INFO: task syz-executor.3:8309 blocked for more than 153 seconds.
      Not tainted 6.2.0-rc3-next-20230109-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3  state:D stack:28256 pid:8309  ppid:5112   flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 rwsem_down_read_slowpath+0x5a7/0xb20 kernel/locking/rwsem.c:1095
 __down_read_common kernel/locking/rwsem.c:1260 [inline]
 __down_read kernel/locking/rwsem.c:1269 [inline]
 down_read+0xe6/0x450 kernel/locking/rwsem.c:1511
 mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 do_user_addr_fault+0xa51/0x1210 arch/x86/mm/fault.c:1379
 handle_page_fault arch/x86/mm/fault.c:1519 [inline]
 exc_page_fault+0x98/0x170 arch/x86/mm/fault.c:1575
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7fafb78276c6
RSP: 002b:00007ffdc952ec38 EFLAGS: 00010287
RAX: 0000001b32a22000 RBX: 00007fafb79ac018 RCX: 0000001b32a20000
RDX: 0000001b32a22004 RSI: 0000001b32a21ca8 RDI: 00000000f48f0ce5
RBP: 00000000f48f0ce5 R08: 0000001b32e20000 R09: 00000000f48f0ce9
R10: 00007ffdc95ed090 R11: 000000000001356c R12: 00007fafb79a0000
R13: 0000000000000001 R14: 000000000000233a R15: ffffffff89b848a0
 </TASK>

Showing all threads with locks held in the system:
task:rcu_tasks_kthre state:I stack:29056 pid:12    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 rcu_tasks_one_gp+0x484/0xcd0 kernel/rcu/tasks.h:517
 rcu_tasks_kthread+0x77/0xa0 kernel/rcu/tasks.h:555
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8c7929f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0xcd0 kernel/rcu/tasks.h:510
task:rcu_tasks_trace state:I stack:29224 pid:13    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 rcu_tasks_one_gp+0x484/0xcd0 kernel/rcu/tasks.h:517
 rcu_tasks_kthread+0x77/0xa0 kernel/rcu/tasks.h:555
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8c7926f0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0xcd0 kernel/rcu/tasks.h:510
task:dhcpcd          state:D
 stack:22968 pid:4650  ppid:4649   flags:0x00000000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6705
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0xa48/0x1360 kernel/locking/mutex.c:747
 __netlink_dump_start+0x16e/0x910 net/netlink/af_netlink.c:2355
 netlink_dump_start include/linux/netlink.h:298 [inline]
 rtnetlink_rcv_msg+0x761/0xd50 net/core/rtnetlink.c:6097
 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564
 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]
 netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356
 netlink_sendmsg+0x925/0xe20 net/netlink/af_netlink.c:1932
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0xd3/0x120 net/socket.c:734
 __sys_sendto+0x23a/0x340 net/socket.c:2117
 __do_sys_sendto net/socket.c:2129 [inline]
 __se_sys_sendto net/socket.c:2125 [inline]
 __x64_sys_sendto+0xe1/0x1b0 net/socket.c:2125
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f93d0823206
RSP: 002b:00007ffc8d819708 EFLAGS: 00000246
 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007ffc8d81a840 RCX: 00007f93d0823206
RDX: 0000000000000014 RSI: 00007ffc8d81a760 RDI: 000000000000000f
RBP: 00007ffc8d81a7d0 R08: 00007ffc8d81a744 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc8d81a760
R13: 00007ffc8d81a744 R14: 0000000000000000 R15: 00007ffc8d819710
 </TASK>
1 lock held by dhcpcd/4650:
 #0: ffffffff8e0c6128
 (rtnl_mutex){+.+.}-{3:3}, at: __netlink_dump_start+0x16e/0x910 net/netlink/af_netlink.c:2355
task:getty           state:S
 stack:23336 pid:4746  ppid:1      flags:0x00000000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 schedule_timeout+0x1e1/0x2a0 kernel/time/timer.c:2143
