INFO: task syz-executor.5:9023 blocked for more than 143 seconds. Not tainted 5.5.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D24536 9023 1 0x00004004 Call Trace: context_switch kernel/sched/core.c:3386 [inline] __schedule+0x87f/0xcd0 kernel/sched/core.c:4082 schedule+0x188/0x210 kernel/sched/core.c:4156 rwsem_down_write_slowpath+0x807/0xdc0 kernel/locking/rwsem.c:1238 __down_write kernel/locking/rwsem.c:1392 [inline] down_write+0x12b/0x140 kernel/locking/rwsem.c:1535 inode_lock include/linux/fs.h:791 [inline] vfs_unlink+0xdc/0x580 fs/namei.c:4064 do_unlinkat+0x36c/0x7c0 fs/namei.c:4137 __do_sys_unlink fs/namei.c:4184 [inline] __se_sys_unlink fs/namei.c:4182 [inline] __x64_sys_unlink+0x49/0x50 fs/namei.c:4182 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45b0e7 Code: 00 00 e9 5c ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 64 48 8b 0c 25 f8 ff ff ff 48 3b 61 10 76 28 48 83 ec 18 48 89 6c 24 <10> 48 8d 6c 24 10 48 8d 05 16 9a 50 00 48 89 04 24 48 c7 44 24 08 RSP: 002b:00007fff9d97d0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045b0e7 RDX: 00007fff9d97d0c0 RSI: 00007fff9d97d0c0 RDI: 00007fff9d97d150 RBP: 0000000000000128 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000003 R11: 0000000000000246 R12: 00007fff9d97e1e0 R13: 0000000001def940 R14: 0000000000000000 R15: 00007fff9d97e1e0 Showing all locks held in the system: 2 locks held by kworker/u4:5/315: #0: ffff8880aeb37198 (&rq->lock){-.-.}, at: newidle_balance+0x6bc/0xb40 kernel/sched/fair.c:10189 #1: ffffffff892d9588 (rcu_read_lock){....}, at: rcu_lock_acquire+0x4/0x30 include/linux/rcupdate.h:207 1 lock held by khungtaskd/1029: #0: ffffffff892d9588 (rcu_read_lock){....}, at: rcu_lock_acquire+0x4/0x30 include/linux/rcupdate.h:207 1 lock held by rsyslogd/8874: #0: ffff8880a9166e20 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x279/0x310 fs/file.c:821 2 locks held by getty/8964: #0: ffff8880a941f090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc900017ab2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 2 locks held by getty/8965: #0: ffff888096d28090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc9000179b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 2 locks held by getty/8966: #0: ffff88808c8d9090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc9000177b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 2 locks held by getty/8967: #0: ffff8880a8cc0090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc9000178b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 2 locks held by getty/8968: #0: ffff8880996e5090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc9000176b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 2 locks held by getty/8969: #0: ffff8880a862f090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc9000170b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 2 locks held by getty/8970: #0: ffff88809f110090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc900016e32e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x22f/0x1bc0 drivers/tty/n_tty.c:2156 3 locks held by syz-executor.5/9023: #0: ffff888214572428 (sb_writers#3){.+.+}, at: sb_start_write include/linux/fs.h:1650 [inline] #0: ffff888214572428 (sb_writers#3){.+.+}, at: mnt_want_write+0x4a/0xa0 fs/namespace.c:354 #1: ffff88808db68888 (&type->i_mutex_dir_key#3/1){+.+.}, at: inode_lock_nested include/linux/fs.h:826 [inline] #1: ffff88808db68888 (&type->i_mutex_dir_key#3/1){+.+.}, at: do_unlinkat+0x18b/0x7c0 fs/namei.c:4123 #2: ffff888091d96648 (&sb->s_type->i_mutex_key#10){+.+.}, at: inode_lock include/linux/fs.h:791 [inline] #2: ffff888091d96648 (&sb->s_type->i_mutex_key#10){+.+.}, at: vfs_unlink+0xdc/0x580 fs/namei.c:4064 2 locks held by syz-executor.5/11723: #0: ffff888214572428 (sb_writers#3){.+.+}, at: file_start_write include/linux/fs.h:2885 [inline] #0: ffff888214572428 (sb_writers#3){.+.+}, at: vfs_write+0x24e/0x580 fs/read_write.c:557 #1: ffff888091d96648 (&sb->s_type->i_mutex_key#10){+.+.}, at: inode_lock include/linux/fs.h:791 [inline] #1: ffff888091d96648 (&sb->s_type->i_mutex_key#10){+.+.}, at: ext4_buffered_write_iter+0xa5/0x5c0 fs/ext4/file.c:264 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1029 Comm: khungtaskd Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fb/0x318 lib/dump_stack.c:118 nmi_cpu_backtrace+0xaa/0x190 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x16f/0x290 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x10/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace+0x17/0x20 include/linux/nmi.h:146 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xd40/0xd60 kernel/hung_task.c:289 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 315 Comm: kworker/u4:5 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:check_preemption_disabled+0x1/0x260 lib/smp_processor_id.c:13 Code: cc cc cc cc cc cc cc cc cc 55 48 89 e5 e8 67 2f d4 fd 48 c7 c7 aa 24 e6 88 48 c7 c6 d7 ed ff 88 e8 04 00 00 00 5d c3 66 90 55 <48> 89 e5 41 57 41 56 41 55 41 54 53 50 49 89 f6 49 89 ff e8 37 2f RSP: 0018:ffffc900018c7c30 EFLAGS: 00000293 RAX: ffffffff83a28f99 RBX: ffff88809531acc0 RCX: ffff8880a8a66140 RDX: 0000000000000000 RSI: ffffffff88ffedd7 RDI: ffffffff88e624aa RBP: ffffc900018c7c40 R08: ffffffff87f6c399 R09: ffffed1015d67004 R10: ffffed1015d67004 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff88806ef8cb80 R14: ffff88806ef90000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faaec7a735c CR3: 0000000098256000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:299 [inline] rcu_is_watching+0x20/0xa0 kernel/rcu/tree.c:919 rcu_read_unlock include/linux/rcupdate.h:651 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:411 [inline] batadv_nc_worker+0x225/0x5f0 net/batman-adv/network-coding.c:718 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352