FAT-fs (loop2): Can't find a valid FAT filesystem netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. FAT-fs (loop2): bogus number of reserved sectors FAT-fs (loop2): Can't find a valid FAT filesystem INFO: task syz-executor.3:9056 blocked for more than 140 seconds. Not tainted 4.19.89-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D23592 9056 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2826 [inline] __schedule+0x866/0x1dc0 kernel/sched/core.c:3515 schedule+0x92/0x1c0 kernel/sched/core.c:3559 __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:589 [inline] rwsem_down_write_failed+0x774/0xc30 kernel/locking/rwsem-xadd.c:618 call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117 __down_write arch/x86/include/asm/rwsem.h:142 [inline] down_write+0x53/0x90 kernel/locking/rwsem.c:72 inode_lock include/linux/fs.h:747 [inline] vfs_unlink+0xd1/0x500 fs/namei.c:3990 do_unlinkat+0x3f7/0x6d0 fs/namei.c:4062 __do_sys_unlink fs/namei.c:4109 [inline] __se_sys_unlink fs/namei.c:4107 [inline] __x64_sys_unlink+0x42/0x50 fs/namei.c:4107 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a657 Code: Bad RIP value. RSP: 002b:00007ffd20013958 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045a657 RDX: 00007ffd20013970 RSI: 00007ffd20013970 RDI: 00007ffd20013a00 RBP: 00000000000000c6 R08: 0000000000000000 R09: 0000000000000008 R10: 0000000000000003 R11: 0000000000000246 R12: 00007ffd20014a90 R13: 0000000002073940 R14: 0000000000000000 R15: 00007ffd20014a90 Showing all locks held in the system: 1 lock held by khungtaskd/1068: #0: 000000002b9cb41c (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:4438 1 lock held by rsyslogd/7545: #0: 00000000d41f69ee (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:767 2 locks held by getty/7667: #0: 0000000020cece1e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 0000000087045478 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7668: #0: 00000000f38e6214 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 00000000b5e31eec (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7669: #0: 0000000023140e52 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 0000000025a878bf (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7670: #0: 00000000107bdadf (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 000000002be43aae (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7671: #0: 000000004702ee33 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 00000000242a6a51 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7672: #0: 00000000a22cb261 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 000000002d7df52e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 2 locks held by getty/7673: #0: 00000000b2eb027c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:362 #1: 0000000014086a92 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2154 3 locks held by syz-executor.3/9056: #0: 00000000c1182e1f (sb_writers#4){.+.+}, at: sb_start_write include/linux/fs.h:1578 [inline] #0: 00000000c1182e1f (sb_writers#4){.+.+}, at: mnt_want_write+0x3f/0xc0 fs/namespace.c:360 #1: 000000000b77402e (&type->i_mutex_dir_key#3/1){+.+.}, at: inode_lock_nested include/linux/fs.h:782 [inline] #1: 000000000b77402e (&type->i_mutex_dir_key#3/1){+.+.}, at: do_unlinkat+0x29f/0x6d0 fs/namei.c:4048 #2: 000000008360530b (&sb->s_type->i_mutex_key#9){++++}, at: inode_lock include/linux/fs.h:747 [inline] #2: 000000008360530b (&sb->s_type->i_mutex_key#9){++++}, at: vfs_unlink+0xd1/0x500 fs/namei.c:3990 2 locks held by syz-executor.3/12431: #0: 00000000c1182e1f (sb_writers#4){.+.+}, at: file_start_write include/linux/fs.h:2775 [inline] #0: 00000000c1182e1f (sb_writers#4){.+.+}, at: vfs_write+0x429/0x560 fs/read_write.c:548 #1: 000000008360530b (&sb->s_type->i_mutex_key#9){++++}, at: inode_trylock include/linux/fs.h:767 [inline] #1: 000000008360530b (&sb->s_type->i_mutex_key#9){++++}, at: ext4_file_write_iter+0x23f/0x1060 fs/ext4/file.c:236 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1068 Comm: khungtaskd Not tainted 4.19.89-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1b0/0x1f8 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x9df/0xee0 kernel/hung_task.c:287 kthread+0x354/0x420 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 11276 Comm: kworker/u4:6 Not tainted 4.19.89-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: writeback wb_workfn (flush-8:0) RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:22 [inline] RIP: 0010:rcu_dynticks_curr_cpu_in_eqs+0x73/0xb0 kernel/rcu/tree.c:350 Code: 4c 89 e7 e8 ef 48 49 00 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 04 <84> d2 75 14 8b 43 10 48 83 c4 08 5b 41 5c 5d d1 e8 83 f0 01 83 e0 RSP: 0018:ffff8880523ef858 EFLAGS: 00000206 RAX: 0000000000000003 RBX: ffff8880ae923980 RCX: ffffffff81597f81 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880ae923990 RBP: ffff8880523ef870 R08: 1ffff11015d24732 R09: ffffed1015d24733 R10: ffffed1015d24732 R11: ffff8880ae923993 R12: ffff8880ae923990 R13: ffffed100659cad7 R14: dffffc0000000000 R15: ffff88805330aa18 FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 00000000566b4000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rcu_is_watching+0x10/0x30 kernel/rcu/tree.c:1025 rcu_read_lock_sched include/linux/rcupdate.h:742 [inline] percpu_ref_put_many include/linux/percpu-refcount.h:279 [inline] percpu_ref_put include/linux/percpu-refcount.h:300 [inline] wb_put include/linux/backing-dev-defs.h:271 [inline] locked_inode_to_wb_and_lock_list+0x50b/0x980 fs/fs-writeback.c:301 inode_to_wb_and_lock_list fs/fs-writeback.c:323 [inline] writeback_sb_inodes+0x636/0xe90 fs/fs-writeback.c:1657 __writeback_inodes_wb+0xc3/0x260 fs/fs-writeback.c:1703 wb_writeback+0x872/0xcf0 fs/fs-writeback.c:1812 wb_check_background_flush fs/fs-writeback.c:1880 [inline] wb_do_writeback fs/fs-writeback.c:1968 [inline] wb_workfn+0xa2e/0x1190 fs/fs-writeback.c:1996 process_one_work+0x989/0x1750 kernel/workqueue.c:2153 worker_thread+0x98/0xe40 kernel/workqueue.c:2296 kthread+0x354/0x420 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415