 wait_woken+0x197/0x200 kernel/sched/wait.c:463
 n_tty_read+0x1055/0x13e0 drivers/tty/n_tty.c:2243
 iterate_tty_read drivers/tty/tty_io.c:852 [inline]
 tty_read+0x30e/0x5a0 drivers/tty/tty_io.c:927
 call_read_iter include/linux/fs.h:2185 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x681/0x930 fs/read_write.c:470
 ksys_read+0x12b/0x250 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f04e27f98fe
RSP: 002b:00007ffca24a29b8 EFLAGS: 00000246
 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000055fd7806a910 RCX: 00007f04e27f98fe
RDX: 0000000000000001 RSI: 00007ffca24a29d0 RDI: 0000000000000000
RBP: 000055fd7806a970 R08: 0000000000000007 R09: 000055fd7806bcd0
R10: 0000000000000063 R11: 0000000000000246 R12: 000055fd7806a9ac
R13: 00007ffca24a29d0 R14: 0000000000000000 R15: 000055fd7806a9ac
 </TASK>
2 locks held by getty/4746:
 #0: 
ffff88802a878098
 (
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x26/0x80 drivers/tty/tty_ldisc.c:244
 #1: 
ffffc900015b02f0
 (
&ldata->atomic_read_lock
){+.+.}-{3:3}
, at: n_tty_read+0xef4/0x13e0 drivers/tty/n_tty.c:2177
task:kworker/1:7     state:D
 stack:27184 pid:5213  ppid:2      flags:0x00004000
Workqueue: events pwq_unbound_release_workfn

Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 exp_funnel_lock kernel/rcu/tree_exp.h:316 [inline]
 synchronize_rcu_expedited+0x706/0x770 kernel/rcu/tree_exp.h:990
 synchronize_rcu+0x302/0x3b0 kernel/rcu/tree.c:3481
 lockdep_unregister_key+0x282/0x460 kernel/locking/lockdep.c:6362
 wq_unregister_lockdep kernel/workqueue.c:3501 [inline]
 pwq_unbound_release_workfn+0x258/0x340 kernel/workqueue.c:3739
 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
 worker_thread+0x669/0x1090 kernel/workqueue.c:2440
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
2 locks held by kworker/1:7/5213:
 #0: 
ffff888012470d38
 (
(wq_completion)events
){+.+.}-{0:0}
, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
, at: set_work_data kernel/workqueue.c:636 [inline]
, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
, at: process_one_work+0x86d/0x1750 kernel/workqueue.c:2264
 #1: ffffc90004757da8 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1750 kernel/workqueue.c:2268
task:kworker/1:13    state:D stack:26640 pid:5255  ppid:2      flags:0x00004000
Workqueue: rcu_gp wait_rcu_exp_gp
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167
 synchronize_rcu_expedited_wait_once kernel/rcu/tree_exp.h:572 [inline]
 synchronize_rcu_expedited_wait kernel/rcu/tree_exp.h:624 [inline]
 rcu_exp_wait_wake+0x28f/0x11c0 kernel/rcu/tree_exp.h:693
 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
 worker_thread+0x669/0x1090 kernel/workqueue.c:2440
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
2 locks held by kworker/1:13/5255:
 #0: 
ffff888012472538
 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x86d/0x1750 kernel/workqueue.c:2264
 #1: 
ffffc900048e7da8
 (
(work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1750 kernel/workqueue.c:2268
task:kworker/u4:10   state:D
 stack:26112 pid:7099  ppid:2      flags:0x00004000
Workqueue: events_unbound io_ring_exit_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common+0x1ce/0x5c0 kernel/sched/completion.c:106
 io_ring_exit_work+0x342/0xc84 io_uring/io_uring.c:2896
 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
 worker_thread+0x669/0x1090 kernel/workqueue.c:2440
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
2 locks held by kworker/u4:10/7099:
 #0: 
ffff888012479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
ffff888012479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
