INFO: task syz.9.7092:29523 blocked for more than 143 seconds.
Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.7092 state:D stack:26936 pid:29523 tgid:29522 ppid:26626 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
rwsem_down_read_slowpath+0x552/0x880 kernel/locking/rwsem.c:1084
__down_read_common kernel/locking/rwsem.c:1248 [inline]
__down_read kernel/locking/rwsem.c:1261 [inline]
down_read+0x98/0x2e0 kernel/locking/rwsem.c:1526
inode_lock_shared include/linux/fs.h:877 [inline]
blkdev_read_iter+0x2f8/0x440 block/fops.c:808
aio_read+0x30e/0x470 fs/aio.c:1602
__io_submit_one fs/aio.c:-1 [inline]
io_submit_one+0x6ec/0x1240 fs/aio.c:2052
__do_sys_io_submit fs/aio.c:2111 [inline]
__se_sys_io_submit+0x185/0x2f0 fs/aio.c:2081
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feecc98e969
RSP: 002b:00007feecd7d5038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 00007feeccbb5fa0 RCX: 00007feecc98e969
RDX: 00002000000000c0 RSI: 00000000000000ca RDI: 00007feecd7b0000
RBP: 00007feecca10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007feeccbb5fa0 R15: 00007feecccdfa28
INFO: task syz.9.7092:29524 blocked for more than 145 seconds.
Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.7092 state:D stack:28344 pid:29524 tgid:29522 ppid:26626 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
rwsem_down_read_slowpath+0x552/0x880 kernel/locking/rwsem.c:1084
__down_read_common kernel/locking/rwsem.c:1248 [inline]
__down_read kernel/locking/rwsem.c:1261 [inline]
down_read+0x98/0x2e0 kernel/locking/rwsem.c:1526
inode_lock_shared include/linux/fs.h:877 [inline]
blkdev_read_iter+0x2f8/0x440 block/fops.c:808
aio_read+0x30e/0x470 fs/aio.c:1602
__io_submit_one fs/aio.c:-1 [inline]
io_submit_one+0x6ec/0x1240 fs/aio.c:2052
__do_sys_io_submit fs/aio.c:2111 [inline]
__se_sys_io_submit+0x185/0x2f0 fs/aio.c:2081
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feecc98e969
RSP: 002b:00007feecd7af038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 00007feeccbb6080 RCX: 00007feecc98e969
RDX: 00002000000000c0 RSI: 00000000000000ca RDI: 00007feecd7b0000
RBP: 00007feecca10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007feeccbb6080 R15: 00007feecccdfa28
Showing all locks held in the system:
7 locks held by kworker/0:0/9:
1 lock held by khungtaskd/31:
#0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764
2 locks held by kworker/u8:4/65:
#0: ffff888146293948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff888146293948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
#1: ffffc90001567c60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90001567c60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
2 locks held by kworker/0:2/917:
3 locks held by acpid/5184:
#0: ffff888023f08160
(&mousedev->mutex#2){+.+.}-{4:4}, at: mousedev_close_device+0x2e/0xd0 drivers/input/mousedev.c:441
#1: ffff888034f7b2c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:201 [inline]
#1: ffff888034f7b2c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_close_device+0x4c/0x230 drivers/input/input.c:645
#2: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:304 [inline]
#2: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f4/0x730 kernel/rcu/tree_exp.h:998
1 lock held by udevd/5199:
#0: ffff888143fac358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 block/bdev.c:945
2 locks held by getty/5590:
#0: ffff8880348fa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
3 locks held by kworker/0:6/5890:
#0: ffff88801a080d48 ((wq_completion)events){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3213 [inline]
, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
#1: ffffc90004a37c60 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90004a37c60 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
#2: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:336 [inline]
#2: ffffffff8df41338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b7/0x730 kernel/rcu/tree_exp.h:998
2 locks held by kworker/0:5/12125:
3 locks held by kworker/u8:1/17905:
#0: ffff888056513148 ((wq_completion)loop6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff888056513148 ((wq_completion)loop6){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
#1: ffffc90011027c60 ((work_completion)(&worker->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90011027c60 ((work_completion)(&worker->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
#2: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline]
#2: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:808
6 locks held by kworker/1:7/24666:
4 locks held by syz.7.7063/29419:
1 lock held by syz.9.7092/29523:
#0: ffff88802286ef20 (
&sb->s_type->i_mutex_key
#8){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline]
#8){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:808
1 lock held by syz.9.7092/29524:
#0: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline]
#0: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:808
1 lock held by syz-executor/29628:
#0: ffff888143fac358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 block/bdev.c:945
1 lock held by syz.0.7269/30131:
#0: ffff888143fac358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1a9/0x650 block/bdev.c:1128
3 locks held by syz-executor/30291:
#0: ffff888031bd0d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
#0: ffff888031bd0d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
#1: ffff888031bd0078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
#2: ffffffff8f45a488 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
#2: ffffffff8f45a488 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
1 lock held by syz.8.7327/30339:
#0: ffff88802286f0c0 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:922 [inline]
#0: ffff88802286f0c0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 mm/readahead.c:491
4 locks held by syz.2.7374/30531:
#0: ffff888028890d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
#0: ffff888028890d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
#1: ffff888028890078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
#2: ffffffff8f45a488 (hci_cb_list_lock){+.+.}-{4:4}
, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
#3:
ffff888078961338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 net/bluetooth/l2cap_core.c:1761
3 locks held by syz.3.7378/30546:
#0: ffff88805b458d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
#0: ffff88805b458d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x1fe/0x500 net/bluetooth/hci_core.c:2678
#1: ffff88805b458078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5213
#2: ffffffff8f45a488 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
#2: ffffffff8f45a488 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2701
1 lock held by syz.4.7383/30563:
#0: ffff88802286f0c0 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:922 [inline]
#0: ffff88802286f0c0 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x445/0xc70 mm/readahead.c:491
1 lock held by syz.4.7383/30565:
#0: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline]
#0: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_write_iter+0x50b/0x710 block/fops.c:754
1 lock held by syz.4.7383/30568:
#0: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: inode_lock include/linux/fs.h:867 [inline]
#0: ffff88802286ef20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_fallocate+0x1d8/0x4b0 block/fops.c:853
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0xfee/0x1030 kernel/hung_task.c:437
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: events dvb_usb_read_remote_control
RIP: 0010:io_serial_in+0x77/0xc0 drivers/tty/serial/8250/8250_port.c:409
Code: e8 1e 3f 82 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 ff 33 e4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07
RSP: 0018:ffffc900000e7430 EFLAGS: 00000002
RAX: 1ffffffff3369700 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: ffffffff99b4be50 R08: ffff888024210237 R09: 1ffff11004842046
R10: dffffc0000000000 R11: ffffffff853d7f60 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffffff99b4bbc0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000003cb030 CR3: 000000002f62e000 CR4: 00000000003526f0
Call Trace:
serial_in drivers/tty/serial/8250/8250.h:137 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline]
wait_for_lsr+0x19e/0x2f0 drivers/tty/serial/8250/8250_port.c:2098
fifo_wait_for_lsr drivers/tty/serial/8250/8250_port.c:3348 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3371 [inline]
serial8250_console_write+0x134c/0x1ba0 drivers/tty/serial/8250/8250_port.c:3456
console_emit_next_record kernel/printk/printk.c:3138 [inline]
console_flush_all+0x725/0xc40 kernel/printk/printk.c:3226
__console_flush_and_unlock kernel/printk/printk.c:3285 [inline]
console_unlock+0xc4/0x270 kernel/printk/printk.c:3325
vprintk_emit+0x5b7/0x7a0 kernel/printk/printk.c:2450
_printk+0xcf/0x120 kernel/printk/printk.c:2475
m920x_read drivers/media/usb/dvb-usb/m920x.c:40 [inline]
m920x_rc_core_query+0x2c5/0x540 drivers/media/usb/dvb-usb/m920x.c:-1
dvb_usb_read_remote_control+0xb1/0x1a0 drivers/media/usb/dvb-usb/dvb-usb-remote.c:261
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245