INFO: task syz-executor.4:15379 blocked for more than 143 seconds. Not tainted 5.15.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:29256 pid:15379 ppid: 13976 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xb44/0x5960 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107 __down_write_common kernel/locking/rwsem.c:1262 [inline] __down_write_common kernel/locking/rwsem.c:1259 [inline] __down_write kernel/locking/rwsem.c:1271 [inline] down_write+0x137/0x150 kernel/locking/rwsem.c:1518 inode_lock include/linux/fs.h:786 [inline] open_last_lookups fs/namei.c:3349 [inline] path_openat+0x941/0x2740 fs/namei.c:3558 do_filp_open+0x1aa/0x400 fs/namei.c:3588 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200 do_sys_open fs/open.c:1216 [inline] __do_sys_open fs/open.c:1224 [inline] __se_sys_open fs/open.c:1220 [inline] __x64_sys_open+0x119/0x1c0 fs/open.c:1220 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc1cba6fae9 RSP: 002b:00007fc1c8fa3188 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007fc1cbb830e0 RCX: 00007fc1cba6fae9 RDX: 0000000000000000 RSI: 0000000000141042 RDI: 0000000020000000 RBP: 00007fc1cbac9f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc0c95144f R14: 00007fc1c8fa3300 R15: 0000000000022000 INFO: task syz-executor.4:15384 blocked for more than 144 seconds. Not tainted 5.15.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:28280 pid:15384 ppid: 13976 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xb44/0x5960 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 rwsem_down_read_slowpath+0x4c5/0x990 kernel/locking/rwsem.c:993 __down_read_common kernel/locking/rwsem.c:1214 [inline] __down_read kernel/locking/rwsem.c:1223 [inline] down_read+0xe4/0x440 kernel/locking/rwsem.c:1466 inode_lock_shared include/linux/fs.h:796 [inline] lookup_slow fs/namei.c:1673 [inline] walk_component+0x400/0x6a0 fs/namei.c:1970 lookup_last fs/namei.c:2425 [inline] path_lookupat+0x1bb/0x860 fs/namei.c:2449 filename_lookup+0x1c6/0x590 fs/namei.c:2478 user_path_at_empty+0x42/0x60 fs/namei.c:2801 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3328 [inline] __do_sys_mount fs/namespace.c:3539 [inline] __se_sys_mount fs/namespace.c:3516 [inline] __x64_sys_mount+0x1ea/0x300 fs/namespace.c:3516 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc1cba6fae9 RSP: 002b:00007fc1c8f82188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fc1cbb831a0 RCX: 00007fc1cba6fae9 RDX: 0000000020000240 RSI: 0000000020000200 RDI: 0000000000000000 RBP: 00007fc1cbac9f25 R08: 0000000020000280 R09: 0000000000000000 R10: 0000000000284001 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc0c95144f R14: 00007fc1c8f82300 R15: 0000000000022000 INFO: task syz-executor.4:15395 blocked for more than 145 seconds. Not tainted 5.15.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:29504 pid:15395 ppid: 13976 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xb44/0x5960 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 rwsem_down_read_slowpath+0x4c5/0x990 kernel/locking/rwsem.c:993 __down_read_common kernel/locking/rwsem.c:1214 [inline] __down_read kernel/locking/rwsem.c:1223 [inline] down_read+0xe4/0x440 kernel/locking/rwsem.c:1466 inode_lock_shared include/linux/fs.h:796 [inline] lookup_slow fs/namei.c:1673 [inline] walk_component+0x400/0x6a0 fs/namei.c:1970 lookup_last fs/namei.c:2425 [inline] path_lookupat+0x1bb/0x860 fs/namei.c:2449 filename_lookup+0x1c6/0x590 fs/namei.c:2478 user_path_at_empty+0x42/0x60 fs/namei.c:2801 user_path_at include/linux/namei.h:57 [inline] __do_sys_chdir fs/open.c:489 [inline] __se_sys_chdir fs/open.c:483 [inline] __x64_sys_chdir+0xb7/0x260 fs/open.c:483 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc1cba6fae9 RSP: 002b:00007fc1c8f61188 EFLAGS: 00000246 ORIG_RAX: 0000000000000050 RAX: ffffffffffffffda RBX: 00007fc1cbb83260 RCX: 00007fc1cba6fae9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 RBP: 00007fc1cbac9f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc0c95144f R14: 00007fc1c8f61300 R15: 0000000000022000 INFO: task syz-executor.4:15397 blocked for more than 145 seconds. Not tainted 5.15.0-rc7-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:28856 pid:15397 ppid: 13976 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0xb44/0x5960 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107 __down_write_common kernel/locking/rwsem.c:1262 [inline] __down_write_common kernel/locking/rwsem.c:1259 [inline] __down_write kernel/locking/rwsem.c:1271 [inline] down_write+0x137/0x150 kernel/locking/rwsem.c:1518 inode_lock include/linux/fs.h:786 [inline] open_last_lookups fs/namei.c:3349 [inline] path_openat+0x941/0x2740 fs/namei.c:3558 do_filp_open+0x1aa/0x400 fs/namei.c:3588 do_sys_openat2+0x16d/0x4d0 fs/open.c:1200 do_sys_open fs/open.c:1216 [inline] __do_sys_creat fs/open.c:1290 [inline] __se_sys_creat fs/open.c:1284 [inline] __x64_sys_creat+0xc9/0x120 fs/open.c:1284 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc1cba6fae9 RSP: 002b:00007fc1c8f40188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007fc1cbb83320 RCX: 00007fc1cba6fae9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 RBP: 00007fc1cbac9f25 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc0c95144f R14: 00007fc1c8f40300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8b981b20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446 1 lock held by in:imklog/6397: #0: ffff88807c2400f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 3 locks held by kworker/u4:10/17764: 1 lock held by systemd-udevd/18254: 1 lock held by systemd-udevd/18795: 3 locks held by syz-executor.4/15376: 2 locks held by syz-executor.4/15379: #0: ffff888082428460 (sb_writers#21){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:3341 [inline] #0: ffff888082428460 (sb_writers#21){.+.+}-{0:0}, at: path_openat+0x25c9/0x2740 fs/namei.c:3558 #1: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: open_last_lookups fs/namei.c:3349 [inline] #1: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: path_openat+0x941/0x2740 fs/namei.c:3558 1 lock held by syz-executor.4/15384: #0: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:796 [inline] #0: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: lookup_slow fs/namei.c:1673 [inline] #0: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: walk_component+0x400/0x6a0 fs/namei.c:1970 1 lock held by syz-executor.4/15395: #0: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: inode_lock_shared include/linux/fs.h:796 [inline] #0: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: lookup_slow fs/namei.c:1673 [inline] #0: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: walk_component+0x400/0x6a0 fs/namei.c:1970 2 locks held by syz-executor.4/15397: #0: ffff888082428460 (sb_writers#21){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:3341 [inline] #0: ffff888082428460 (sb_writers#21){.+.+}-{0:0}, at: path_openat+0x25c9/0x2740 fs/namei.c:3558 #1: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: inode_lock include/linux/fs.h:786 [inline] #1: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: open_last_lookups fs/namei.c:3349 [inline] #1: ffff88806ea28190 (&type->i_mutex_dir_key#12){++++}-{3:3}, at: path_openat+0x941/0x2740 fs/namei.c:3558 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc1d/0xf50 kernel/hung_task.c:295 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 17764 Comm: kworker/u4:10 Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:__lock_acquire+0x1ec/0x54a0 kernel/locking/lockdep.c:4925 Code: f6 4c 8d 24 c5 00 00 00 00 74 4a 4a 8d 4c 21 d8 48 be 00 00 00 00 00 fc ff df 48 8d 79 20 49 89 f8 49 c1 e8 03 41 0f b6 34 30 <40> 84 f6 74 0a 40 80 fe 03 0f 8e 94 3b 00 00 0f b7 71 20 81 e6 ff RSP: 0018:ffffc9000312f9f0 EFLAGS: 00000012 RAX: 000000000000000a RBX: ffffffff8b981b20 RCX: ffff88807e4e4348 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807e4e4368 RBP: 0000000000000000 R08: 1ffff1100fc9c86d R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000050 R13: ffff88807e4e3900 R14: 0000000000000002 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb07fcbb000 CR3: 000000000b68e000 CR4: 0000000000350ef0 Call Trace: lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 rcu_lock_acquire include/linux/rcupdate.h:267 [inline] rcu_read_lock include/linux/rcupdate.h:687 [inline] batadv_nc_process_nc_paths.part.0+0xec/0x3c0 net/batman-adv/network-coding.c:691 batadv_nc_process_nc_paths net/batman-adv/network-coding.c:683 [inline] batadv_nc_worker+0xc46/0xfa0 net/batman-adv/network-coding.c:732 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: f6 4c 8d 24 c5 testb $0xc5,0x24(%rbp,%rcx,4) 5: 00 00 add %al,(%rax) 7: 00 00 add %al,(%rax) 9: 74 4a je 0x55 b: 4a 8d 4c 21 d8 lea -0x28(%rcx,%r12,1),%rcx 10: 48 be 00 00 00 00 00 movabs $0xdffffc0000000000,%rsi 17: fc ff df 1a: 48 8d 79 20 lea 0x20(%rcx),%rdi 1e: 49 89 f8 mov %rdi,%r8 21: 49 c1 e8 03 shr $0x3,%r8 25: 41 0f b6 34 30 movzbl (%r8,%rsi,1),%esi * 2a: 40 84 f6 test %sil,%sil <-- trapping instruction 2d: 74 0a je 0x39 2f: 40 80 fe 03 cmp $0x3,%sil 33: 0f 8e 94 3b 00 00 jle 0x3bcd 39: 0f b7 71 20 movzwl 0x20(%rcx),%esi 3d: 81 .byte 0x81 3e: e6 ff out %al,$0xff