 fs/namei.c:3769
do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
do_sys_open fs/open.c:1269 [inline]
__do_sys_openat fs/open.c:1285 [inline]
__se_sys_openat fs/open.c:1280 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1280
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f282551c9a4
RSP: 002b:00007ffc8a5c9b00 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00005644e1a68cf0 RCX: 00007f282551c9a4
RDX: 00000000000a0800 RSI: 00005644e1a6cc50 RDI: 00000000ffffff9c
RBP: 00005644e1a6cc50 R08: 00000000ffffffff R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000a0800
R13: 00005644e1a5a2b0 R14: 0000000000000001 R15: 00005644e1a47910
</TASK>
INFO: task syz.2.1628:11327 blocked for more than 144 seconds.
Not tainted 5.15.165-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1628 state:D stack:25440 pid:11327 ppid: 8304 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515
__mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
blkdev_get_by_dev+0x14d/0xa50 block/bdev.c:817
blkdev_get_by_path+0x1e0/0x2d0 block/bdev.c:888
get_tree_bdev+0xda/0x620 fs/super.c:1273
vfs_get_tree+0x88/0x270 fs/super.c:1528
do_new_mount+0x2ba/0xb40 fs/namespace.c:3005
do_mount fs/namespace.c:3348 [inline]
__do_sys_mount fs/namespace.c:3556 [inline]
__se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3533
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fa86431565a
RSP: 002b:00007fa86278fe68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fa86278fef0 RCX: 00007fa86431565a
RDX: 00000000200000c0 RSI: 0000000020000240 RDI: 00007fa86278feb0
RBP: 00000000200000c0 R08: 00007fa86278fef0 R09: 0000000000000800
R10: 0000000000000800 R11: 0000000000000246 R12: 0000000020000240
R13: 00007fa86278feb0 R14: 0000000000001524 R15: 0000000020000b80
</TASK>
INFO: task syz.1.1629:11329 blocked for more than 145 seconds.
Not tainted 5.15.165-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1629 state:D stack:25984 pid:11329 ppid: 7813 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
blk_mq_freeze_queue_wait+0xfa/0x180 block/blk-mq.c:151
lo_release+0x116/0x1f0 drivers/block/loop.c:2090
blkdev_put_whole block/bdev.c:692 [inline]
blkdev_put+0x455/0x790 block/bdev.c:954
blkdev_close+0x7c/0xa0 block/fops.c:475
__fput+0x3fe/0x8e0 fs/file_table.c:280
task_work_run+0x129/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f2632641b4a
RSP: 002b:00007f2630abee50 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007f2630abeef0 RCX: 00007f2632641b4a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 0000000020000000 R08: 0000000000000000 R09: 00000000000002ef
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000020000180
R13: 00007f2630abeeb0 R14: 00000000000002f5 R15: 0000000020000340
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8c91fbe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/u4:4/1456:
#0: ffff888017079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc900059ffd20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251
2 locks held by getty/3333:
#0: ffff88814b351098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1: ffffc9000209b2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158
2 locks held by kworker/0:4/3579:
3 locks held by kworker/0:7/3613:
#0: ffff888017070938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc90003067d20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:74
3 locks held by kworker/1:12/3826:
#0: ffff888028ffa538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc90003177d20 ((addr_chk_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0xa/0x20 net/ipv6/addrconf.c:4657
5 locks held by kworker/0:13/4675:
#0: ffff88801c175d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc900030f7d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffff888147ede220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline]
#2: ffff888147ede220 (&dev->mutex){....}-{3:3}, at: hub_event+0x208/0x54c0 drivers/usb/core/hub.c:5769
#3: ffff888147ee95c0 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3125 [inline]
#3: ffff888147ee95c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5351 [inline]
