INFO: task syz-executor.3:5793 blocked for more than 143 seconds. Not tainted 6.8.0-rc7-syzkaller-00051-g67be068d31d4 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:26552 pid:5793 tgid:5792 ppid:5085 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5400 [inline] __schedule+0x177f/0x49a0 kernel/sched/core.c:6727 __schedule_loop kernel/sched/core.c:6802 [inline] schedule+0x149/0x260 kernel/sched/core.c:6817 request_wait_answer fs/fuse/dev.c:407 [inline] __fuse_request_send fs/fuse/dev.c:426 [inline] fuse_simple_request+0x1198/0x1b90 fs/fuse/dev.c:513 fuse_dentry_revalidate+0x524/0xbc0 fs/fuse/dir.c:233 d_revalidate fs/namei.c:862 [inline] __lookup_slow+0x1bb/0x3f0 fs/namei.c:1682 lookup_slow+0x53/0x70 fs/namei.c:1710 walk_component+0x2e1/0x410 fs/namei.c:2005 lookup_last fs/namei.c:2462 [inline] path_lookupat+0x16f/0x450 fs/namei.c:2486 filename_lookup+0x255/0x610 fs/namei.c:2515 vfs_statx+0x105/0x4e0 fs/stat.c:244 do_statx fs/stat.c:681 [inline] __do_sys_statx fs/stat.c:708 [inline] __se_sys_statx fs/stat.c:699 [inline] __x64_sys_statx+0x1a4/0x240 fs/stat.c:699 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f041587dda9 RSP: 002b:00007f041653f0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000014c RAX: ffffffffffffffda RBX: 00007f04159abf80 RCX: 00007f041587dda9 RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffffffffffffff9c RBP: 00007f04158ca47a R08: 00000000200065c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f04159abf80 R15: 00007ffc47875bb8 INFO: task syz-executor.3:5794 blocked for more than 144 seconds. Not tainted 6.8.0-rc7-syzkaller-00051-g67be068d31d4 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:24080 pid:5794 tgid:5792 ppid:5085 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5400 [inline] __schedule+0x177f/0x49a0 kernel/sched/core.c:6727 __schedule_loop kernel/sched/core.c:6802 [inline] schedule+0x149/0x260 kernel/sched/core.c:6817 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6874 rwsem_down_write_slowpath+0xeea/0x13b0 kernel/locking/rwsem.c:1178 __down_write_common+0x1ae/0x200 kernel/locking/rwsem.c:1306 inode_lock_nested include/linux/fs.h:839 [inline] filename_create+0x260/0x540 fs/namei.c:3895 do_mkdirat+0xbd/0x3a0 fs/namei.c:4141 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4162 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f041587c8a7 RSP: 002b:00007f041651def8 EFLAGS: 00000202 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f041651df80 RCX: 00007f041587c8a7 RDX: 00000000000001ff RSI: 0000000020000140 RDI: 00000000ffffff9c RBP: 0000000020000200 R08: 0000000000000000 R09: 00000000000001c5 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000140 R13: 00007f041651df40 R14: 00000000000001cb R15: 0000000020000500 Showing all locks held in the system: 1 lock held by khungtaskd/29: #0: ffffffff8e130be0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #0: ffffffff8e130be0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #0: ffffffff8e130be0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614 2 locks held by getty/4806: #0: ffff88802ab130a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b4/0x1e10 drivers/tty/n_tty.c:2201 1 lock held by syz-executor.3/5793: #0: ffff88805d8d5fd0 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805d8d5fd0 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: lookup_slow+0x45/0x70 fs/namei.c:1709 2 locks held by syz-executor.3/5794: #0: ffff88806f9f4420 (sb_writers#37){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:409 #1: ffff88805d8d5fd0 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline] #1: ffff88805d8d5fd0 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:3895 1 lock held by syz-executor.3/6060: #0: ffff88805d8d6d50 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805d8d6d50 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: lookup_slow+0x45/0x70 fs/namei.c:1709 2 locks held by syz-executor.3/6071: #0: ffff888070be8420 (sb_writers#37){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:409 #1: ffff88805d8d6d50 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline] #1: ffff88805d8d6d50 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:3895 2 locks held by syz-executor.3/6362: #0: ffff88801ebea420 (sb_writers#37){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:409 #1: ffff88805d8d4b90 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline] #1: ffff88805d8d4b90 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:3895 1 lock held by syz-executor.3/6364: #0: ffff88805d8d4b90 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805d8d4b90 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: lookup_slow+0x45/0x70 fs/namei.c:1709 1 lock held by syz-executor.3/6739: #0: ffff88805d825910 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:814 [inline] #0: ffff88805d825910 (&type->i_mutex_dir_key#26){.+.+}-{3:3}, at: lookup_slow+0x45/0x70 fs/namei.c:1709 2 locks held by syz-executor.3/6747: #0: ffff888045836420 (sb_writers#37){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:409 #1: ffff88805d825910 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline] #1: ffff88805d825910 (&type->i_mutex_dir_key#26/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:3895 1 lock held by syz-executor.4/6925: #0: ffffffff8e136578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline] #0: ffffffff8e136578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x46c/0x890 kernel/rcu/tree_exp.h:995 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 29 Comm: khungtaskd Not tainted 6.8.0-rc7-syzkaller-00051-g67be068d31d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xfaf/0xff0 kernel/hung_task.c:379 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:243 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 24711 Comm: kworker/u4:0 Not tainted 6.8.0-rc7-syzkaller-00051-g67be068d31d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:deref_stack_reg+0x9/0x260 arch/x86/kernel/unwind_orc.c:402 Code: ff e8 3b e3 1d 0a 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 <53> 48 83 ec 28 49 89 d6 48 89 34 24 48 89 fb 49 bf 00 00 00 00 00 RSP: 0018:ffffc90019226af8 EFLAGS: 00000283 RAX: fffffffffffffff0 RBX: ffffffff90063fb0 RCX: 0000000000000000 RDX: ffffc90019226c40 RSI: ffffc90019227ed0 RDI: ffffc90019226c00 RBP: ffffc90019226c00 R08: 0000000000000005 R09: ffffffff814066c0 R10: 0000000000000003 R11: ffff88802ba38000 R12: ffffc90019227ed8 R13: dffffc0000000000 R14: ffffc90019226c50 R15: 1ffff92003244d80 FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00116a000 CR3: 0000000024536000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unwind_next_frame+0x1ab9/0x29e0 arch/x86/kernel/unwind_orc.c:648 arch_stack_walk+0x150/0x1b0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x117/0x1d0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3981 [inline] __kmalloc+0x22e/0x490 mm/slub.c:3994 kmalloc include/linux/slab.h:594 [inline] kzalloc include/linux/slab.h:711 [inline] ieee802_11_parse_elems_full+0xe7/0x2470 net/mac80211/util.c:1628 ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2291 [inline] ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2298 [inline] ieee80211_inform_bss+0x146/0x1060 net/mac80211/scan.c:79 rdev_inform_bss+0x11f/0x480 net/wireless/rdev-ops.h:418 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:3094 [inline] cfg80211_inform_bss_frame_data+0x11af/0x1d60 net/wireless/scan.c:3125 ieee80211_bss_info_update+0x8a7/0xbc0 net/mac80211/scan.c:226 ieee80211_rx_bss_info net/mac80211/ibss.c:1098 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1577 [inline] ieee80211_ibss_rx_queued_mgmt+0x1924/0x2cd0 net/mac80211/ibss.c:1604 ieee80211_iface_process_skb net/mac80211/iface.c:1589 [inline] ieee80211_iface_work+0x809/0xd90 net/mac80211/iface.c:1643 cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:243