INFO: task syz-executor.5:15232 blocked for more than 143 seconds. Not tainted 5.7.0-rc6-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D29048 15232 380 0x80004006 Call Trace: context_switch kernel/sched/core.c:3367 [inline] __schedule+0x892/0x1d80 kernel/sched/core.c:4083 locks_remove_posix+0x277/0x4e0 fs/locks.c:2706 __sched_text_start+0x8/0x8 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] prepare_to_wait_event+0x129/0x650 kernel/sched/wait.c:305 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 schedule+0xcd/0x2b0 kernel/sched/core.c:4158 wdm_flush+0x2ea/0x3c0 drivers/usb/class/cdc-wdm.c:590 wdm_poll+0x280/0x280 include/linux/poll.h:50 finish_wait+0x260/0x260 include/linux/list.h:301 task_work_add+0x97/0x120 kernel/task_work.c:35 wdm_poll+0x280/0x280 include/linux/poll.h:50 filp_close+0xb4/0x170 fs/open.c:1251 close_files fs/file.c:388 [inline] put_files_struct fs/file.c:416 [inline] put_files_struct+0x1d8/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb36/0x2c80 kernel/exit.c:791 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 mm_update_next_owner+0x7a0/0x7a0 kernel/exit.c:375 lock_downgrade+0x720/0x720 kernel/locking/lockdep.c:4599 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x480/0x2480 kernel/signal.c:2739 trace_kfree include/trace/events/kmem.h:138 [inline] kfree+0x2a2/0x300 mm/slub.c:4010 do_signal+0x88/0x1ae0 arch/x86/kernel/signal.c:784 finish_wait+0x260/0x260 include/linux/list.h:301 force_valid_ss arch/x86/kernel/signal.c:73 [inline] restore_sigcontext+0x620/0x620 arch/x86/kernel/signal.c:134 wdm_probe+0x2d0/0x2d0 drivers/usb/class/cdc-wdm.c:925 __vfs_write+0x7e/0x100 fs/read_write.c:495 vfs_write+0x161/0x5d0 fs/read_write.c:555 fput_many+0x2f/0x1a0 fs/file_table.c:336 ksys_write+0x1a5/0x250 fs/read_write.c:618 __ia32_sys_read+0xb0/0xb0 fs/read_write.c:596 exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 INFO: task syz-executor.2:15235 blocked for more than 143 seconds. Not tainted 5.7.0-rc6-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D28816 15235 370 0x80004006 Call Trace: context_switch kernel/sched/core.c:3367 [inline] __schedule+0x892/0x1d80 kernel/sched/core.c:4083 locks_remove_posix+0x277/0x4e0 fs/locks.c:2706 __sched_text_start+0x8/0x8 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] prepare_to_wait_event+0x129/0x650 kernel/sched/wait.c:305 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 schedule+0xcd/0x2b0 kernel/sched/core.c:4158 wdm_flush+0x2ea/0x3c0 drivers/usb/class/cdc-wdm.c:590 wdm_poll+0x280/0x280 include/linux/poll.h:50 finish_wait+0x260/0x260 include/linux/list.h:301 task_work_add+0x97/0x120 kernel/task_work.c:35 wdm_poll+0x280/0x280 include/linux/poll.h:50 filp_close+0xb4/0x170 fs/open.c:1251 close_files fs/file.c:388 [inline] put_files_struct fs/file.c:416 [inline] put_files_struct+0x1d8/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb36/0x2c80 kernel/exit.c:791 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 mm_update_next_owner+0x7a0/0x7a0 kernel/exit.c:375 lock_downgrade+0x720/0x720 kernel/locking/lockdep.c:4599 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x480/0x2480 kernel/signal.c:2739 down_interruptible+0x4b/0x80 kernel/locking/semaphore.c:85 do_signal+0x88/0x1ae0 arch/x86/kernel/signal.c:784 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 __trace_hardirqs_on_caller kernel/locking/lockdep.c:3657 [inline] lockdep_hardirqs_on+0x3c7/0x5d0 kernel/locking/lockdep.c:3702 force_valid_ss arch/x86/kernel/signal.c:73 [inline] restore_sigcontext+0x620/0x620 arch/x86/kernel/signal.c:134 down_interruptible+0x4b/0x80 kernel/locking/semaphore.c:85 raw_ioctl+0x11f/0x2570 drivers/usb/gadget/legacy/raw_gadget.c:1261 ksys_dup3+0x3c0/0x3c0 include/linux/compiler.h:199 raw_open+0x4d0/0x4d0 include/linux/semaphore.h:34 down_read_nested+0x430/0x430 include/linux/compiler.h:199 exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 INFO: task syz-executor.3:15236 blocked for more than 143 seconds. Not tainted 