#3: ffff888147ee95c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5595 [inline]
#3: ffff888147ee95c0 (&port_dev->status_lock){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5741 [inline]
#3: ffff888147ee95c0 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x2238/0x54c0 drivers/usb/core/hub.c:5823
#4: ffff8880238e7e68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect drivers/usb/core/hub.c:5352 [inline]
#4: ffff8880238e7e68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_port_connect_change drivers/usb/core/hub.c:5595 [inline]
#4: ffff8880238e7e68 (hcd->address0_mutex){+.+.}-{3:3}, at: port_event drivers/usb/core/hub.c:5741 [inline]
#4: ffff8880238e7e68 (hcd->address0_mutex){+.+.}-{3:3}, at: hub_event+0x2260/0x54c0 drivers/usb/core/hub.c:5823
2 locks held by syz-executor/7262:
#0: ffff888020a0c118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xfb/0x790 block/bdev.c:912
#1: ffff8880209b4468 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0xa9/0xbe0 drivers/block/loop.c:1365
2 locks held by kworker/0:15/8461:
2 locks held by udevd/9147:
#0: ffff8880209ab918 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xfb/0x790 block/bdev.c:912
#1: ffff888020996468 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_release+0x4d/0x1f0 drivers/block/loop.c:2070
1 lock held by udevd/9367:
#0: ffff88802099f118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x14d/0xa50 block/bdev.c:817
3 locks held by syz.3.1623/11315:
2 locks held by syz.0.1624/11308:
#0: ffff88802099a918 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xfb/0x790 block/bdev.c:912
#1: ffff888020990468 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_release+0x4d/0x1f0 drivers/block/loop.c:2070
1 lock held by syz.2.1628/11327:
#0: ffff8880209ab918 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x14d/0xa50 block/bdev.c:817
2 locks held by syz.1.1629/11329:
#0: ffff88802099f118 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xfb/0x790 block/bdev.c:912
#1: ffff888020993468 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_release+0x4d/0x1f0 drivers/block/loop.c:2070
2 locks held by syz-executor/11333:
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3a/0x1b0 drivers/net/tun.c:3440
#1: ffffffff8c7bd490 (cpu_hotplug_lock){++++}-{0:0}, at: flush_all_backlogs net/core/dev.c:5847 [inline]
#1: ffffffff8c7bd490 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many+0x58e/0x18f0 net/core/dev.c:11079
2 locks held by syz-executor/11354:
#0: ffffffff8da25210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x378/0x5d0 net/core/net_namespace.c:472
#1: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x20f/0x700 net/ipv4/ip_tunnel.c:1096
6 locks held by syz-executor/11357:
#0: ffffffff8da25210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x378/0x5d0 net/core/net_namespace.c:472
#1: ffffffff8d81cd10 (devices_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x162/0x250 drivers/infiniband/core/device.c:1178
#2: ffffffff8d81ced0 (rdma_nets_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x1b0/0x250 drivers/infiniband/core/device.c:1183
#3: ffff888076c3cfe0 (&device->compat_devs_mutex){+.+.}-{3:3}, at: add_one_compat_dev+0x103/0x6c0 drivers/infiniband/core/device.c:942
#4: ffff888076c3d208 (&rxe->usdev_lock){+.+.}-{3:3}, at: rxe_query_port+0x46/0x1a0 drivers/infiniband/sw/rxe/rxe_verbs.c:40
#5: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: ib_get_eth_speed+0x145/0x500 drivers/infiniband/core/verbs.c:1905
4 locks held by syz-executor/11362:
#0: ffffffff8da25210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x378/0x5d0 net/core/net_namespace.c:472
#1: ffffffff8d81cd10 (devices_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x162/0x250 drivers/infiniband/core/device.c:1178
#2: ffffffff8d81ced0 (rdma_nets_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x1b0/0x250 drivers/infiniband/core/device.c:1183
#3: ffff888076c3cfe0 (&device->compat_devs_mutex){+.+.}-{3:3}, at: add_one_compat_dev+0x103/0x6c0 drivers/infiniband/core/device.c:942
4 locks held by syz-executor/11363:
