INFO: task syz-executor.2:7231 blocked for more than 140 seconds. Not tainted 4.9.166+ #35 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D25016 7231 7230 0x00000000 ffff8801c81dc740 ffff880181c58000 ffff8801db721000 ffff880187eeaf80 ffff8801db721018 ffff8801c60a79d0 ffffffff827ffaae ffffffff8280b035 ffff8801c395b8c8 00ff8801c60a7920 ffff8801db7218f0 1ffff10038c14f29 Call Trace: [<00000000171555ca>] schedule+0x92/0x1c0 kernel/sched/core.c:3546 [<000000009857de2d>] __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:533 [inline] [<000000009857de2d>] rwsem_down_write_failed+0x3a3/0x750 kernel/locking/rwsem-xadd.c:562 [<00000000eac00a9c>] call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:105 [<000000006175c8dd>] __down_write arch/x86/include/asm/rwsem.h:125 [inline] [<000000006175c8dd>] down_write+0x5c/0xa0 kernel/locking/rwsem.c:54 [<00000000a2f396a8>] i_mmap_lock_write include/linux/fs.h:526 [inline] [<00000000a2f396a8>] dup_mmap kernel/fork.c:642 [inline] [<00000000a2f396a8>] dup_mm kernel/fork.c:1156 [inline] [<00000000a2f396a8>] copy_mm kernel/fork.c:1210 [inline] [<00000000a2f396a8>] copy_process.part.0+0x3ec7/0x63f0 kernel/fork.c:1694 [<00000000451f64c8>] copy_process kernel/fork.c:1505 [inline] [<00000000451f64c8>] _do_fork+0x1b8/0xd40 kernel/fork.c:1985 [<00000000e5bb3f83>] SYSC_clone kernel/fork.c:2097 [inline] [<00000000e5bb3f83>] SyS_clone+0x37/0x50 kernel/fork.c:2091 [<000000007f8b2102>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285 [<000000002f798948>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Showing all locks held in the system: 2 locks held by khungtaskd/24: #0: (rcu_read_lock){......}, at: [<00000000f984ae0f>] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline] #0: (rcu_read_lock){......}, at: [<00000000f984ae0f>] watchdog+0x13c/0xae0 kernel/hung_task.c:239 #1: (tasklist_lock){.+.?..}, at: [<00000000e55fd9be>] debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4339 2 locks held by getty/2038: #0: (&tty->ldisc_sem){++++++}, at: [<00000000ecb11793>] ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:377 #1: (&ldata->atomic_read_lock){+.+...}, at: [<00000000af22a496>] n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156 1 lock held by syz-executor.1/2120: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.0/2121: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.5/2123: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.4/4758: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.2/7230: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 4 locks held by syz-executor.2/7231: #0: (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] dup_mmap kernel/fork.c:573 [inline] #0: (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] dup_mm kernel/fork.c:1156 [inline] #0: (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] copy_mm kernel/fork.c:1210 [inline] #0: (&dup_mmap_sem){.+.+.+}, at: [<00000000af03a212>] copy_process.part.0+0x38ca/0x63f0 kernel/fork.c:1694 #1: (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] dup_mmap kernel/fork.c:574 [inline] #1: (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] dup_mm kernel/fork.c:1156 [inline] #1: (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] copy_mm kernel/fork.c:1210 [inline] #1: (&mm->mmap_sem){++++++}, at: [<00000000b4123854>] copy_process.part.0+0x38e5/0x63f0 kernel/fork.c:1694 #2: (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] dup_mmap kernel/fork.c:583 [inline] #2: (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] dup_mm kernel/fork.c:1156 [inline] #2: (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] copy_mm kernel/fork.c:1210 [inline] #2: (&mm->mmap_sem/1){+.+.+.}, at: [<000000009d52ceda>] copy_process.part.0+0x391e/0x63f0 kernel/fork.c:1694 #3: (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] i_mmap_lock_write include/linux/fs.h:526 [inline] #3: (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] dup_mmap kernel/fork.c:642 [inline] #3: (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] dup_mm kernel/fork.c:1156 [inline] #3: (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] copy_mm kernel/fork.c:1210 [inline] #3: (&mapping->i_mmap_rwsem){++++..}, at: [<00000000a2f396a8>] copy_process.part.0+0x3ec7/0x63f0 kernel/fork.c:1694 1 lock held by syz-executor.3/20330: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.3/11937: #0: (&sig->cred_guard_mutex){+.+.+.}, at: [<000000005b5fa8b5>] prepare_bprm_creds+0x55/0x120 fs/exec.c:1369 1 lock held by syz-executor.0/5674: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.5/5678: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.3/5675: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.4/5668: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 1 lock held by syz-executor.1/5667: #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] i_mmap_lock_write include/linux/fs.h:526 [inline] #0: (&mapping->i_mmap_rwsem){++++..}, at: [<0000000058d0d7fc>] unlink_file_vma+0x75/0xb0 mm/mmap.c:156 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.166+ #35 ffff8801d98d7cc8 ffffffff81b4ef81 0000000000000001 0000000000000000 0000000000000001 ffffffff81097401 dffffc0000000000 ffff8801d98d7d00 ffffffff81b5a23c 0000000000000001 0000000000000000 0000000000000001 Call Trace: [<00000000b15cc3ad>] __dump_stack lib/dump_stack.c:15 [inline] [<00000000b15cc3ad>] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [<0000000046e06a05>] nmi_cpu_backtrace.cold+0x47/0x87 lib/nmi_backtrace.c:99 [<00000000e498cf0f>] nmi_trigger_cpumask_backtrace+0x124/0x155 lib/nmi_backtrace.c:60 [<000000004bdf6aca>] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [<0000000005f1b853>] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [<0000000005f1b853>] check_hung_task kernel/hung_task.c:125 [inline] [<0000000005f1b853>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [<0000000005f1b853>] watchdog+0x661/0xae0 kernel/hung_task.c:239 [<0000000012c22232>] kthread+0x278/0x310 kernel/kthread.c:211 [<0000000064e9ca50>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 27260 Comm: syz-executor.2 Not tainted 4.9.166+ #35 task: 0000000087141d6c task.stack: 0000000024e50e03 RIP: 0033:[<0000000000401584>] c [<0000000064184ec5>] 0x401584 RSP: 002b:00007f4104bdc690 EFLAGS: 00000282 RAX: 00000000c4caa668 RBX: 000000000000000b RCX: 00000000004582b9 RDX: b700000001000000 RSI: 00007f4104bdc6c0 RDI: 000000000000000b RBP: 0000000000000000 R08: 91726972ae636573 R09: 0000000000000000 R10: 5400007974dd0836 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f4104bdd700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f999cfe3000 CR3: 0000000195f6f000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600