5.7.0-rc6-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28816 15236 371 0x80004006 Call Trace: context_switch kernel/sched/core.c:3367 [inline] __schedule+0x892/0x1d80 kernel/sched/core.c:4083 locks_remove_posix+0x277/0x4e0 fs/locks.c:2706 __sched_text_start+0x8/0x8 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] prepare_to_wait_event+0x129/0x650 kernel/sched/wait.c:305 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 schedule+0xcd/0x2b0 kernel/sched/core.c:4158 wdm_flush+0x2ea/0x3c0 drivers/usb/class/cdc-wdm.c:590 wdm_poll+0x280/0x280 include/linux/poll.h:50 finish_wait+0x260/0x260 include/linux/list.h:301 task_work_add+0x97/0x120 kernel/task_work.c:35 wdm_poll+0x280/0x280 include/linux/poll.h:50 filp_close+0xb4/0x170 fs/open.c:1251 close_files fs/file.c:388 [inline] put_files_struct fs/file.c:416 [inline] put_files_struct+0x1d8/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb36/0x2c80 kernel/exit.c:791 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 mm_update_next_owner+0x7a0/0x7a0 kernel/exit.c:375 lock_downgrade+0x720/0x720 kernel/locking/lockdep.c:4599 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x480/0x2480 kernel/signal.c:2739 down_interruptible+0x4b/0x80 kernel/locking/semaphore.c:85 do_signal+0x88/0x1ae0 arch/x86/kernel/signal.c:784 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 __trace_hardirqs_on_caller kernel/locking/lockdep.c:3657 [inline] lockdep_hardirqs_on+0x3c7/0x5d0 kernel/locking/lockdep.c:3702 force_valid_ss arch/x86/kernel/signal.c:73 [inline] restore_sigcontext+0x620/0x620 arch/x86/kernel/signal.c:134 down_interruptible+0x4b/0x80 kernel/locking/semaphore.c:85 raw_ioctl+0x11f/0x2570 drivers/usb/gadget/legacy/raw_gadget.c:1261 ksys_dup3+0x3c0/0x3c0 include/linux/compiler.h:199 raw_open+0x4d0/0x4d0 include/linux/semaphore.h:34 down_read_nested+0x430/0x430 include/linux/compiler.h:199 exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 INFO: task syz-executor.0:15262 blocked for more than 143 seconds. Not tainted 5.7.0-rc6-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28768 15262 372 0x80004006 Call Trace: context_switch kernel/sched/core.c:3367 [inline] __schedule+0x892/0x1d80 kernel/sched/core.c:4083 locks_remove_posix+0x277/0x4e0 fs/locks.c:2706 __sched_text_start+0x8/0x8 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] prepare_to_wait_event+0x129/0x650 kernel/sched/wait.c:305 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 schedule+0xcd/0x2b0 kernel/sched/core.c:4158 wdm_flush+0x2ea/0x3c0 drivers/usb/class/cdc-wdm.c:590 wdm_poll+0x280/0x280 include/linux/poll.h:50 finish_wait+0x260/0x260 include/linux/list.h:301 task_work_add+0x97/0x120 kernel/task_work.c:35 wdm_poll+0x280/0x280 include/linux/poll.h:50 filp_close+0xb4/0x170 fs/open.c:1251 close_files fs/file.c:388 [inline] put_files_struct fs/file.c:416 [inline] put_files_struct+0x1d8/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb36/0x2c80 kernel/exit.c:791 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 mm_update_next_owner+0x7a0/0x7a0 kernel/exit.c:375 lock_downgrade+0x720/0x720 kernel/locking/lockdep.c:4599 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x480/0x2480 kernel/signal.c:2739 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 __might_fault mm/memory.c:4814 [inline] __might_fault+0x11f/0x1d0 mm/memory.c:4799 do_signal+0x88/0x1ae0 arch/x86/kernel/signal.c:784 __might_fault mm/memory.c:4814 [inline] __might_fault+0x190/0x1d0 mm/memory.c:4799 force_valid_ss arch/x86/kernel/signal.c:73 [inline] restore_sigcontext+0x620/0x620 arch/x86/kernel/signal.c:134 _copy_to_user+0x126/0x160 lib/usercopy.c:31 __do_sys_futex kernel/futex.c:3869 [inline] __se_sys_futex kernel/futex.c:3837 [inline] __x64_sys_futex+0x380/0x4f0 kernel/futex.c:3837 do_futex+0x1ae0/0x1ae0 include/linux/list.h:70 __do_sys_clock_gettime kernel/time/posix-timers.c:1094 [inline] __se_sys_clock_gettime kernel/time/posix-timers.c:1082 [inline] __x64_sys_clock_gettime+0x165/0x240 kernel/time/posix-timers.c:1082 exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 INFO: task syz-executor.1:15267 blocked for more than 144 seconds. Not tainted 5.7.0-rc6-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D28552 15267 375 0x80004004 Call Trace: context_switch kernel/sched/core.c:3367 [inline] __schedule+0x892/0x1d80 kernel/sched/core.c:4083 locks_remove_posix+0x277/0x4e0 fs/locks.c:2706 __sched_text_start+0x8/0x8 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] prepare_to_wait_event+0x129/0x650 kernel/sched/wait.c:305 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0x39/0x40 kernel/locking/spinlock.c:191 schedule+0xcd/0x2b0 kernel/sched/core.c:4158 wdm_flush+0x2ea/0x3c0 drivers/usb/class/cdc-wdm.c:590 wdm_poll+0x280/0x280 include/linux/poll.h:50 finish_wait+0x260/0x260 include/linux/list.h:301 spin_unlock include/linux/spinlock.h:393 [inline] task_unlock include/linux/sched/task.h:180 [inline] exit_files+0x76/0xa0 fs/file.c:444 wdm_poll+0x280/0x280 include/linux/poll.h:50 filp_close+0xb4/0x170 fs/open.c:1251 close_files fs/file.c:388 [inline] put_files_struct fs/file.c:416 [inline] put_files_struct+0x1d8/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb36/0x2c80 kernel/exit.c:791 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 mm_update_next_owner+0x7a0/0x7a0 kernel/exit.c:375 lock_downgrade+0x720/0x720 kernel/locking/lockdep.c:4599 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x480/0x2480 kernel/signal.c:2739 find_held_lock+0x2d/0x110 kernel/locking/lockdep.c:4458 do_signal+0x88/0x1ae0 arch/x86/kernel/signal.c:784 lock_downgrade+0x720/0x720 kernel/locking/lockdep.c:4599 __might_fault mm/memory.c:4814 [inline] __might_fault+0x190/0x1d0 mm/memory.c:4799 _copy_from_user+0x13c/0x1a0 lib/usercopy.c:18 get_timespec64+0x11a/0x190 kernel/time/time.c:800 force_valid_ss arch/x86/kernel/signal.c:73 [inline] restore_sigcontext+0x620/0x620 arch/x86/kernel/signal.c:134 __trace_hardirqs_on_caller kernel/locking/lockdep.c:3657 [inline] lockdep_hardirqs_on+0x3c7/0x5d0 kernel/locking/lockdep.c:3702 ktime_get kernel/time/timekeeping.c:763 [inline] ktime_get+0x15d/0x1c0 kernel/time/timekeeping.c:747 __do_sys_futex kernel/futex.c:3869 [inline] __se_sys_futex kernel/futex.c:3837 [inline] __x64_sys_futex+0x380/0x4f0 kernel/futex.c:3837 do_futex+0x1ae0/0x1ae0 include/linux/list.h:70 exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x4e0/0x5a0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Showing all locks held in the system: 1 lock held by khungtaskd/23: #0: ffffffff87111260 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x264 kernel/locking/lockdep.c:5754 1 lock held by in:imklog/262: #0: ffff8881c7d53770 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:826 2 locks held by agetty/272: #0: ffff8881d69ba098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc900009be2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x220/0x1b30 drivers/tty/n_tty.c:2156 2 locks held by agetty/7106: #0: ffff8881c6967098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:267 #1: ffffc9000fdb22e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x220/0x1b30 drivers/tty/n_tty.c:2156 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 23 Comm: khungtaskd Not tainted 5.7.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xef/0x16e lib/dump_stack.c:118 irq_force_complete_move.cold+0x13/0x47 arch/x86/kernel/apic/vector.c:1023 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101 lapic_can_unplug_cpu.cold+0x3b/0x3b nmi_trigger_cpumask_backtrace+0x1db/0x207 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xa99/0xfd0 kernel/hung_task.c:289 reset_hung_task_detector+0x30/0x30 kernel/hung_task.c:243 kthread+0x326/0x430 kernel/kthread.c:268 kthread_create_on_node+0xf0/0xf0 kernel/kthread.c:405 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline] NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline] NMI backtrace for cpu 1 skipped: idling at default_idle+0x28/0x300 arch/x86/kernel/process.c:697