INFO: task syz-executor5:21168 blocked for more than 140 seconds. Not tainted 4.9.124+ #32 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor5 D27928 21168 2311 0x00000004 ffff8801ba3d2f80 ffff8801d2ddbc80 ffff8801a8c81080 ffff8801b9ef5f00 ffff8801db6210d8 ffff8801a9c3fa40 ffffffff8277c942 ffff8801a9c3fa18 ffffffff81201f37 0000000000000000 00ff8801ba3d3828 ffff8801db6219b0 Call Trace: [] schedule+0x7f/0x1b0 kernel/sched/core.c:3553 [] __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:526 [inline] [] rwsem_down_write_failed+0x336/0x5a0 kernel/locking/rwsem-xadd.c:555 [] call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105 [] __down_write arch/x86/include/asm/rwsem.h:125 [inline] [] down_write+0x5c/0xa0 kernel/locking/rwsem.c:54 [] inode_lock include/linux/fs.h:766 [inline] [] lock_mount+0x8c/0x2c0 fs/namespace.c:2101 [] do_add_mount+0x27/0x330 fs/namespace.c:2484 [] do_new_mount fs/namespace.c:2551 [inline] [] do_mount+0x1330/0x2790 fs/namespace.c:2859 [] SYSC_mount fs/namespace.c:3075 [inline] [] SyS_mount+0xea/0x100 fs/namespace.c:3052 [] do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Showing all locks held in the system: 2 locks held by khungtaskd/24: #0: (rcu_read_lock){......}, at: [] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 kernel/hung_task.c:239 #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336 2 locks held by getty/2220: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142 1 lock held by syz-executor5/21168: #0: (&type->i_mutex_dir_key#4){++++++}, at: [] inode_lock include/linux/fs.h:766 [inline] #0: (&type->i_mutex_dir_key#4){++++++}, at: [] lock_mount+0x8c/0x2c0 fs/namespace.c:2101 1 lock held by syz-executor5/21197: #0: (&type->i_mutex_dir_key#4){++++++}, at: [] inode_lock_shared include/linux/fs.h:776 [inline] #0: (&type->i_mutex_dir_key#4){++++++}, at: [] lookup_slow+0x154/0x470 fs/namei.c:1645 2 locks held by syz-executor5/21247: #0: (sb_writers#13){.+.+.+}, at: [] sb_start_write include/linux/fs.h:1573 [inline] #0: (sb_writers#13){.+.+.+}, at: [] mnt_want_write+0x3f/0xb0 fs/namespace.c:391 #1: (&type->i_mutex_dir_key#4){++++++}, at: [] inode_lock include/linux/fs.h:766 [inline] #1: (&type->i_mutex_dir_key#4){++++++}, at: [] do_last fs/namei.c:3312 [inline] #1: (&type->i_mutex_dir_key#4){++++++}, at: [] path_openat+0xf13/0x2790 fs/namei.c:3534 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.124+ #32 ffff8801d9497d08 ffffffff81af4529 0000000000000000 0000000000000001 0000000000000001 0000000000000001 ffffffff81096740 ffff8801d9497d40 ffffffff81aff287 0000000000000001 0000000000000000 0000000000000003 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99 [] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60 [] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [] check_hung_task kernel/hung_task.c:125 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [] watchdog+0x6ad/0xa20 kernel/hung_task.c:239 [] kthread+0x26d/0x300 kernel/kthread.c:211 [] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 21181 Comm: syz-executor5 Not tainted 4.9.124+ #32 task: ffff8801d6d72f80 task.stack: ffff8801b12f8000 RIP: 0010:[] c [] get_current arch/x86/include/asm/current.h:14 [inline] RIP: 0010:[] c [] __sanitizer_cov_trace_pc+0xd/0x50 kernel/kcov.c:99 RSP: 0018:ffff8801b12ff490 EFLAGS: 00000246 RAX: ffff8801d6d72f80 RBX: ffff8801d1d86db0 RCX: 00000000000052bd RDX: 1ffff1003adae693 RSI: 0000000000000000 RDI: ffff8801d6d73498 RBP: ffff8801b12ff490 R08: ffff8801d6d73830 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffed003a3b0dbc R13: dffffc0000000000 R14: ffffffff83fe9ae0 R15: ffff8801d1d86de0 FS: 00007fd8db057700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f678ffe7140 CR3: 00000001c2b2a000 CR4: 00000000001606b0 DR0: 00000000200001c0 DR1: 00000000200001c0 DR2: 0000000020000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Stack: ffff8801b12ff570c ffffffff8183107ec ffff8801b12ff558c 1ffff1003625fe99c fffffbfff07fd35cc ffff8801d1d86e80c ffff8801b12ff4e8c 0000000041b58ab3c ffffffff82c29369c ffffffff81830ee0c ffff8801b12ff528c ffffffff00000000c Call Trace: [] request_wait_answer+0x19e/0x6f0 fs/fuse/dev.c:459 [] __fuse_request_send+0x109/0x1b0 fs/fuse/dev.c:480 [] fuse_request_send+0x5d/0x70 fs/fuse/dev.c:493 [] fuse_simple_request+0x2f4/0x660 fs/fuse/dev.c:551 [] fuse_lookup_name+0x253/0x5d0 fs/fuse/dir.c:369 [] fuse_lookup+0xed/0x3a0 fs/fuse/dir.c:406 [] fuse_atomic_open+0x1bf/0x2d0 fs/fuse/dir.c:545 [] atomic_open fs/namei.c:3055 [inline] [] lookup_open+0xe3c/0x18b0 fs/namei.c:3194 [] do_last fs/namei.c:3315 [inline] [] path_openat+0xf3d/0x2790 fs/namei.c:3534 [] do_filp_open+0x197/0x270 fs/namei.c:3568 [] do_sys_open+0x30d/0x5c0 fs/open.c:1072 [] SYSC_open fs/open.c:1090 [inline] [] SyS_open fs/open.c:1085 [inline] [] SYSC_creat fs/open.c:1110 [inline] [] SyS_creat+0x27/0x30 fs/open.c:1108 [] do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: c5f cff cff cff c48 c89 cdf ce8 c72 c94 c1d c00 ce9 cf9 cfe cff cff c66 c2e c0f c1f c84 c00 c00 c00 c00 c00 c0f c1f c00 c55 c48 c89 ce5 c65 c48 c8b c04 c25 cc0 c7d c01 c00 c<65> c8b c15 c0c cb5 cd0 c7e c81 ce2 c00 c01 c1f c00 c48 c8b c75 c08 c75 c2b c8b c90 c