[ 2186]     0  2186    17618     8288      24       3        0             0 syz-executor3
[ 2189]     0  2189    17684     8912      27       4        0             0 syz-executor0
Out of memory: Kill process 27240 (syz-executor5) score 1004 or sacrifice child
Killed process 27240 (syz-executor5) total-vm:70472kB, anon-rss:164kB, file-rss:32768kB, shmem-rss:0kB
oom_reaper: reaped process 27240 (syz-executor5), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
INFO: task init:31860 blocked for more than 140 seconds.
      Not tainted 4.14.87+ #19
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init            D29352 31860      1 0x00000000
Call Trace:
 schedule+0x7f/0x1b0 kernel/sched/core.c:3490
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3548
 __mutex_lock_common kernel/locking/mutex.c:833 [inline]
 __mutex_lock+0x521/0x1480 kernel/locking/mutex.c:893
 tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
 chrdev_open+0x20d/0x570 fs/char_dev.c:417
 do_dentry_open+0x426/0xda0 fs/open.c:764
 vfs_open+0x11c/0x210 fs/open.c:878
 do_last fs/namei.c:3455 [inline]
 path_openat+0x5f9/0x2930 fs/namei.c:3597
 do_filp_open+0x197/0x270 fs/namei.c:3631
 do_sys_open+0x2ef/0x580 fs/open.c:1071
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f576e58d120
RSP: 002b:00007ffeb0cd04b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000e761b0 RCX: 00007f576e58d120
RDX: 0000000000000010 RSI: 0000000000000902 RDI: 00000000004072c8
RBP: 0000000000000000 R08: 0000000000407370 R09: 0000000000000001
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000902
R13: 0000000000000102 R14: 00007ffeb0cd0630 R15: 0000000000e761b8

Showing all locks held in the system:
2 locks held by init/1:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
1 lock held by khungtaskd/23:
 #0:  (tasklist_lock){.+.?}, at: [<ffffffff9ec04947>] debug_show_all_locks+0x74/0x20f kernel/locking/lockdep.c:4541
2 locks held by udevd/190:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
1 lock held by rsyslogd/1631:
 #0:  (&f->f_pos_lock){+.+.}, at: [<ffffffff9efc0f92>] __fdget_pos+0xa2/0xc0 fs/file.c:768
2 locks held by getty/1759:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&ldata->atomic_read_lock){+.+.}, at: [<ffffffff9f73be0f>] n_tty_read+0x1ff/0x1700 drivers/tty/n_tty.c:2156
2 locks held by syz-fuzzer/1783:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
2 locks held by syz-fuzzer/1784:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
2 locks held by syz-fuzzer/1794:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
2 locks held by syz-fuzzer/1795:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
1 lock held by syz-executor5/1849:
 #0:  (&xt[i].mutex){+.+.}, at: [<ffffffff9fe6a375>] xt_find_table_lock+0x35/0x3d0 net/netfilter/x_tables.c:1092
2 locks held by syz-executor1/1851:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
1 lock held by syz-executor2/21520:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f727d0a>] tty_release_struct+0x2a/0x50 drivers/tty/tty_io.c:1605
2 locks held by syz-executor1/22224:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
1 lock held by syz-executor5/27240:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f727d0a>] tty_release_struct+0x2a/0x50 drivers/tty/tty_io.c:1605
2 locks held by syz-executor5/27285:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor5/27324:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor5/27373:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor5/27420:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor5/27476:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor5/27483:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor5/27489:
 #0:  (&tty->ldisc_sem){++++}, at: [<ffffffff9f7409b0>] tty_ldisc_ref_wait+0x20/0x80 drivers/tty/tty_ldisc.c:275
 #1:  (&tty->atomic_write_lock){+.+.}, at: [<ffffffff9f7262eb>] tty_write_lock+0x1b/0x60 drivers/tty/tty_io.c:883
2 locks held by syz-executor0/30990:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
1 lock held by init/31860:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/32048:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/32049:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/32050:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
1 lock held by init/32051:
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open_by_driver drivers/tty/tty_io.c:1927 [inline]
 #0:  (tty_mutex){+.+.}, at: [<ffffffff9f7301a8>] tty_open+0x3a8/0x980 drivers/tty/tty_io.c:2011
2 locks held by syz-executor1/2176:
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9ef76fd5>] pipe_lock_nested fs/pipe.c:67 [inline]
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9ef76fd5>] pipe_lock fs/pipe.c:75 [inline]
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9ef76fd5>] pipe_wait+0x185/0x1b0 fs/pipe.c:123
 #1:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
1 lock held by syz-executor3/2177:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eeec88f>] do_mprotect_pkey mm/mprotect.c:469 [inline]
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eeec88f>] SYSC_mprotect mm/mprotect.c:566 [inline]
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eeec88f>] SyS_mprotect+0x16f/0x610 mm/mprotect.c:563
2 locks held by syz-executor3/2180:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eec4dd6>] __mm_populate+0x206/0x300 mm/gup.c:1247
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
2 locks held by syz-executor0/2189:
 #0:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354
 #1:  (&ei->i_mmap_sem){++++}, at: [<ffffffff9f164b85>] ext4_filemap_fault+0x75/0xb0 fs/ext4/inode.c:6178
2 locks held by syz-executor0/2200:
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9ef76fd5>] pipe_lock_nested fs/pipe.c:67 [inline]
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9ef76fd5>] pipe_lock fs/pipe.c:75 [inline]
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9ef76fd5>] pipe_wait+0x185/0x1b0 fs/pipe.c:123
 #1:  (&mm->mmap_sem){++++}, at: [<ffffffff9eab573d>] __do_page_fault+0x26d/0xb60 arch/x86/mm/fault.c:1354

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 23 Comm: khungtaskd Not tainted 4.14.87+ #19
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 nmi_cpu_backtrace.cold.0+0x47/0x85 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x121/0x146 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:196 [inline]
 watchdog+0x574/0xa70 kernel/hung_task.c:252
 kthread+0x348/0x420 kernel/kthread.c:232
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at pc 0xffffffffa0269772