ffff888012479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
ffff888012479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline]
ffff888012479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
ffff888012479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x86d/0x1750 kernel/workqueue.c:2264
 #1: ffffc9000b13fda8
 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1750 kernel/workqueue.c:2268
task:kworker/u4:13   state:D stack:25608 pid:7203  ppid:2      flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6705
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0xa48/0x1360 kernel/locking/mutex.c:747
 cangw_pernet_exit_batch+0x15/0xa0 net/can/gw.c:1250
 ops_exit_list+0x125/0x170 net/core/net_namespace.c:174
 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:606
 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293
 worker_thread+0x669/0x1090 kernel/workqueue.c:2440
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
4 locks held by kworker/u4:13/7203:
 #0: 
ffff8880125df938
 (
(wq_completion)netns
){+.+.}-{0:0}
, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline]
, at: set_work_data kernel/workqueue.c:636 [inline]
, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline]
, at: process_one_work+0x86d/0x1750 kernel/workqueue.c:2264
 #1: 
ffffc9001555fda8
 (
net_cleanup_work
){+.+.}-{0:0}
, at: process_one_work+0x8a1/0x1750 kernel/workqueue.c:2268
 #2: 
ffffffff8e0b2490
 (
pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9f/0xb10 net/core/net_namespace.c:568
 #3: ffffffff8e0c6128 (rtnl_mutex){+.+.}-{3:3}, at: cangw_pernet_exit_batch+0x15/0xa0 net/can/gw.c:1250
task:syz-executor.3  state:D stack:28256 pid:8309  ppid:5112   flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 rwsem_down_read_slowpath+0x5a7/0xb20 kernel/locking/rwsem.c:1095
 __down_read_common kernel/locking/rwsem.c:1260 [inline]
 __down_read kernel/locking/rwsem.c:1269 [inline]
 down_read+0xe6/0x450 kernel/locking/rwsem.c:1511
 mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 do_user_addr_fault+0xa51/0x1210 arch/x86/mm/fault.c:1379
 handle_page_fault arch/x86/mm/fault.c:1519 [inline]
 exc_page_fault+0x98/0x170 arch/x86/mm/fault.c:1575
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7fafb78276c6
RSP: 002b:00007ffdc952ec38 EFLAGS: 00010287
RAX: 0000001b32a22000 RBX: 00007fafb79ac018 RCX: 0000001b32a20000
RDX: 0000001b32a22004 RSI: 0000001b32a21ca8 RDI: 00000000f48f0ce5
RBP: 00000000f48f0ce5 R08: 0000001b32e20000 R09: 00000000f48f0ce9
R10: 00007ffdc95ed090 R11: 000000000001356c R12: 00007fafb79a0000
R13: 0000000000000001 R14: 000000000000233a R15: ffffffff89b848a0
 </TASK>
1 lock held by syz-executor.3/8309:
 #0: ffff8880269d7698 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:117 [inline]
 #0: ffff8880269d7698 (&mm->mmap_lock){++++}-{3:3}, at: do_user_addr_fault+0xa51/0x1210 arch/x86/mm/fault.c:1379
task:syz-executor.3  state:R
  running task     stack:27208 pid:8311  ppid:5112   flags:0x00004006
Call Trace:
 <TASK>
 </TASK>
3 locks held by syz-executor.3/8311:
task:kvm-nx-lpage-re state:D
 stack:28880 pid:9689  ppid:2      flags:0x00024000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 synchronize_rcu_expedited+0x5e2/0x770 kernel/rcu/tree_exp.h:1005
 synchronize_rcu+0x302/0x3b0 kernel/rcu/tree.c:3481
 rcu_sync_enter+0x14b/0x2e0 kernel/rcu/sync.c:149
 percpu_down_write+0x68/0x390 kernel/locking/percpu-rwsem.c:231
 cgroup_attach_lock+0x35/0x40 kernel/cgroup/cgroup.c:2437
 cgroup_attach_task_all+0x2f/0x140 kernel/cgroup/cgroup-v1.c:62
 kvm_vm_worker_thread+0x306/0x5f0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:6120
