INFO: task syz.4.135:6490 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.135 state:D stack:23832 pid:6490 tgid:6489 ppid:5822 [ 383.686455][ T39] task:syz.4.135 state:D stack:23832 pid:6490 tgid:6489 ppid:5822 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5387 [inline]
__schedule+0x169e/0x54f0 kernel/sched/core.c:7188
__schedule_loop kernel/sched/core.c:7267 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7282
schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153
xfs_dqflock fs/xfs/xfs_dquot.h:111 [inline]
xfs_qm_flush_one+0x107/0x200 fs/xfs/xfs_qm.c:1432
xfs_qm_dquot_walk+0x28a/0x5d0 fs/xfs/xfs_qm.c:90
xfs_qm_quotacheck+0x432/0x6f0 fs/xfs/xfs_qm.c:1531
xfs_qm_mount_quotas+0x26a/0x670 fs/xfs/xfs_qm.c:1646
xfs_mountfs+0x1b16/0x22e0 fs/xfs/xfs_mount.c:1187
xfs_fs_fill_super+0x11b5/0x1600 fs/xfs/xfs_super.c:1938
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcde357da8a
RSP: 002b:00007fcde17cde58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fcde17cdee0 RCX: 00007fcde357da8a
RDX: 0000200000009700 RSI: 00002000000007c0 RDI: 00007fcde17cdea0
RBP: 0000200000009700 R08: 00007fcde17cdee0 R09: 0000000004000000
R10: 0000000004000000 R11: 0000000000000246 R12: 00002000000007c0
R13: 00007fcde17cdea0 R14: 000000000000975c R15: 00002000000000c0
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/39:
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6777
5 locks held by kworker/u8:5/91:
#0: ffff88813fe7c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc90002f0fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffffffff8de57c10 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:222
#3: ffffffff8e09b8b8 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline]
#3: ffffffff8e09b8b8 (jump_label_mutex){+.+.}-{4:4}, at: static_key_enable_cpuslocked+0xcb/0x240 kernel/jump_label.c:207
#4: ffffffff8de6e298 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145
6 locks held by kworker/u8:6/212:
#0: ffff88813fe7c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc90003be7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffff888031262310 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:909
#3: ffff888061842d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff888061842d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff888061842d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffff8880b8636f90 ((crngs.lock)){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#5: ffff8880b8636f90 ((crngs.lock)){+.+.}-{3:3}, at: crng_make_state+0x162/0x5d0 drivers/char/random.c:358
5 locks held by kworker/u8:12/4511:
#0: ffff88813fe7c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc900104dfc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffff888035fc0310 (&devlink->lock_key#10){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:909
#3: ffff88803c714520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803c714520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff88803c714520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
3 locks held by jbd2/sda1-8/5154:
#0: ffff888037a40108 (&journal->j_state_lock){++++}-{3:3}, at: write_lock include/linux/rwlock_rt.h:92 [inline]
#0: ffff888037a40108 (&journal->j_state_lock){++++}-{3:3}, at: jbd2_journal_commit_transaction+0x6ba/0x5b20 fs/jbd2/commit.c:466
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_write_lock+0x86/0x220 kernel/locking/spinlock_rt.c:244
#2: ffff888037a403d8 (&journal->j_wait_updates){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff888037a403d8 (&journal->j_wait_updates){+.+.}-{3:3}, at: prepare_to_wait+0x44/0x200 kernel/sched/wait.c:253
2 locks held by dhcpcd/5487:
#0: ffff888031a52928 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: netlink_dump+0xe2/0xe10 net/netlink/af_netlink.c:2267
#1: ffffffff8f382478 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f382478 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 net/core/rtnetlink.c:6862
2 locks held by getty/5576:
#0: ffff8880373fc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 drivers/tty/n_tty.c:2211
4 locks held by kworker/1:3/5833:
#0: ffff88813fe3a538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc90004f17c40 ((gc_work).work){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffffffff8eab0258 ("ratelimiter_table_lock"){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffffffff8eab0258 ("ratelimiter_table_lock"){+.+.}-{3:3}, at: wg_ratelimiter_gc_entries+0x5d/0x480 drivers/net/wireguard/ratelimiter.c:63
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
5 locks held by kworker/1:8/6024:
#0: ffff88813fe3b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc90005d4fc40 (((io_key_has_sqarray).work).work){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffffffff8de57c10 (cpu_hotplug_lock){++++}-{0:0}, at: __static_key_slow_dec kernel/jump_label.c:320 [inline]
