INFO: task syz-executor.4:3178 blocked for more than 143 seconds. Not tainted 6.4.0-rc7-syzkaller-00204-g61dabacdad4e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:24440 pid:3178 ppid:5027 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5343 [inline] __schedule+0x187b/0x4900 kernel/sched/core.c:6669 schedule+0xc3/0x180 kernel/sched/core.c:6745 io_schedule+0x8c/0x100 kernel/sched/core.c:8979 folio_wait_bit_common+0x86c/0x12b0 mm/filemap.c:1301 __filemap_get_folio+0x90/0xa00 mm/filemap.c:1937 pagecache_get_page+0x2e/0x220 mm/folio-compat.c:99 find_or_create_page include/linux/pagemap.h:635 [inline] ni_readpage_cmpr+0x313/0xa70 fs/ntfs3/frecord.c:2131 ntfs_read_folio+0x19e/0x210 fs/ntfs3/inode.c:716 filemap_read_folio+0x19d/0x7a0 mm/filemap.c:2427 filemap_create_folio mm/filemap.c:2555 [inline] filemap_get_pages+0xdf7/0x20c0 mm/filemap.c:2608 filemap_read+0x45a/0x1170 mm/filemap.c:2696 call_read_iter include/linux/fs.h:1862 [inline] generic_file_splice_read+0x240/0x640 fs/splice.c:419 do_splice_to fs/splice.c:902 [inline] splice_direct_to_actor+0x40c/0xbd0 fs/splice.c:973 do_splice_direct+0x283/0x3d0 fs/splice.c:1082 do_sendfile+0x620/0xff0 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64+0x17c/0x1e0 fs/read_write.c:1308 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f9a4d68c389 RSP: 002b:00007f9a4e42a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f9a4d7abf80 RCX: 00007f9a4d68c389 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000008 RBP: 00007f9a4d6d7493 R08: 0000000000000000 R09: 0000000000000000 R10: 0001000000201005 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd4d0921cf R14: 00007f9a4e42a300 R15: 0000000000022000 INFO: task syz-executor.4:3191 blocked for more than 145 seconds. Not tainted 6.4.0-rc7-syzkaller-00204-g61dabacdad4e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:24288 pid:3191 ppid:5027 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5343 [inline] __schedule+0x187b/0x4900 kernel/sched/core.c:6669 schedule+0xc3/0x180 kernel/sched/core.c:6745 io_schedule+0x8c/0x100 kernel/sched/core.c:8979 folio_wait_bit_common+0x86c/0x12b0 mm/filemap.c:1301 __filemap_get_folio+0x90/0xa00 mm/filemap.c:1937 pagecache_get_page+0x2e/0x220 mm/folio-compat.c:99 find_or_create_page include/linux/pagemap.h:635 [inline] ntfs_get_frame_pages fs/ntfs3/file.c:764 [inline] ntfs_compress_write+0x1055/0x1c20 fs/ntfs3/file.c:915 ntfs_file_write_iter+0x3db/0x6d0 fs/ntfs3/file.c:1054 do_iter_write+0x7b1/0xcb0 fs/read_write.c:860 iter_file_splice_write+0x843/0xfe0 fs/splice.c:795 do_splice_from fs/splice.c:873 [inline] direct_splice_actor+0xe7/0x1c0 fs/splice.c:1039 splice_direct_to_actor+0x4c4/0xbd0 fs/splice.c:994 do_splice_direct+0x283/0x3d0 fs/splice.c:1082 do_sendfile+0x620/0xff0 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1322 [inline] __se_sys_sendfile64+0x17c/0x1e0 fs/read_write.c:1308 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f9a4d68c389 RSP: 002b:00007f9a4e409168 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f9a4d7ac050 RCX: 00007f9a4d68c389 RDX: 0000000000000000 RSI: 000000000000000d RDI: 000000000000000c RBP: 00007f9a4d6d7493 R08: 0000000000000000 R09: 0000000000000000 R10: 0001000000201005 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd4d0921cf R14: 00007f9a4e409300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/13: #0: ffffffff8cf276f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20 kernel/rcu/tasks.h:518 1 lock held by rcu_tasks_trace/14: #0: ffffffff8cf27ab0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20 kernel/rcu/tasks.h:518 1 lock held by khungtaskd/28: #0: ffffffff8cf27520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 2 locks held by getty/4744: #0: ffff888028a62098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900015802f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ab/0x1db0 drivers/tty/n_tty.c:2176 1 lock held by syz-executor.0/5022: 3 locks held by syz-executor.1/5041: #0: ffff8880260ea0e0 (&type->s_umount_key#58){++++}-{3:3}, at: deactivate_super+0xad/0xf0 fs/super.c:361 #1: ffff8880b98287c8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x441/0x770 kernel/sched/psi.c:996 #2: ffffffff8cf27520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x40 include/linux/rcupdate.h:326 2 locks held by kworker/1:3/5061: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc90003f2fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:6/5085: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc90004917d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:1/21093: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc90004c17d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:2/21094: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc90004effd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:13/21156: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000561fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:4/28987: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000343fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:5/28988: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000348fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:7/28989: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc900036dfd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:8/28990: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc900036efd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:9/28992: #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc900036ffd20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:10/28995: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000371fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:14/28998: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000374fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 2 locks held by kworker/1:15/28999: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000375fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 3 locks held by kworker/1:16/29000: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000376fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 #2: ffffffff8cf2cbf8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:325 [inline] ffffffff8cf2cbf8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x46c/0x890 kernel/rcu/tree_exp.h:992 2 locks held by kworker/1:17/29001: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc9000366fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 3 locks held by kworker/1:18/29113: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc90004a57d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 #2: ffffffff8cf2cbf8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:293 [inline] #2: ffffffff8cf2cbf8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a3/0x890 kernel/rcu/tree_exp.h:992 2 locks held by kworker/1:19/30202: #0: ffff888012470d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x77e/0x10e0 kernel/workqueue.c:2381 #1: ffffc90015f97d20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7c8/0x10e0 kernel/workqueue.c:2383 3 locks held by syz-executor.4/3178: #0: ffff8880775ee460 (sb_writers#15){.+.+}-{0:0}, at: do_sendfile+0x5fb/0xff0 fs/read_write.c:1253 #1: ffff88808e480ca0 (mapping.invalidate_lock#4){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:830 [inline] #1: ffff88808e480ca0 (mapping.invalidate_lock#4){++++}-{3:3}, at: filemap_create_folio mm/filemap.c:2547 [inline] #1: ffff88808e480ca0 (mapping.invalidate_lock#4){++++}-{3:3}, at: filemap_get_pages+0xb1c/0x20c0 mm/filemap.c:2608 #2: ffff88808e480860 (&ni->ni_lock/4){+.+.}-{3:3}, at: ni_lock fs/ntfs3/ntfs_fs.h:1121 [inline] #2: ffff88808e480860 (&ni->ni_lock/4){+.+.}-{3:3}, at: ntfs_read_folio+0x193/0x210 fs/ntfs3/inode.c:715 2 locks held by syz-executor.4/3191: #0: ffff8880775ee460 (sb_writers#15){.+.+}-{0:0}, at: do_sendfile+0x5fb/0xff0 fs/read_write.c:1253 #1: ffff88808e480b00 (&sb->s_type->i_mutex_key#22){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline] #1: ffff88808e480b00 (&sb->s_type->i_mutex_key#22){+.+.}-{3:3}, at: ntfs_file_write_iter+0x260/0x6d0 fs/ntfs3/file.c:1037 2 locks held by syz-executor.0/5816: 3 locks held by syz-executor.2/5818: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.4.0-rc7-syzkaller-00204-g61dabacdad4e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x498/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x187/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xec2/0xf00 kernel/hung_task.c:379 kthread+0x2b8/0x350 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 5031 Comm: syz-executor.5 Not tainted 6.4.0-rc7-syzkaller-00204-g61dabacdad4e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:182 [inline] RIP: 0010:unwind_next_frame+0x1cd/0x2200 arch/x86/kernel/unwind_orc.c:466 Code: b2 67 0b 00 0f 45 f1 8d 46 ff 44 39 e8 0f 86 1c 04 00 00 44 89 e8 48 8d 1c 85 fc 1a 6c 8f 48 89 d8 48 c1 e8 03 42 0f b6 04 30 <84> c0 0f 85 92 1a 00 00 44 8b 23 44 89 e8 ff c0 48 8d 1c 85 fc 1a RSP: 0018:ffffc90003ddf230 EFLAGS: 00000a06 RAX: 0000000000000000 RBX: ffffffff8f6e0180 RCX: 000000000009e001 RDX: dffffc0000000000 RSI: 000000000009e001 RDI: ffffffff813cbcb0 RBP: ffffc90003ddf335 R08: 0000000000000000 R09: ffffc90003ddf3f0 R10: ffffc90003ddf350 R11: dffffc0000000001 R12: ffff88802c981dc0 R13: 00000000000079a1 R14: dffffc0000000000 R15: ffffffff8179a1a6 FS: 00005555573a5400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2e278e3000 CR3: 0000000031c36000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0x111/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x117/0x1c0 kernel/stacktrace.c:122 save_stack+0xfa/0x1e0 mm/page_owner.c:128 __reset_page_owner+0x4f/0x190 mm/page_owner.c:149 reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1302 [inline] free_unref_page_prepare+0x903/0xa30 mm/page_alloc.c:2564 free_unref_page_list+0x596/0x830 mm/page_alloc.c:2705 release_pages+0x2193/0x2470 mm/swap.c:1042 __pagevec_release+0x84/0x100 mm/swap.c:1062 pagevec_release include/linux/pagevec.h:63 [inline] folio_batch_release include/linux/pagevec.h:132 [inline] shmem_undo_range+0x6af/0x1ba0 mm/shmem.c:954 shmem_truncate_range mm/shmem.c:1049 [inline] shmem_evict_inode+0x258/0x9f0 mm/shmem.c:1164 evict+0x2a4/0x620 fs/inode.c:665 __dentry_kill+0x436/0x650 fs/dcache.c:607 dentry_kill+0xbb/0x290 dput+0x1f3/0x420 fs/dcache.c:913 __fput+0x5e4/0x890 fs/file_table.c:329 task_work_run+0x24a/0x300 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xd9/0x100 kernel/entry/common.c:171 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x64/0x280 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f46bc08d7f7 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffde8f2fa88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46bc08d7f7 RDX: 00007ffde8f2fb59 RSI: 000000000000000a RDI: 00007ffde8f2fb50 RBP: 00007ffde8f2fb50 R08: 00000000ffffffff R09: 00007ffde8f2f920 R10: 00005555573a6873 R11: 0000000000000246 R12: 00007f46bc0d643b R13: 00007ffde8f30c10 R14: 00005555573a6810 R15: 00007ffde8f30c50