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
4 locks held by kvm-nx-lpage-re/9689:
 #0: 
ffffffff8c7da5a8
 (
cgroup_mutex
){+.+.}-{3:3}
, at: cgroup_attach_task_all+0x25/0x140 kernel/cgroup/cgroup-v1.c:61
 #1: 
ffffffff8c63d810
 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_attach_lock+0x11/0x40 kernel/cgroup/cgroup.c:2435
 #2: 
ffffffff8c7da370 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_attach_lock+0x35/0x40 kernel/cgroup/cgroup.c:2437
 #3: 
ffffffff8c79e6b8
 (
rcu_state.exp_mutex
){+.+.}-{3:3}
, at: exp_funnel_lock kernel/rcu/tree_exp.h:293 [inline]
, at: synchronize_rcu_expedited+0x658/0x770 kernel/rcu/tree_exp.h:990
task:syz-executor.0  state:D
 stack:27832 pid:9699  ppid:5115   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5252 [inline]
 __schedule+0x25d0/0x5a70 kernel/sched/core.c:6570
 schedule+0xde/0x1b0 kernel/sched/core.c:6646
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6705
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0xa48/0x1360 kernel/locking/mutex.c:747
 exp_funnel_lock kernel/rcu/tree_exp.h:325 [inline]
 synchronize_rcu_expedited+0x400/0x770 kernel/rcu/tree_exp.h:990
 synchronize_net net/core/dev.c:10747 [inline]
 unregister_netdevice_many_notify+0xe94/0x19e0 net/core/dev.c:10876
 unregister_netdevice_many net/core/dev.c:10895 [inline]
 unregister_netdevice_queue+0x2e5/0x3c0 net/core/dev.c:10776
 unregister_netdevice include/linux/netdevice.h:3059 [inline]
 unregister_netdev+0x1c/0x30 net/core/dev.c:10913
 sixpack_close+0x170/0x270 drivers/net/hamradio/6pack.c:673
 tty_ldisc_close+0x110/0x190 drivers/tty/tty_ldisc.c:456
 tty_ldisc_kill+0x94/0x150 drivers/tty/tty_ldisc.c:608
 tty_ldisc_release+0x1f3/0x2a0 drivers/tty/tty_ldisc.c:776
 tty_release_struct+0x24/0xf0 drivers/tty/tty_io.c:1687
 tty_release+0xc14/0x11b0 drivers/tty/tty_io.c:1858
 __fput+0x27c/0xa90 fs/file_table.c:320
 task_work_run+0x16f/0x270 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f6693a3df7b
RSP: 002b:00007ffe7942fd00 EFLAGS: 00000293
 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f6693a3df7b
RDX: 0000000000000000 RSI: 0000001b32923580 RDI: 0000000000000003
RBP: 00007f6693bad980 R08: 0000000000000000 R09: 00000000ccafed55
R10: 0000000000000000 R11: 0000000000000293 R12: 000000000008bcff
R13: 00007ffe7942fe00 R14: 00007ffe7942fe20 R15: 0000000000000032
 </TASK>
3 locks held by syz-executor.0/9699:
 #0: ffff88807bdc8098 (&tty->ldisc_sem){++++}-{0:0}, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:290 [inline]
 #0: ffff88807bdc8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_lock_pair_timeout drivers/tty/tty_ldisc.c:353 [inline]
 #0: ffff88807bdc8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_lock_pair drivers/tty/tty_ldisc.c:367 [inline]
 #0: ffff88807bdc8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_release+0x7d/0x2a0 drivers/tty/tty_ldisc.c:775
 #1: ffffffff8e0c6128 (rtnl_mutex){+.+.}-{3:3}, at: unregister_netdev+0x12/0x30 net/core/dev.c:10912
 #2: 
ffffffff8c79e6b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:325 [inline]
ffffffff8c79e6b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x400/0x770 kernel/rcu/tree_exp.h:990

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.2.0-rc3-next-20230109-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
 nmi_cpu_backtrace.cold+0x24/0x18a lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x32f/0x3c0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xcae/0x1050 kernel/hung_task.c:377