#0: ffffffff8da25210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x378/0x5d0 net/core/net_namespace.c:472
#1: ffffffff8d81cd10 (devices_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x162/0x250 drivers/infiniband/core/device.c:1178
#2: ffffffff8d81ced0 (rdma_nets_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x1b0/0x250 drivers/infiniband/core/device.c:1183
#3: ffff888076c3cfe0 (&device->compat_devs_mutex){+.+.}-{3:3}, at: add_one_compat_dev+0x103/0x6c0 drivers/infiniband/core/device.c:942
4 locks held by syz-executor/11364:
#0: ffffffff8da25210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x378/0x5d0 net/core/net_namespace.c:472
#1: ffffffff8d81cd10 (devices_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x162/0x250 drivers/infiniband/core/device.c:1178
#2: ffffffff8d81ced0 (rdma_nets_rwsem){++++}-{3:3}, at: rdma_dev_init_net+0x1b0/0x250 drivers/infiniband/core/device.c:1183
#3: ffff888076c3cfe0 (&device->compat_devs_mutex){+.+.}-{3:3}, at: add_one_compat_dev+0x103/0x6c0 drivers/infiniband/core/device.c:942
1 lock held by syz-executor/11370:
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5615
1 lock held by syz-executor/11373:
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5615
1 lock held by syz-executor/11378:
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5615
1 lock held by syz-executor/11379:
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5615
1 lock held by syz-executor/11382:
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8da30dc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5615
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.165-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xe72/0xeb0 kernel/hung_task.c:295
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 11315 Comm: syz.3.1623 Not tainted 5.15.165-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:rcu_lockdep_current_cpu_online+0x23/0x130 kernel/rcu/tree.c:1168
Code: 00 00 00 00 00 66 90 41 57 41 56 41 54 53 65 8b 0d 8a 55 97 7e b0 01 f7 c1 00 00 f0 00 0f 85 e2 00 00 00 83 3d 75 39 7e 0c 00 <0f> 84 d5 00 00 00 65 ff 05 68 55 97 7e e8 bb 46 c8 08 89 c3 83 f8
RSP: 0018:ffffc90002de73b8 EFLAGS: 00000202
RAX: 0000000000044101 RBX: 0000000000000000 RCX: 0000000080000000
RDX: ffff88807ebc3b80 RSI: ffffffff8ad8f7a0 RDI: ffffffff8ad8f760
RBP: ffff88801750e6d0 R08: ffffffff842ff49d R09: fffffbfff20e1e19
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920005bce9c
R13: 0000000000000001 R14: ffff888099ef4b02 R15: ffffc90002de74e0
FS: 00007f4b8716e6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3060eff8 CR3: 000000005be52000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
rcu_read_lock_held_common kernel/rcu/update.c:112 [inline]
rcu_read_lock_held+0x1a/0x40 kernel/rcu/update.c:309
xa_entry include/linux/xarray.h:1182 [inline]
xas_descend+0x118/0x3a0 lib/xarray.c:204
xas_load+0xba/0x140 lib/xarray.c:240
mapping_get_entry mm/filemap.c:1826 [inline]
pagecache_get_page+0x20f/0x1010 mm/filemap.c:1894
find_get_page_flags include/linux/pagemap.h:357 [inline]
__find_get_block_slow fs/buffer.c:202 [inline]
__find_get_block+0x3e8/0x1350 fs/buffer.c:1310
__getblk_gfp+0x2d/0xaf0 fs/buffer.c:1332
__bread_gfp+0x2a/0x390 fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
bfs_find_entry+0x1c3/0x3f0 fs/bfs/dir.c:337
bfs_lookup+0x147/0x270 fs/bfs/dir.c:137
lookup_open fs/namei.c:3440 [inline]
open_last_lookups fs/namei.c:3532 [inline]
path_openat+0x111d/0x2f20 fs/namei.c:3739
do_filp_open+0x21c/0x460 fs/namei.c:3769
do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
do_sys_open fs/open.c:1269 [inline]
__do_sys_open fs/open.c:1277 [inline]
__se_sys_open fs/open.c:1273 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1273
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f4b88d33eb9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4b8716e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f4b88ed0130 RCX: 00007f4b88d33eb9
RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000000020000180
RBP: 00007f4b88da193e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4b88ed0130 R15: 00007ffef77752c8
</TASK>