#2: ffffffff8de57c10 (cpu_hotplug_lock){++++}-{0:0}, at: jump_label_update_timeout+0x16/0x30 kernel/jump_label.c:329
#3: ffffffff8e09b8b8 (jump_label_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#3: ffffffff8e09b8b8 (jump_label_mutex){+.+.}-{4:4}, at: __static_key_slow_dec_cpuslocked+0x3a/0x110 kernel/jump_label.c:300
#4: ffffffff8de7ee60 (sched_map-wait-type-override){+.+.}-{3:3}, at: sched_submit_work kernel/sched/core.c:7223 [inline]
#4: ffffffff8de7ee60 (sched_map-wait-type-override){+.+.}-{3:3}, at: rt_mutex_pre_schedule+0x79/0x1d0 kernel/sched/core.c:7557
5 locks held by kworker/u8:13/6039:
#0: ffff88801b686138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc9000613fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffffffff8f373400 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:673
#3: ffff88803a7e1878 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x116/0x310 drivers/net/wireguard/device.c:249
#4: ffffffff8dfce2f0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
3 locks held by syz.4.135/6490:
#0: ffff8880349540d0 (&type->s_umount_key#51/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xac0 fs/super.c:345
#1: ffff88802bc7d208 (&qinf->qi_tree_lock){+.+.}-{4:4}, at: xfs_qm_dquot_walk+0x194/0x5d0 fs/xfs/xfs_qm.c:77
#2: ffff88805e620310 (&xfs_dquot_project_class){+.+.}-{4:4}, at: xfs_qm_flush_one+0xa4/0x200 fs/xfs/xfs_qm.c:1427
1 lock held by syz-executor/6567:
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_read_lock+0x277/0x4b0 kernel/locking/spinlock_rt.c:234
1 lock held by syz-executor/6607:
#0: ffff88803555e480 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:493
1 lock held by udevd/6988:
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x470 mm/page_owner.c:283
3 locks held by kworker/u8:16/7128:
#0: ffff88813fe7c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc900038c7c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffffffff8f382478 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
5 locks held by kworker/u8:18/7357:
#0: ffff888032c29938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc90006f2fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffffffff8de5f280 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#4: ffff88806d1798d8 (key#17){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
#4: ffff88806d1798d8 (key#17){+...}-{3:3}, at: batadv_tt_local_purge+0x143/0x380 net/batman-adv/translation-table.c:1318
9 locks held by syz-executor/7541:
#0: ffff888037bae480 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2724 [inline]
#0: ffff888037bae480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 fs/read_write.c:684
#1: ffff88806091f078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 fs/kernfs/file.c:343
#2: ffff88802a1d70f8 (kn->active#52){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88802a1d70f8 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 fs/kernfs/file.c:344
#3: ffffffff8ebe6a18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:234
#4: ffff88805f827160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#4: ffff88805f827160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1174 [inline]
#4: ffff88805f827160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 drivers/base/dd.c:1372
#5: ffff88801abbc310 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1799
#6: ffffffff8f382478 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x13a/0x830 drivers/net/netdevsim/netdev.c:1185
#7: ffff88805fa2cf50 (&dev_instance_lock_key#24){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2806 [inline]
#7: ffff88805fa2cf50 (&dev_instance_lock_key#24){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x588/0x22b0 net/core/dev.c:12443
#8: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#8: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#8: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __fib6_clean_all+0xbd/0x610 net/ipv6/ip6_fib.c:2318
5 locks held by kworker/u8:19/7841:
#0: ffff88813fe7c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc9000650fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffff88803246c310 (&devlink->lock_key#8){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:909
#3: ffff88802abdbd20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88802abdbd20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff88802abdbd20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
6 locks held by kworker/u8:20/7868:
#0: ffff88813fe7c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3284
#1: ffffc90005a87c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3285
#2: ffff88805f246310 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:909
