syzbot

input: syz1 as /devices/virtual/input/input223
input: syz1 as /devices/virtual/input/input224
INFO: task syz-executor.0:32406 blocked for more than 140 seconds.
      Not tainted 4.9.165+ #27
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.0  D28808 32406   4318 0x00000004
 ffff8801a443c740 ffff8801a011a680 ffff8801db721000 ffff8801a471df00
 ffff8801db721018 ffff8801ac71f8c0 ffffffff827fbcce ffffffff82807255
 ffff8801cc92ea48 00ff8801ac71f810 ffff8801db7218f0 1ffff100358e3f07
Call Trace:
 [<ffffffff827fd5a2>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
 [<ffffffff82807263>] __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:533 [inline]
 [<ffffffff82807263>] rwsem_down_write_failed+0x3a3/0x750 kernel/locking/rwsem-xadd.c:562
 [<ffffffff81b7d1c7>] call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105
 [<ffffffff8280616c>] __down_write arch/x86/include/asm/rwsem.h:125 [inline]
 [<ffffffff8280616c>] down_write+0x5c/0xa0 kernel/locking/rwsem.c:54
 [<ffffffff8154267b>] inode_lock include/linux/fs.h:768 [inline]
 [<ffffffff8154267b>] do_last fs/namei.c:3353 [inline]
 [<ffffffff8154267b>] path_openat+0xe4b/0x2f60 fs/namei.c:3581
 [<ffffffff81547571>] do_filp_open+0x1a1/0x280 fs/namei.c:3615
 [<ffffffff8150bb00>] do_sys_open+0x2f0/0x610 fs/open.c:1072
 [<ffffffff8150bec7>] SYSC_open fs/open.c:1090 [inline]
 [<ffffffff8150bec7>] SyS_open fs/open.c:1085 [inline]
 [<ffffffff8150bec7>] SYSC_creat fs/open.c:1110 [inline]
 [<ffffffff8150bec7>] SyS_creat+0x27/0x30 fs/open.c:1108
 [<ffffffff810056bd>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
 [<ffffffff8280c153>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131d3fc>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
 #0:  (rcu_read_lock){......}, at: [<ffffffff8131d3fc>] watchdog+0x13c/0xae0 kernel/hung_task.c:239
 #1:  (tasklist_lock){.+.+..}, at: [<ffffffff8140072f>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
2 locks held by getty/2040:
 #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff8280a233>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377
 #1:  (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d3d9fe>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
2 locks held by syz-executor.0/32406:
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8157b4df>] sb_start_write include/linux/fs.h:1575 [inline]
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8157b4df>] mnt_want_write+0x3f/0xb0 fs/namespace.c:391
 #1:  (&type->i_mutex_dir_key#3){++++++}, at: [<ffffffff8154267b>] inode_lock include/linux/fs.h:768 [inline]
 #1:  (&type->i_mutex_dir_key#3){++++++}, at: [<ffffffff8154267b>] do_last fs/namei.c:3353 [inline]
 #1:  (&type->i_mutex_dir_key#3){++++++}, at: [<ffffffff8154267b>] path_openat+0xe4b/0x2f60 fs/namei.c:3581

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.165+ #27
 ffff8801d98d7cc8 ffffffff81b4ba01 0000000000000001 0000000000000000
 0000000000000001 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00
 ffffffff81b56c8c 0000000000000001 0000000000000000 0000000000000001
Call Trace:
 [<ffffffff81b4ba01>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b4ba01>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81b56c8c>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99
 [<ffffffff81b56c14>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60
 [<ffffffff81097594>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37
 [<ffffffff8131d921>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline]
 [<ffffffff8131d921>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff8131d921>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff8131d921>] watchdog+0x661/0xae0 kernel/hung_task.c:239
 [<ffffffff81142298>] kthread+0x278/0x310 kernel/kthread.c:211
 [<ffffffff8280c31c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff8280ad42