INFO: task syz-executor.1:26469 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D27328 26469 7284 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_timeout+0x43/0x240 kernel/time/timer.c:1871 mark_held_locks kernel/locking/lockdep.c:3359 [inline] __trace_hardirqs_on_caller kernel/locking/lockdep.c:3388 [inline] lockdep_hardirqs_on+0x4f4/0x840 kernel/locking/lockdep.c:3433 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] _raw_spin_unlock_irq+0x1f/0x80 kernel/locking/spinlock.c:199 do_wait_for_common+0x2c7/0x4c0 kernel/sched/completion.c:83 console_conditional_schedule+0x30/0x30 do_task_dead+0xb0/0xb0 kernel/sched/core.c:4098 __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common kernel/sched/completion.c:115 [inline] wait_for_completion+0x43/0x50 kernel/sched/completion.c:136 kthread_stop+0xf8/0x200 kernel/kthread.c:559 ubi_detach_mtd_dev+0x3b9/0x950 drivers/mtd/ubi/build.c:1101 ctrl_cdev_ioctl+0x176/0x300 drivers/mtd/ubi/cdev.c:1068 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.1:26478 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D28568 26478 7284 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.3:26482 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D27648 26482 7455 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.3:26484 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28496 26484 7455 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.4:26495 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27648 26495 7566 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.4:26501 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28496 26501 7566 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.0:26493 blocked for more than 143 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D27328 26493 7167 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe INFO: task syz-executor.0:26500 blocked for more than 144 seconds. Not tainted 5.6.0-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28568 26500 7167 0x00004004 Call Trace: context_switch kernel/sched/core.c:3380 [inline] __schedule+0x7c9/0xc50 kernel/sched/core.c:4080 schedule+0x188/0x220 kernel/sched/core.c:4154 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:4213 __mutex_lock_common+0x129f/0x2fc0 kernel/locking/mutex.c:1033 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 __mutex_lock kernel/locking/mutex.c:1103 [inline] mutex_lock_nested+0x1a/0x20 kernel/locking/mutex.c:1118 ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 ubi_cdev_ioctl+0x1c10/0x1c10 drivers/mtd/ubi/cdev.c:869 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl fs/ioctl.c:763 [inline] __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl+0xf9/0x160 fs/ioctl.c:770 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Showing all locks held in the system: 1 lock held by khungtaskd/1134: #0: ffffffff890d9ac8 (rcu_read_lock){....}, at: rcu_lock_acquire+0x0/0x30 lib/xarray.c:75 1 lock held by in:imklog/6819: #0: ffff88809e6d1e20 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x24e/0x2f0 fs/file.c:826 2 locks held by agetty/6768: #0: ffff8880a6ae2090 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:267 #1: ffffc90000ee42e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x25d/0x1bc0 drivers/tty/n_tty.c:2156 1 lock held by syz-executor.1/26469: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 1 lock held by syz-executor.1/26478: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 1 lock held by syz-executor.3/26482: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 1 lock held by syz-executor.3/26484: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 1 lock held by syz-executor.4/26495: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 1 lock held by syz-executor.4/26501: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 1 lock held by syz-executor.0/26493: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x16d/0x300 drivers/mtd/ubi/cdev.c:1067 1 lock held by syz-executor.0/26500: #0: ffffffff892b8bf0 (ubi_devices_mutex){+.+.}, at: ctrl_cdev_ioctl+0x1b5/0x300 drivers/mtd/ubi/cdev.c:1042 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1134 Comm: khungtaskd Not tainted 5.