#3: ffff888031a11d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff888031a11d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff888031a11d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffff8880b8736f90 ((crngs.lock)){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#5: ffff8880b8736f90 ((crngs.lock)){+.+.}-{3:3}, at: crng_make_state+0x162/0x5d0 drivers/char/random.c:358
4 locks held by syz.8.356/8080:
#0: ffff88801b6aa480 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2724 [inline]
#0: ffff88801b6aa480 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 fs/read_write.c:684
#1: ffff8880607e3f48 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1029 [inline]
#1: ffff8880607e3f48 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3468
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_trylock kernel/locking/spinlock_rt.c:110 [inline]
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10c/0x2b0 kernel/locking/spinlock_rt.c:118
#3: ffff8880b863b9a0 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0xb6/0x150 kernel/sched/core.c:660
4 locks held by syz.6.362/8083:
#0: ffff888038881db0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
#0: ffff888038881db0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x194/0x9e0 mm/mmap.c:1284
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 mm/pgtable-generic.c:290
#2: ffff888040778658 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff888040778658 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
6 locks held by syz.7.364/8086:
#0: ffff888033158308 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:5850 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:5884 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: do_fault mm/memory.c:6027 [inline]
#1: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: do_pte_missing+0x12b5/0x2950 mm/memory.c:4550
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: filemap_map_pages+0x201/0x1d10 mm/filemap.c:3895
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 mm/pgtable-generic.c:290
#4: ffff8880396934d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#4: ffff8880396934d8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
#5: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#5: ffffffff8dfc8100 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd3/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 17 Comm: pr/legacy Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:get_current arch/x86/include/asm/current.h:25 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x8/0xa0 kernel/kcov.c:300
Code: 89 44 0a 20 e9 89 7b 75 09 cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 08 b3 b1 10 65 44 8b 05 28 b3 b1 10 41 81 e0 00 00 ff
RSP: 0000:ffffc90000007ec0 EFLAGS: 00000086
RAX: ffffffff816b8fa5 RBX: 000000595f27e071 RCX: 0000005aa389c852
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000007f00 R08: ffffffff8f8d41f7 R09: 1ffffffff1f1a83e
R10: dffffc0000000000 R11: ffffc90000007ff8 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffc90000007f40 R15: 1ffff92000000fe4
FS: 0000000000000000(0000) GS:ffff888125eba000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c43706c CR3: 000000002c132000 CR4: 00000000003526f0
Call Trace:
<IRQ>
__preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline]
sched_clock+0x35/0x60 arch/x86/kernel/tsc.c:298
sched_clock_cpu+0x74/0x440 kernel/sched/clock.c:400
irqtime_account_irq+0x69/0x200 kernel/sched/cputime.c:68
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0x99/0xc0 arch/x86/kernel/apic/apic.c:1061
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:401
Code: e8 be bf 87 fc 44 89 f9 d3 e3 49 83 ee 80 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 6f 36 f1 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 4a 3e fd 05 cc 44 89 f9 80 e1 07
RSP: 0000:ffffc900001679d0 EFLAGS: 00000202
RAX: 1ffffffff337ac00 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff99bd69f0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff853ce990 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffffff99bd6760 R15: 0000000000000000
serial_in drivers/tty/serial/8250/8250.h:128 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline]
wait_for_lsr+0x1aa/0x2f0 drivers/tty/serial/8250/8250_port.c:1970
serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3207 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3272 [inline]
serial8250_console_write+0x120d/0x1b90 drivers/tty/serial/8250/8250_port.c:3357
console_emit_next_record kernel/printk/printk.c:3163 [inline]
console_flush_one_record+0x68b/0xb90 kernel/printk/printk.c:3269
legacy_kthread_func+0x1b6/0x250 kernel/printk/printk.c:3712
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>