INFO: task syz.8.4633:13074 blocked for more than 143 seconds.
Not tainted 6.14.0-syzkaller-03576-g1e1ba8d23dae #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.4633 state:D stack:27648 pid:13074 tgid:13073 ppid:3894 task_flags:0x400140 flags:0x00000004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5366 [inline]
__schedule+0x1129/0x5c00 kernel/sched/core.c:6747
__schedule_loop kernel/sched/core.c:6824 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6839
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6896
__mutex_lock_common kernel/locking/mutex.c:664 [inline]
__mutex_lock+0x6ae/0xb00 kernel/locking/mutex.c:732
devlink_health_report+0x3ba/0x9c0 net/devlink/health.c:627
nsim_dev_health_break_write+0x166/0x210 drivers/net/netdevsim/health.c:162
full_proxy_write+0x13c/0x200 fs/debugfs/file.c:398
vfs_write+0x25c/0x1180 fs/read_write.c:682
ksys_write+0x12a/0x240 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9f5fd8d169
RSP: 002b:00007f9f60c17038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9f5ffa5fa0 RCX: 00007f9f5fd8d169
RDX: 00000000000000ef RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f9f5fe0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9f5ffa5fa0 R15: 00007fff8b752198
</TASK>
INFO: task syz.8.4633:13077 blocked for more than 143 seconds.
Not tainted 6.14.0-syzkaller-03576-g1e1ba8d23dae #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.4633 state:D stack:29192 pid:13077 tgid:13073 ppid:3894 task_flags:0x400040 flags:0x00000004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5366 [inline]
__schedule+0x1129/0x5c00 kernel/sched/core.c:6747
__schedule_loop kernel/sched/core.c:6824 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6839
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6896
__mutex_lock_common kernel/locking/mutex.c:664 [inline]
__mutex_lock+0x6ae/0xb00 kernel/locking/mutex.c:732
fdget_pos+0x2a2/0x370 fs/file.c:1213
class_fd_pos_constructor include/linux/file.h:85 [inline]
ksys_read+0x71/0x240 fs/read_write.c:704
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9f5fd8d169
RSP: 002b:00007f9f60bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f9f5ffa6080 RCX: 00007f9f5fd8d169
RDX: 0000000000001f40 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f9f5fe0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f9f5ffa6080 R15: 00007fff8b752198
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e1be140 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e1be140 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e1be140 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6761
2 locks held by kworker/u9:0/16899:
#0: ffff888025662948 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc900042efd18 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
1 lock held by syz.6.2628/21132:
2 locks held by syz.7.3894/3288:
7 locks held by syz-executor/12466:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff88805eb48888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
#4: ffff888030e3b0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
#4: ffff888030e3b0e8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
#4: ffff888030e3b0e8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa4/0x620 drivers/base/dd.c:1293
#5: ffff888030e3c250 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_drv_remove+0x4a/0x1d0 drivers/net/netdevsim/dev.c:1675
#6: ffff88804c1d15a8 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
#6: ffff88804c1d15a8 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: simple_recursive_removal+0x2f5/0x8e0 fs/libfs.c:627
3 locks held by syz.8.4633/13074:
#0: ffff88807e727eb8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a2/0x370 fs/file.c:1213
#1: ffff888141e82420 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#2: ffff888030e3c250 (&devlink->lock_key#5){+.+.}-{4:4}, at: devlink_health_report+0x3ba/0x9c0 net/devlink/health.c:627
1 lock held by syz.8.4633/13077:
#0: ffff88807e727eb8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a2/0x370 fs/file.c:1213
2 locks held by syz.9.4640/13273:
#0: ffff888141e82420 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:3754 [inline]
#0: ffff888141e82420 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x1f3e/0x2d40 fs/namei.c:4001
#1: ffff88804c1d15a8 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline]
#1: ffff88804c1d15a8 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: open_last_lookups fs/namei.c:3764 [inline]
#1: ffff88804c1d15a8 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: path_openat+0x88a/0x2d40 fs/namei.c:4001
