INFO: task syz.2.205:7558 blocked for more than 143 seconds. Not tainted 6.11.0-rc6-syzkaller-00075-gad618736883b #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.205 state:D stack:27392 pid:7558 tgid:7544 ppid:7271 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0x17ae/0x4a10 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 __fdget_pos+0x24e/0x310 fs/file.c:1187 fdget_pos include/linux/file.h:76 [inline] __do_sys_getdents fs/readdir.c:320 [inline] __se_sys_getdents+0x1c3/0x4d0 fs/readdir.c:309 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f80c1d7cef9 RSP: 002b:00007f80c17de038 EFLAGS: 00000246 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f80c1f36208 RCX: 00007f80c1d7cef9 RDX: 00000000000000bb RSI: ffffffff81000000 RDI: 0000000000000006 RBP: 00007f80c1def01e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f80c1f36208 R15: 00007ffd7c0c3658 Showing all locks held in the system: 3 locks held by kworker/0:0/8: #0: ffff88801a880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801a880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900000d7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900000d7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888025c85240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x2d1/0x4130 drivers/net/netdevsim/fib.c:1489 3 locks held by kworker/0:1/9: #0: ffff88801a880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801a880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc900000e7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc900000e7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888085434240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x2d1/0x4130 drivers/net/netdevsim/fib.c:1489 3 locks held by kworker/u8:1/12: 1 lock held by khungtaskd/30: #0: ffffffff8e738320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #0: ffffffff8e738320 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8e738320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6626 3 locks held by kworker/1:2/58: #0: ffff88801a880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88801a880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc9000133fd00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc9000133fd00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8e73d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:296 [inline] #2: ffffffff8e73d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x381/0x830 kernel/rcu/tree_exp.h:958 2 locks held by jfsCommit/112: #0: ffff8880393c8920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889 #1: ffff88805c999ce0 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diFree+0x398/0x2fb0 fs/jfs/jfs_imap.c:894 2 locks held by jfsCommit/113: #0: ffff8880602c0920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889 #1: ffff888054bc8a70 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diFree+0x398/0x2fb0 fs/jfs/jfs_imap.c:894 2 locks held by getty/4974: #0: ffff8880307470a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900031332f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/7191: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505 1 lock held by syz.2.205/7548: 2 locks held by syz.2.205/7554: 1 lock held by syz.2.205/7558: #0: ffff88802555aac8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x24e/0x310 fs/file.c:1187 2 locks held by syz-executor/7874: #0: ffff88806243a0e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline] #0: ffff88806243a0e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff88806243a0e0 (&type->s_umount_key#53){++++}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505 #1: ffffffff8eb4bdc8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb2/0x530 fs/jfs/jfs_logmgr.c:1444 1 lock held by syz.3.245/8041: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.4.266/8112: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 2 locks held by syz-executor/8153: #0: ffff8880687380e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline] #0: ffff8880687380e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff8880687380e0 (&type->s_umount_key#53){++++}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505 #1: ffffffff8eb4bdc8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb2/0x530 fs/jfs/jfs_logmgr.c:1444 1 lock held by syz.3.323/8561: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.4.328/8578: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.0.337/8651: #0: ffff88806243a0e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88806243a0e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.1.359/8863: #0: ffff8880687380e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff8880687380e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.3.360/8867: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.4.369/8903: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 1 lock held by syz.0.373/8915: #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline] #0: ffff88805d2200e0 (&type->s_umount_key#53){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120 3 locks held by syz-executor/8940: #0: ffff88806b558d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88806b558d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff88806b558078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5145 #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1977 [inline] #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 net/bluetooth/hci_conn.c:2592 3 locks held by syz-executor/8953: #0: ffff88803b030d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88803b030d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff88803b030078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5145 #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1977 [inline] #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 net/bluetooth/hci_conn.c:2592 3 locks held by syz-executor/8969: #0: ffff88806f7f8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88806f7f8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff88806f7f8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5145 #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1977 [inline] #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 net/bluetooth/hci_conn.c:2592 4 locks held by syz.1.376/9001: #0: ffff888070904d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff888070904d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff888070904078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5145 #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1977 [inline] #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 net/bluetooth/hci_conn.c:2592 #3: ffffffff8e73d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:328 [inline] #3: ffffffff8e73d6f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:958 3 locks held by syz.2.388/9002: #0: ffff88803bc28d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88803bc28d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff88803bc28078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5145 #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1977 [inline] #2: ffffffff8fbe53a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 net/bluetooth/hci_conn.c:2592 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc6-syzkaller-00075-gad618736883b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xff4/0x1040 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 2563 Comm: kworker/u8:10 Not tainted 6.11.0-rc6-syzkaller-00075-gad618736883b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: bat_events batadv_nc_worker RIP: 0010:__lock_acquire+0x1394/0x2040 kernel/locking/lockdep.c:5146 Code: 48 8b 74 24 40 44 89 e2 48 89 e9 e8 c6 98 00 00 45 31 f6 85 c0 0f 84 81 00 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 44 24 20 <0f> b6 04 10 84 c0 0f 85 00 08 00 00 48 8b 44 24 10 f6 40 02 10 75 RSP: 0018:ffffc900098178f0 EFLAGS: 00000002 RAX: 1ffff11005f3bcaa RBX: ffffffff93970148 RCX: 86124adcd1a2bb00 RDX: dffffc0000000000 RSI: ffff88802f9de530 RDI: ffff88802f9dda00 RBP: 3e32b3f597131e49 R08: ffffffff93fa6847 R09: 1ffffffff27f4d08 R10: dffffc0000000000 R11: fffffbfff27f4d09 R12: 0000000000000000 R13: ffff88802f9de4d8 R14: 0000000000000000 R15: ffff88802f9de550 FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556af9a0ff70 CR3: 0000000060f22000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 rcu_lock_acquire include/linux/rcupdate.h:326 [inline] rcu_read_lock include/linux/rcupdate.h:838 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline] batadv_nc_worker+0xec/0x610 net/batman-adv/network-coding.c:719 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244