INFO: task syz-executor.4:6880 blocked for more than 143 seconds. Not tainted 5.15.0-rc2-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:23496 pid: 6880 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:4940 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6287 schedule+0xd3/0x270 kernel/sched/core.c:6366 rwsem_down_write_slowpath+0x7b9/0x11d0 kernel/locking/rwsem.c:1107 __down_write_common kernel/locking/rwsem.c:1262 [inline] __down_write_common kernel/locking/rwsem.c:1259 [inline] __down_write kernel/locking/rwsem.c:1271 [inline] down_write+0x137/0x150 kernel/locking/rwsem.c:1518 fuse_mount_remove fs/fuse/inode.c:1716 [inline] fuse_sb_destroy fs/fuse/inode.c:1751 [inline] fuse_kill_sb_anon+0x81/0x290 fs/fuse/inode.c:1759 deactivate_locked_super+0x94/0x160 fs/super.c:335 deactivate_super+0xad/0xd0 fs/super.c:366 cleanup_mnt+0x3a2/0x540 fs/namespace.c:1137 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:175 [inline] exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f5719e62b67 RSP: 002b:00007ffc2d2e6738 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5719e62b67 RDX: 00007ffc2d2e680c RSI: 0000000000000002 RDI: 00007ffc2d2e6800 RBP: 00007ffc2d2e6800 R08: 00000000ffffffff R09: 00007ffc2d2e65d0 R10: 00005555571d88e3 R11: 0000000000000246 R12: 00007f5719ebae80 R13: 00007ffc2d2e78c0 R14: 00005555571d8810 R15: 00007ffc2d2e7900 Showing all locks held in the system: 1 lock held by khungtaskd/26: #0: ffffffff8b97d420 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446 1 lock held by systemd-journal/2959: 5 locks held by in:imklog/6447: 2 locks held by syz-executor.4/6880: #0: ffff88808c5960e0 (&type->s_umount_key#69){+.+.}-{3:3}, at: deactivate_super+0xa5/0xd0 fs/super.c:365 #1: ffff88806c588b38 (&fc->killsb){++++}-{3:3}, at: fuse_mount_remove fs/fuse/inode.c:1716 [inline] #1: ffff88806c588b38 (&fc->killsb){++++}-{3:3}, at: fuse_sb_destroy fs/fuse/inode.c:1751 [inline] #1: ffff88806c588b38 (&fc->killsb){++++}-{3:3}, at: fuse_kill_sb_anon+0x81/0x290 fs/fuse/inode.c:1759 2 locks held by kworker/u4:6/8359: 1 lock held by syz-executor.4/21792: #0: ffff88806c588b38 (&fc->killsb){++++}-{3:3}, at: fuse_notify_retrieve fs/fuse/dev.c:1749 [inline] #0: ffff88806c588b38 (&fc->killsb){++++}-{3:3}, at: fuse_notify fs/fuse/dev.c:1787 [inline] #0: ffff88806c588b38 (&fc->killsb){++++}-{3:3}, at: fuse_dev_do_write+0xffc/0x2bd0 fs/fuse/dev.c:1865 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 26 Comm: khungtaskd Not tainted 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xc1d/0xf50 kernel/hung_task.c:295 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 22963 Comm: syz-executor.5 Not tainted 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:check_preemption_disabled+0x4/0x140 lib/smp_processor_id.c:13 Code: 00 00 e8 7f ba 63 f8 65 48 8b 3c 25 40 f0 01 00 e8 f1 2e 1c f8 eb 99 0f 1f 44 00 00 0f 0b e9 23 ff ff ff cc cc cc 41 56 41 55 <49> 89 f5 41 54 55 48 89 fd 53 0f 1f 44 00 00 65 44 8b 25 4d 6b cc RSP: 0000:ffffc9000c2d7c18 EFLAGS: 00000046 RAX: 0000000080000001 RBX: 00000000fffffe01 RCX: 1ffffffff2049b1c RDX: 0000000000000000 RSI: ffffffff898a7dc0 RDI: ffffffff89e3a220 RBP: ffffffff812b7b18 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff817b682d R11: 0000000000000000 R12: ffff8880869c02c0 R13: ffffed1010d3832a R14: 00007f006681edc0 R15: dffffc0000000000 FS: 00007f006681f700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f006924f931 CR3: 00000001443f7000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __local_bh_enable_ip+0xe2/0x120 kernel/softirq.c:378 local_bh_enable include/linux/bottom_half.h:32 [inline] fpregs_unlock arch/x86/include/asm/fpu/api.h:78 [inline] copy_fpstate_to_sigframe+0x277/0x9f0 arch/x86/kernel/fpu/signal.c:205 get_sigframe.constprop.0.isra.0+0x433/0x610 arch/x86/kernel/signal.c:295 __setup_rt_frame arch/x86/kernel/signal.c:471 [inline] setup_rt_frame arch/x86/kernel/signal.c:778 [inline] handle_signal arch/x86/kernel/signal.c:822 [inline] arch_do_signal_or_restart+0xd8e/0x1c40 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207 irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:313 exc_page_fault+0xc6/0x180 arch/x86/mm/fault.c:1534 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568 RIP: 0033:0x7f006924f272 Code: ff e8 32 33 01 00 85 c0 0f 84 ba 01 00 00 64 f0 83 2c 25 b8 ff ff ff 01 e8 3b d1 00 00 48 8b 0c 24 8b 00 48 8b 99 80 00 00 00 <89> 81 88 00 00 00 85 c0 75 06 48 83 fb ff 74 18 48 63 44 24 14 48 RSP: 002b:00007f006681f1a0 EFLAGS: 00010203 RAX: 0000000000000013 RBX: 00000002be5741c3 RCX: 00007f006924f8a9 RDX: 00007f006924f24e RSI: 0000000000000001 RDI: 00007f006681f5f0 RBP: 00007f0069302cb4 R08: 00007f006681f1a0 R09: 00007f0069302cb4 R10: 00007f0069303b80 R11: 0000000000000286 R12: 0000000000000000 R13: 00007ffc8547ddef R14: 00007f006681f300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: e8 7f ba 63 f8 callq 0xf863ba86 7: 65 48 8b 3c 25 40 f0 mov %gs:0x1f040,%rdi e: 01 00 10: e8 f1 2e 1c f8 callq 0xf81c2f06 15: eb 99 jmp 0xffffffb0 17: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 1c: 0f 0b ud2 1e: e9 23 ff ff ff jmpq 0xffffff46 23: cc int3 24: cc int3 25: cc int3 26: 41 56 push %r14 28: 41 55 push %r13 * 2a: 49 89 f5 mov %rsi,%r13 <-- trapping instruction 2d: 41 54 push %r12 2f: 55 push %rbp 30: 48 89 fd mov %rdi,%rbp 33: 53 push %rbx 34: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 39: 65 gs 3a: 44 rex.R 3b: 8b .byte 0x8b 3c: 25 .byte 0x25 3d: 4d rex.WRB 3e: 6b .byte 0x6b 3f: cc int3