INFO: task syz.1.729:6607 blocked for more than 143 seconds.
Not tainted 5.15.166-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.729 state:D stack:24736 pid: 6607 ppid: 5094 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
percpu_rwsem_wait+0x3e1/0x470 kernel/locking/percpu-rwsem.c:160
__percpu_down_read+0xd0/0x100 kernel/locking/percpu-rwsem.c:174
percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
__sb_start_write include/linux/fs.h:1811 [inline]
sb_start_write+0x182/0x1c0 include/linux/fs.h:1881
mnt_want_write+0x3b/0x80 fs/namespace.c:377
open_last_lookups fs/namei.c:3521 [inline]
path_openat+0x7a3/0x2f20 fs/namei.c:3739
do_filp_open+0x21c/0x460 fs/namei.c:3769
do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
do_sys_open fs/open.c:1269 [inline]
__do_sys_openat fs/open.c:1285 [inline]
__se_sys_openat fs/open.c:1280 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1280
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f3f38220ef9
RSP: 002b:00007f3f3669a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f3f383d9f80 RCX: 00007f3f38220ef9
RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 00007f3f38293046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3f383d9f80 R15: 00007ffc244e3728
</TASK>
INFO: task kmmpd-loop1:6615 blocked for more than 143 seconds.
Not tainted 5.15.166-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kmmpd-loop1 state:D stack:27480 pid: 6615 ppid: 2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5027 [inline]
__schedule+0x12c4/0x45b0 kernel/sched/core.c:6373
schedule+0x11b/0x1f0 kernel/sched/core.c:6456
percpu_rwsem_wait+0x3e1/0x470 kernel/locking/percpu-rwsem.c:160
__percpu_down_read+0xd0/0x100 kernel/locking/percpu-rwsem.c:174
percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
__sb_start_write include/linux/fs.h:1811 [inline]
sb_start_write include/linux/fs.h:1881 [inline]
write_mmp_block+0x2f0/0x390 fs/ext4/mmp.c:66
kmmpd+0x292/0xa90 fs/ext4/mmp.c:248
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8c91fbe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by getty/3321:
#0: ffff88814b8ae098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1: ffffc9000209b2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158
3 locks held by kworker/0:5/3612:
#0: ffff888017070938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc900030c7d20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffff888075799240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x2cd/0x4120 drivers/net/netdevsim/fib.c:1478
2 locks held by kworker/0:9/3616:
#0: ffff888017072138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc90002f27d20 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
4 locks held by kworker/u4:12/4004:
#0: ffff8880171d5938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
#1: ffffc90003557d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
#2: ffffffff8da25a50 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 net/core/net_namespace.c:561
#3: ffffffff8c9241a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
#3: ffffffff8c9241a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x280/0x740 kernel/rcu/tree_exp.h:845
1 lock held by syz.1.729/6607:
#0: ffff8880601e8460 (sb_writers#5){++++}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:377
1 lock held by kmmpd-loop1/6615:
#0: ffff8880601e8460 (sb_writers#5){++++}-{0:0}, at: kmmpd+0x292/0xa90 fs/ext4/mmp.c:248
3 locks held by syz.3.1254/8922:
#0: ffff8880b913a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475
#1: ffff8880b9127848 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x53d/0x810 kernel/sched/psi.c:891
#2: ffff888028060220 (&(&sig->stats_lock)->lock){....}-{2:2}, at: spin_lock include/linux/spinlock.h:363 [inline]
#2: ffff888028060220 (&(&sig->stats_lock)->lock){....}-{2:2}, at: write_seqlock include/linux/seqlock.h:890 [inline]
#2: ffff888028060220 (&(&sig->stats_lock)->lock){....}-{2:2}, at: __exit_signal kernel/exit.c:182 [inline]
#2: ffff888028060220 (&(&sig->stats_lock)->lock){....}-{2:2}, at: release_task+0x835/0x1750 kernel/exit.c:246
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.166-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xe72/0xeb0 kernel/hung_task.c:295
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 8926 Comm: syz.3.1254 Not tainted 5.15.166-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:xas_start+0x35b/0x7b0 lib/xarray.c:193
Code: 08 4c 89 e7 e8 06 ff 99 fd 49 8b 2c 24 84 db 74 76 49 8d 5d fe 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 0f 85 c6 03 00 00 0f b6 1b bf 40 00 00 00 89 de e8 4e 38 50
RSP: 0018:ffffc900025870d0 EFLAGS: 00000802
RAX: 0000000000000000 RBX: ffff8880612a5b80 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002
RBP: 0000000000000216 R08: ffffffff843023a4 R09: fffff940002e6691
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90002587268
R13: ffff8880612a5b82 R14: ffffc90002587278 R15: 1ffff920004b0e4f
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc3beea4b8 CR3: 000000000c68e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
xas_load lib/xarray.c:233 [inline]
xas_store+0xaa/0x19e0 lib/xarray.c:788
page_cache_delete mm/filemap.c:142 [inline]
__delete_from_page_cache+0x672/0x860 mm/filemap.c:232
delete_from_page_cache+0x126/0x190 mm/filemap.c:266
truncate_inode_page+0x8d/0xb0 mm/truncate.c:219
shmem_undo_range+0x535/0x1b50 mm/shmem.c:960
shmem_truncate_range mm/shmem.c:1063 [inline]
shmem_evict_inode+0x21b/0xa00 mm/shmem.c:1145
evict+0x529/0x930 fs/inode.c:622
__dentry_kill+0x436/0x650 fs/dcache.c:586
dentry_kill+0xbb/0x290
dput+0xd8/0x1a0 fs/dcache.c:893
__fput+0x636/0x8e0 fs/file_table.c:288
task_work_run+0x129/0x1a0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x6a3/0x2480 kernel/exit.c:874
do_group_exit+0x144/0x310 kernel/exit.c:996
get_signal+0xc66/0x14e0 kernel/signal.c:2897
arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fba9e91def9
Code: Unable to access opcode bytes at RIP 0x7fba9e91decf.
RSP: 002b:00007fba9cd55038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007fba9ead7130 RCX: 00007fba9e91def9
RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000006
RBP: 00007fba9e990046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fba9ead7130 R15: 00007ffd0fafada8
</TASK>