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1e9/0x30e lib/dump_stack.c:118 nmi_cpu_backtrace+0x9f/0x180 lib/nmi_backtrace.c:101 arch_trigger_cpumask_backtrace+0x10/0x10 arch/x86/kernel/apic/hw_nmi.c:38 nmi_trigger_cpumask_backtrace+0x16a/0x280 lib/nmi_backtrace.c:62 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xd2a/0xd40 kernel/hung_task.c:289 kthread+0x317/0x340 kernel/kthread.c:255 hungtask_pm_notify+0x50/0x50 kernel/hung_task.c:265 kthread_blkcg+0xd0/0xd0 kernel/kthread.c:1234 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4233 Comm: systemd-journal Not tainted 5.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:arch_local_save_flags arch/x86/include/asm/paravirt.h:754 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/paravirt.h:776 [inline] RIP: 0010:lock_acquire+0x95/0x250 kernel/locking/lockdep.c:4479 Code: 10 00 74 16 48 c7 c7 10 d4 0a 89 e8 25 12 57 00 48 ba 00 00 00 00 00 fc ff df 48 83 3d c3 f5 b0 07 00 0f 84 af 01 00 00 9c 58 <0f> 1f 44 00 00 48 89 44 24 10 48 c7 c0 20 d4 0a 89 48 c1 e8 03 80 RSP: 0018:ffffc90001627900 EFLAGS: 00000082 RAX: 0000000000000082 RBX: 1ffff110126e91aa RCX: 0000000000000002 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffffffff890d9ac8 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffed1015d27004 R11: 0000000000000000 R12: ffff888093748d54 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002 FS: 00007f18e20ab8c0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f18df57b018 CR3: 0000000093bd2000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: stack_trace_save+0x150/0x150 kernel/stacktrace.c:124 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:208 rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:207 rcu_read_lock include/linux/rcupdate.h:601 [inline] is_bpf_text_address+0x27/0x330 kernel/bpf/core.c:705 stack_trace_save+0x150/0x150 kernel/stacktrace.c:124 kernel_text_address+0x8f/0xe0 kernel/extable.c:150 __kernel_text_address+0x9/0x40 kernel/extable.c:104 unwind_get_return_address+0x48/0x90 arch/x86/kernel/unwind_orc.c:314 arch_stack_walk+0x98/0xe0 arch/x86/kernel/stacktrace.c:26 putname fs/namei.c:259 [inline] filename_lookup+0x41b/0x5d0 fs/namei.c:2475 stack_trace_save+0xad/0x150 kernel/stacktrace.c:123 save_stack mm/kasan/common.c:72 [inline] set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x12e/0x1e0 mm/kasan/common.c:476 save_stack mm/kasan/common.c:72 [inline] set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x12e/0x1e0 mm/kasan/common.c:476 __cache_free mm/slab.c:3426 [inline] kmem_cache_free+0x7e/0xf0 mm/slab.c:3694 putname fs/namei.c:259 [inline] filename_lookup+0x41b/0x5d0 fs/namei.c:2475 user_path_at include/linux/namei.h:58 [inline] do_faccessat+0x2ca/0x780 fs/open.c:398 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:650 [inline] queued_spin_unlock arch/x86/include/asm/qspinlock.h:55 [inline] do_raw_spin_unlock+0x134/0x8d0 kernel/locking/spinlock_debug.c:139 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] _raw_spin_unlock_irqrestore+0xb4/0xd0 kernel/locking/spinlock.c:191 __debug_check_no_obj_freed lib/debugobjects.c:977 [inline] debug_check_no_obj_freed+0x592/0x640 lib/debugobjects.c:998 putname fs/namei.c:259 [inline] filename_lookup+0x41b/0x5d0 fs/namei.c:2475 __cache_free mm/slab.c:3426 [inline] kmem_cache_free+0x7e/0xf0 mm/slab.c:3694 putname fs/namei.c:259 [inline] filename_lookup+0x41b/0x5d0 fs/namei.c:2475 audit_dummy_context include/linux/audit.h:296 [inline] audit_getname include/linux/audit.h:327 [inline] getname_flags+0x20d/0x610 fs/namei.c:202 user_path_at include/linux/namei.h:58 [inline] do_faccessat+0x2ca/0x780 fs/open.c:398 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f18e13679c7 Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc34abc708 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffc34abf620 RCX: 00007f18e13679c7 RDX: 00007f18e1dd8a00 RSI: 0000000000000000 RDI: 0000555be99e39a3 RBP: 00007ffc34abc740 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffc34abf620 R15: 00007ffc34abcc30