INFO: task syz.0.1865:15546 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.1865 state:D stack:28744 pid:15546 tgid:15531 ppid:11481 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5263 [inline] __schedule+0x1836/0x4ed0 kernel/sched/core.c:6871 __schedule_loop kernel/sched/core.c:6953 [inline] schedule+0x165/0x360 kernel/sched/core.c:6968 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7025 rwsem_down_read_slowpath+0x5fd/0x8f0 kernel/locking/rwsem.c:1086 __down_read_common kernel/locking/rwsem.c:1261 [inline] __down_read kernel/locking/rwsem.c:1274 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1539 inode_lock_shared include/linux/fs.h:1042 [inline] lookup_slow+0x46/0x70 fs/namei.c:1871 walk_component+0x2d2/0x400 fs/namei.c:2190 lookup_last fs/namei.c:2691 [inline] path_lookupat+0x163/0x430 fs/namei.c:2715 filename_lookup+0x212/0x570 fs/namei.c:2744 user_path_at+0x3a/0x60 fs/namei.c:3536 do_mount fs/namespace.c:4048 [inline] __do_sys_mount fs/namespace.c:4240 [inline] __se_sys_mount+0x2d4/0x410 fs/namespace.c:4217 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc97cb8f749 RSP: 002b:00007fc97d96e038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fc97cde6090 RCX: 00007fc97cb8f749 RDX: 0000200000000080 RSI: 00002000000000c0 RDI: 0000000000000000 RBP: 00007fc97cc13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000200011 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc97cde6128 R14: 00007fc97cde6090 R15: 00007ffce329a808 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8df3d9c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8df3d9c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8df3d9c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 3 locks held by kworker/0:8/5993: 2 locks held by getty/6472: #0: ffff88814e3f30a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000de2b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 3 locks held by syz.0.1865/15532: 1 lock held by syz.0.1865/15546: #0: ffff88805ae46240 (&type->i_mutex_dir_key#20){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1042 [inline] #0: ffff88805ae46240 (&type->i_mutex_dir_key#20){++++}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1871 2 locks held by sed/17008: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xfb5/0x1000 kernel/hung_task.c:515 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 15532 Comm: syz.0.1865 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:lock_is_held_type+0x0/0x190 kernel/locking/lockdep.c:5925 Code: 86 28 f6 90 0f 0b 90 90 90 eb b5 e8 1a fc ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 10 65 48 8b 05 RSP: 0018:ffffc9000477fa00 EFLAGS: 00000202 RAX: ffffffff8241700b RBX: dffffc0000000000 RCX: 0000000000000002 RDX: ffff88802ac11e80 RSI: 00000000ffffffff RDI: ffff888050e502e8 RBP: 1ffffffff1ed139e R08: ffffffff8dc168c3 R09: 1ffffffff1b82d18 R10: dffffc0000000000 R11: fffffbfff1b82d19 R12: 1ffff1100a1ca08a R13: ffff888050e50450 R14: 0000000000000001 R15: 1ffffffff1efc374 FS: 00007fc97d98f6c0(0000) GS:ffff888125fb9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4a24d6e368 CR3: 000000007db5c000 CR4: 00000000003526f0 DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000007a8d DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: lock_is_held include/linux/lockdep.h:249 [inline] iput+0xdf/0x1050 fs/inode.c:1977 insert_inode_locked+0x32a/0x5d0 fs/inode.c:1874 ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675 ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309 ntfs_mkdir+0x3d/0x50 fs/ntfs3/namei.c:215 vfs_mkdir+0x512/0x5b0 fs/namei.c:5099 do_mkdirat+0x276/0x4b0 fs/namei.c:5133 __do_sys_mkdirat fs/namei.c:5155 [inline] __se_sys_mkdirat fs/namei.c:5153 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:5153 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc97cb8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc97d98f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007fc97cde5fa0 RCX: 00007fc97cb8f749 RDX: 00000000000001a1 RSI: 0000200000000340 RDI: ffffffffffffff9c RBP: 00007fc97cc13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc97cde6038 R14: 00007fc97cde5fa0 R15: 00007ffce329a808