4 locks held by syz-executor/13549:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff888075416c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
4 locks held by syz-executor/13989:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff88803325bc88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
3 locks held by kworker/0:6/15013:
#0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc90000be7d18 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
#2: ffffffff8e1c9678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x280/0x3c0 kernel/rcu/tree_exp.h:304
4 locks held by syz-executor/15233:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff88807cabac88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
4 locks held by syz-executor/16139:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff888026267c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
4 locks held by syz-executor/16509:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff888032199488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
1 lock held by syz.7.4772/17212:
#0: ffffffff8fef80a8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8fef80a8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 drivers/net/tun.c:3517
4 locks held by syz-executor/17515:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff88809eb80888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
4 locks held by syz-executor/18237:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff888097bf8888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
4 locks held by syz-executor/18611:
#0: ffff88807ece6420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x240 fs/read_write.c:736
#1: ffff8880a5631c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x287/0x510 fs/kernfs/file.c:325
#2: ffff8880260e6008 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2aa/0x510 fs/kernfs/file.c:326
#3: ffffffff8f4a43e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:216
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-syzkaller-03576-g1e1ba8d23dae #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
watchdog+0xf70/0x12c0 kernel/hung_task.c:399
kthread+0x3a4/0x760 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 21132 Comm: syz.6.2628 Not tainted 6.14.0-syzkaller-03576-g1e1ba8d23dae #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:run_timer_base+0x7c/0x190 kernel/time/timer.c:2433
Code: 00 00 00 e8 56 24 b4 09 48 69 db c0 10 00 00 41 89 c4 48 81 c3 00 a6 7c 93 83 f8 07 0f 87 03 01 00 00 4a 8d 3c e5 c0 5c ab 8d <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f
RSP: 0018:ffffc90000007ed8 EFLAGS: 00000297
RAX: 0000000000000000 RBX: ffffffff937ca600 RCX: dffffc0000000000
RDX: ffff88808286da00 RSI: ffffffff8bd35de0 RDI: ffffffff8dab5cc0
RBP: 1ffff92000000fdb R08: 0000000000000000 R09: fffffbfff20c4ea2
R10: ffffffff90627517 R11: ffffc90000007ff8 R12: 0000000000000000
R13: 0000000080000101 R14: 0000000000000000 R15: ffffffff8de0c0c8
FS: 00007fbe257d56c0(0000) GS:ffff888124e5a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0d8d2d7d60 CR3: 000000006173a000 CR4: 00000000003526f0
Call Trace:
<NMI>
</NMI>
<IRQ>
run_timer_softirq+0x10/0x40 kernel/time/timer.c:2443
handle_softirqs+0x216/0x8e0 kernel/softirq.c:561
do_softirq kernel/softirq.c:462 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:449
</IRQ>
<TASK>
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:389
local_bh_enable include/linux/bottom_half.h:33 [inline]
fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
kernel_fpu_end+0x5e/0x70 arch/x86/kernel/fpu/core.c:460
_sha256_update arch/x86/crypto/sha256_ssse3_glue.c:75 [inline]
_sha256_update+0xc3/0xf0 arch/x86/crypto/sha256_ssse3_glue.c:58
ima_calc_file_hash_tfm+0x300/0x3d0 security/integrity/ima/ima_crypto.c:491
ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
ima_calc_file_hash+0x1ba/0x490 security/integrity/ima/ima_crypto.c:568
ima_collect_measurement+0x897/0xa40 security/integrity/ima/ima_api.c:293
process_measurement+0x126c/0x2360 security/integrity/ima/ima_main.c:375
ima_file_mmap+0x1b1/0x1d0 security/integrity/ima/ima_main.c:465
security_mmap_file+0x88c/0x990 security/security.c:2982
vm_mmap_pgoff+0xec/0x450 mm/util.c:572
ksys_mmap_pgoff+0x1c8/0x5c0 mm/mmap.c:607
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbe2798d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbe257d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fbe27ba6080 RCX: 00007fbe2798d169
RDX: 0000000000000004 RSI: 0000000800000005 RDI: 0000000000000000
RBP: 00007fbe27a0e2a0 R08: 0000000000000401 R09: 0003800000000000
R10: 0000000000040eb3 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fbe27ba6080 R15: 00007ffef4335048
</TASK>