INFO: task syz.7.1534:15150 blocked for more than 143 seconds. Not tainted 6.14.0-rc5-syzkaller-00218-g2a520073e74f #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.7.1534 state:D stack:23872 pid:15150 tgid:15150 ppid:14354 task_flags:0x440040 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 do_sync_mmap_readahead+0x4a6/0x990 filemap_fault+0x89e/0x16c0 mm/filemap.c:3446 __do_fault+0x135/0x390 mm/memory.c:4988 do_shared_fault mm/memory.c:5467 [inline] do_fault mm/memory.c:5541 [inline] do_pte_missing mm/memory.c:4058 [inline] handle_pte_fault mm/memory.c:5900 [inline] __handle_mm_fault+0x220a/0x70f0 mm/memory.c:6043 handle_mm_fault+0x3e5/0x8d0 mm/memory.c:6212 do_user_addr_fault arch/x86/mm/fault.c:1337 [inline] handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x459/0x8b0 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f7dbe754ea2 RSP: 002b:00007f7dbeacfb88 EFLAGS: 00010246 RAX: 0000400000000180 RBX: 0000000000000004 RCX: ffffffffffffff1a RDX: 0000000000000001 RSI: 00007f7dbe200064 RDI: 0000400000000180 RBP: 00007f7dbe9a7ba0 R08: 00007f7dbe600000 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: 00007f7dbe9a5fac R13: 00007f7dbe9a5fa0 R14: fffffffffffffffe R15: 00007f7dbeacfca0 Showing all locks held in the system: 6 locks held by kworker/0:0/9: #0: ffff888144aaa548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff888144aaa548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc900000e7c60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc900000e7c60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffff888144f90190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #2: ffff888144f90190 (&dev->mutex){....}-{4:4}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5861 #3: ffff88802809f190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #3: ffff88802809f190 (&dev->mutex){....}-{4:4}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #4: ffff888050619160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #4: ffff888050619160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #5: ffffffff8fe63c08 (register_mutex#6){+.+.}-{4:4}, at: usb_audio_probe+0x417/0x2100 sound/usb/card.c:813 1 lock held by khungtaskd/31: #0: ffffffff8eb39320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8eb39320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8eb39320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746 3 locks held by kworker/u8:10/3543: 1 lock held by dhcpcd/5505: #0: ffff8880309c0208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline] #0: ffff8880309c0208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: __sock_release net/socket.c:646 [inline] #0: ffff8880309c0208 (&sb->s_type->i_mutex_key#10){+.+.}-{4:4}, at: sock_close+0x90/0x240 net/socket.c:1398 2 locks held by getty/5597: #0: ffff8880317c40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211 4 locks held by udevd/6110: #0: ffff888060e44b08 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb4/0xd70 fs/seq_file.c:182 #1: ffff88803d0d6c88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x53/0x3b0 fs/kernfs/file.c:154 #2: ffff88803659d008 (kn->active#5){++++}-{0:0}, at: kernfs_seq_start+0x72/0x3b0 fs/kernfs/file.c:155 #3: ffff88802809f190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #3: ffff88802809f190 (&dev->mutex){....}-{4:4}, at: uevent_show+0x17d/0x340 drivers/base/core.c:2729 1 lock held by syz.0.1501/14914: 1 lock held by syz.7.1534/15150: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 1 lock held by syz.1.1557/15339: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 2 locks held by syz.1.1557/15340: #0: ffff8880645e54d8 (&runtime->oss.params_lock){+.+.}-{4:4}, at: snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1401 [inline] #0: ffff8880645e54d8 (&runtime->oss.params_lock){+.+.}-{4:4}, at: snd_pcm_oss_write+0x25e/0x11f0 sound/core/oss/pcm_oss.c:2796 #1: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #1: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 1 lock held by syz.1.1557/15341: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 2 locks held by syz.2.1580/15529: #0: ffff8880613520a8 (&ctx->uring_lock){+.+.}-{4:4}, at: __do_sys_io_uring_enter io_uring/io_uring.c:3371 [inline] #0: ffff8880613520a8 (&ctx->uring_lock){+.+.}-{4:4}, at: __se_sys_io_uring_enter+0x2bd/0x3390 io_uring/io_uring.c:3307 #1: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #1: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 1 lock held by syz.3.1617/16065: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 1 lock held by syz.3.1617/16066: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 1 lock held by syz.3.1617/16069: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 1 lock held by syz.3.1617/16070: #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:932 [inline] #0: ffff888148c4f0c0 (mapping.invalidate_lock#2){++++}-{4:4}, at: page_cache_ra_unbounded+0x156/0x820 mm/readahead.c:229 2 locks held by syz.6.1870/17676: 5 locks held by syz.0.1883/17751: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc5-syzkaller-00218-g2a520073e74f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline] watchdog+0x1058/0x10a0 kernel/hung_task.c:399 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] NMI backtrace for cpu 1 skipped: idling at acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:111