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 8311 Comm: syz-executor.3 Not tainted 6.2.0-rc3-next-20230109-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:3726 [inline]
RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3745 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3800 [inline]
RIP: 0010:__lock_acquire+0x1709/0x5660 kernel/locking/lockdep.c:5056
Code: 48 89 ea 48 8b 6c 24 08 eb 06 48 83 eb 08 74 42 48 8d 7b 18 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 0d 3f 00 00 48 8b 43 18 <48> 39 c5 0f 84 99 f5 ff ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 42 80
RSP: 0018:ffffc90000007ab8 EFLAGS: 00000046
RAX: 9cc549aed7a5a811 RBX: ffffffff90211980 RCX: ffffffff8163bcce
RDX: 0000000000019b9a RSI: 0000000000000008 RDI: ffffffff90211998
RBP: 9cc549aed7a5a811 R08: 0000000000000000 R09: ffffffff91350b47
R10: fffffbfff226a168 R11: 0000000000000001 R12: ffff8880211e6248
R13: ffff8880211e57c0 R14: dffffc0000000000 R15: 0000000000000000
FS:  00007fafb8639700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcf1887ff0 CR3: 000000002ae97000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 lock_acquire.part.0+0x11a/0x350 kernel/locking/lockdep.c:5669
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
 debug_object_deactivate lib/debugobjects.c:739 [inline]
 debug_object_deactivate+0x105/0x300 lib/debugobjects.c:727
 debug_timer_deactivate kernel/time/timer.c:787 [inline]
 debug_deactivate kernel/time/timer.c:831 [inline]
 detach_timer kernel/time/timer.c:878 [inline]
 expire_timers+0x12f/0x330 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:2022 [inline]
 __run_timers kernel/time/timer.c:1995 [inline]
 run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
 __do_softirq+0x1fb/0xaf6 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2008 [inline]
RIP: 0010:vprintk_emit+0x3fe/0x600 kernel/printk/printk.c:2356
Code: 32 1b 00 48 85 db 0f 85 da 01 00 00 e8 7b 35 1b 00 31 ff 4c 89 f6 e8 41 32 1b 00 4d 85 f6 74 06 e8 67 35 1b 00 fb f3 0f 1e fa <e8> 5d 35 1b 00 45 31 c9 41 b8 01 00 00 00 31 c9 68 ea 77 66 81 ba
RSP: 0018:ffffc90014eff788 EFLAGS: 00000246
RAX: 0000000000040000 RBX: 0000000000000000 RCX: ffffc9000a679000
RDX: 0000000000040000 RSI: ffffffff816677e9 RDI: 0000000000000007
RBP: ffffc90014eff7c0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000010
R13: ffff888017590000 R14: 0000000000000200 R15: ffffc90014eff810
 vprintk+0x84/0xa0 kernel/printk/printk_safe.c:50
 _printk+0xbe/0xf1 kernel/printk/printk.c:2378
 mt_dump_entry+0xb3/0xf4 lib/maple_tree.c:6722
 mt_dump_range64 lib/maple_tree.c:6747 [inline]
 mt_dump_node+0x3ec/0x927 lib/maple_tree.c:6829
 mt_dump_arange64 lib/maple_tree.c:6792 [inline]
 mt_dump_node+0x851/0x927 lib/maple_tree.c:6832
 mt_dump.cold+0xf2/0x115 lib/maple_tree.c:6849
 mt_find.cold+0x48/0x90 lib/maple_tree.c:6473
 find_vma+0x10c/0x1b0 mm/mmap.c:1850
 walk_page_range+0x2b1/0x4a0 mm/pagewalk.c:463
 mlock_vma_pages_range mm/mlock.c:386 [inline]
 mlock_fixup+0x650/0x810 mm/mlock.c:462
 apply_vma_lock_flags+0x23d/0x350 mm/mlock.c:506
 do_mlock+0x25a/0x6d0 mm/mlock.c:601
 __do_sys_mlock2 mm/mlock.c:628 [inline]
 __se_sys_mlock2 mm/mlock.c:618 [inline]
 __x64_sys_mlock2+0xc1/0x100 mm/mlock.c:618
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fafb788c0c9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fafb8639168 EFLAGS: 00000246 ORIG_RAX: 0000000000000145
RAX: ffffffffffffffda RBX: 00007fafb79abf80 RCX: 00007fafb788c0c9
RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffd000
RBP: 00007fafb78e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc952ec6f R14: 00007fafb8639300 R15: 0000000000022000
 </TASK>