Bluetooth: hci2 command 0x0406 tx timeout Bluetooth: hci3 command 0x0406 tx timeout Bluetooth: hci1 command 0x0406 tx timeout Bluetooth: hci4 command 0x0406 tx timeout Bluetooth: hci5 command 0x0406 tx timeout INFO: task syz-executor.2:18883 blocked for more than 140 seconds. Not tainted 4.14.256-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29296 18883 8015 0x00000004 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 request_wait_answer+0x30d/0x620 fs/fuse/dev.c:478 __fuse_request_send+0x108/0x1a0 fs/fuse/dev.c:498 fuse_request_send fs/fuse/dev.c:511 [inline] fuse_simple_request+0x2fa/0x790 fs/fuse/dev.c:569 fuse_lookup_name+0x228/0x550 fs/fuse/dir.c:330 fuse_lookup+0xcd/0x390 fs/fuse/dir.c:368 lookup_real fs/namei.c:1555 [inline] __lookup_hash fs/namei.c:1575 [inline] __lookup_hash+0x1bb/0x270 fs/namei.c:1563 filename_create+0x156/0x3f0 fs/namei.c:3675 user_path_create fs/namei.c:3732 [inline] SYSC_mkdirat fs/namei.c:3864 [inline] SyS_mkdirat+0x95/0x270 fs/namei.c:3856 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f0ab94f5af9 RSP: 002b:00007f0ab844a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f0ab9609028 RCX: 00007f0ab94f5af9 RDX: 0000000000000000 RSI: 0000000020004380 RDI: ffffffffffffff9c RBP: 00007f0ab954fff7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd60237b9f R14: 00007f0ab844a300 R15: 0000000000022000 INFO: task syz-executor.2:18910 blocked for more than 140 seconds. Not tainted 4.14.256-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29400 18910 8015 0x00000004 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:588 [inline] rwsem_down_write_failed+0x343/0x6d0 kernel/locking/rwsem-xadd.c:617 call_rwsem_down_write_failed+0x13/0x20 arch/x86/lib/rwsem.S:105 __down_write arch/x86/include/asm/rwsem.h:126 [inline] down_write+0x4f/0x90 kernel/locking/rwsem.c:56 inode_lock include/linux/fs.h:719 [inline] fuse_reverse_inval_entry+0x99/0x5e0 fs/fuse/dir.c:972 fuse_notify_delete fs/fuse/dev.c:1578 [inline] fuse_notify fs/fuse/dev.c:1812 [inline] fuse_dev_do_write+0x1f22/0x25c0 fs/fuse/dev.c:1887 fuse_dev_write+0x125/0x1a0 fs/fuse/dev.c:1971 call_write_iter include/linux/fs.h:1778 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x44c/0x630 fs/read_write.c:482 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f0ab94f5af9 RSP: 002b:00007f0ab8429188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f0ab96090f0 RCX: 00007f0ab94f5af9 RDX: 0000000000000029 RSI: 00000000200043c0 RDI: 0000000000000003 RBP: 00007f0ab954fff7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd60237b9f R14: 00007f0ab8429300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1533: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548 1 lock held by in:imklog/7712: #0: (&f->f_pos_lock){+.+.}, at: [] __fdget_pos+0x1fb/0x2b0 fs/file.c:769 3 locks held by syz-executor.2/18883: #0: (sb_writers#17){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#17){.+.+}, at: [] mnt_want_write+0x3a/0xb0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#9/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#9/1){+.+.}, at: [] filename_create+0x12a/0x3f0 fs/namei.c:3674 #2: (&fi->mutex){+.+.}, at: [] fuse_lock_inode+0xb0/0xe0 fs/fuse/inode.c:365 2 locks held by syz-executor.2/18910: #0: (&fc->killsb){++++}, at: [] fuse_notify_inval_entry fs/fuse/dev.c:1525 [inline] #0: (&fc->killsb){++++}, at: [] fuse_notify fs/fuse/dev.c:1803 [inline] #0: (&fc->killsb){++++}, at: [] fuse_dev_do_write+0xc80/0x25c0 fs/fuse/dev.c:1887 #1: (&type->i_mutex_dir_key#10){++++}, at: [] inode_lock include/linux/fs.h:719 [inline] #1: (&type->i_mutex_dir_key#10){++++}, at: [] fuse_reverse_inval_entry+0x99/0x5e0 fs/fuse/dir.c:972 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1533 Comm: khungtaskd Not tainted 4.14.256-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x5b9/0xb40 kernel/hung_task.c:274 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 skipped: idling at pc 0xffffffff8723c75e