INFO: task syz-executor.0:23723 blocked for more than 143 seconds. Not tainted 6.9.0-syzkaller-12398-gc13320499ba0 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:24672 pid:23723 tgid:23723 ppid:22760 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5408 [inline] __schedule+0x1796/0x49d0 kernel/sched/core.c:6745 __schedule_loop kernel/sched/core.c:6822 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6837 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6894 rwsem_down_read_slowpath kernel/locking/rwsem.c:1086 [inline] __down_read_common kernel/locking/rwsem.c:1250 [inline] __down_read kernel/locking/rwsem.c:1263 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1528 filemap_invalidate_lock_shared include/linux/fs.h:846 [inline] filemap_fault+0xb5b/0x1760 mm/filemap.c:3320 __do_fault+0x135/0x460 mm/memory.c:4562 do_shared_fault mm/memory.c:4986 [inline] do_fault mm/memory.c:5060 [inline] do_pte_missing mm/memory.c:3903 [inline] handle_pte_fault+0x11b7/0x7130 mm/memory.c:5380 __handle_mm_fault mm/memory.c:5523 [inline] handle_mm_fault+0xfb0/0x19d0 mm/memory.c:5688 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline] handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7fe85f25df6b RSP: 002b:00007fff0f7738c8 EFLAGS: 00010202 RAX: 00000000200000c0 RBX: 0000000000000004 RCX: 0000000000746166 RDX: 0000000000000006 RSI: 0000000061667865 RDI: 00000000200000c0 RBP: 00007fff0f773988 R08: 00007fe85f200000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000009 R12: 000000000012d4d6 R13: 00007fe85f3abf8c R14: 00007fe85f3abf80 R15: 0000000000000032 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #0: ffffffff8e333f60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614 3 locks held by kworker/1:2/58: #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc9000133fd00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc9000133fd00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff8880662bb240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x2d1/0x4130 drivers/net/netdevsim/fib.c:1489 3 locks held by kworker/u8:8/2440: 3 locks held by klogd/4525: 2 locks held by getty/4833: #0: ffff88802b54b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2201 2 locks held by syz-fuzzer/5076: 2 locks held by kworker/1:0/22530: #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90004f4fd00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90004f4fd00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 1 lock held by syz-executor.3/23294: 2 locks held by syz-executor.0/23723: #0: ffff88801b282148 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:678 [inline] #0: ffff88801b282148 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x2f9/0x6e0 mm/memory.c:5844 #1: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:846 [inline] #1: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xb5b/0x1760 mm/filemap.c:3320 1 lock held by syz-executor.4/23901: #0: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:836 [inline] #0: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x233/0x550 block/fops.c:792 2 locks held by syz-executor.3/24180: #0: ffff88806878f220 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:678 [inline] #0: ffff88806878f220 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x2f9/0x6e0 mm/memory.c:5844 #1: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:846 [inline] #1: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xb5b/0x1760 mm/filemap.c:3320 1 lock held by syz-executor.1/24234: #0: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:836 [inline] #0: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: blkdev_fallocate+0x233/0x550 block/fops.c:792 1 lock held by syz-executor.4/24639: #0: ffffffff8e339338 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #0: ffffffff8e339338 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:939 2 locks held by syz-executor.0/24837: #0: ffff88802e26ca90 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_read include/linux/mm.h:678 [inline] #0: ffff88802e26ca90 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x2f9/0x6e0 mm/memory.c:5844 #1: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:846 [inline] #1: ffff88801d55e548 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_fault+0xb5b/0x1760 mm/filemap.c:3320 3 locks held by syz-executor.2/24851: #0: ffff88801fbf0d88 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:554 [inline] #0: ffff88801fbf0d88 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1d3/0x4e0 net/bluetooth/hci_core.c:2760 #1: ffff88801fbf0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x494/0xf60 net/bluetooth/hci_sync.c:5050