INFO: task syz-executor:7377 blocked for more than 144 seconds. Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:11608 pid:7377 tgid:7377 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 inode_lock include/linux/fs.h:818 [inline] vfs_unlink+0xe4/0x650 fs/namei.c:4512 do_unlinkat+0x4ae/0x830 fs/namei.c:4587 __do_sys_unlink fs/namei.c:4635 [inline] __se_sys_unlink fs/namei.c:4633 [inline] __x64_sys_unlink+0x47/0x50 fs/namei.c:4633 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5ca277fdb7 RSP: 002b:00007ffe76310a68 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5ca277fdb7 RDX: 00007ffe76310a90 RSI: 00007ffe76310b20 RDI: 00007ffe76310b20 RBP: 00007ffe76310b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe76311c10 R13: 00007f5ca27f37dc R14: 00000000000a482c R15: 00007ffe76312cd0 Showing all locks held in the system: 1 lock held by pool_workqueue_/3: 1 lock held by khungtaskd/30: #0: ffffffff8e93c560 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e93c560 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e93c560 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744 2 locks held by getty/5602: #0: ffff8880353f20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000330b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211 3 locks held by kworker/0:5/5908: 6 locks held by kworker/1:4/5910: 3 locks held by kworker/0:8/5965: #0: ffff88801ac78948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801ac78948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc900047bfd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc900047bfd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104 3 locks held by kworker/u8:11/6503: #0: ffff8881412df948 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff8881412df948 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc9000ceafd00 ((work_completion)(&(&rdev->dfs_update_channels_wk)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc9000ceafd00 ((work_completion)(&(&rdev->dfs_update_channels_wk)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: cfg80211_dfs_channels_update_work+0xbf/0x610 net/wireless/mlme.c:1015 2 locks held by kworker/u8:15/7316: 3 locks held by kworker/u8:19/7325: #0: ffff88801ac81148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801ac81148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc900046ffd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc900046ffd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:276 3 locks held by syz-executor/7377: #0: ffff888056a46420 (sb_writers#32){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515 #1: ffff888056d488c8 (&sb->s_type->i_mutex_key#38/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:853 [inline] #1: ffff888056d488c8 (&sb->s_type->i_mutex_key#38/1){+.+.}-{4:4}, at: do_unlinkat+0x26a/0x830 fs/namei.c:4574 #2: ffff88807f2488c8 (&sb->s_type->i_mutex_key#38){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline] #2: ffff88807f2488c8 (&sb->s_type->i_mutex_key#38){++++}-{4:4}, at: vfs_unlink+0xe4/0x650 fs/namei.c:4512 3 locks held by syz-executor/11376: 1 lock held by syz-executor/11383: 4 locks held by bch-reclaim/loo/13055: #0: ffff88803a04b0a8 (&j->reclaim_lock){+.+.}-{4:4}, at: bch2_journal_reclaim_thread+0x167/0x560 fs/bcachefs/journal_reclaim.c:739 #1: ffff88803a004398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:158 [inline] #1: ffff88803a004398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:249 [inline] #1: ffff88803a004398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x7e1/0xd30 fs/bcachefs/btree_iter.c:3228 #2: ffff88803a004740 (&wb->flushing.lock){+.+.}-{4:4}, at: btree_write_buffer_flush_seq+0x1b19/0x1cc0 fs/bcachefs/btree_write_buffer.c:516 #3: ffff88803a0266d0 (&c->gc_lock){++++}-{4:4}, at: bch2_btree_update_start+0x682/0x14e0 fs/bcachefs/btree_update_interior.c:1197 4 locks held by syz.6.1761/13072: #0: ffff88807f2488c8 (&sb->s_type->i_mutex_key#38){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline] #0: ffff88807f2488c8 (&sb->s_type->i_mutex_key#38){++++}-{4:4}, at: do_truncate+0x20c/0x310 fs/open.c:63 #1: ffff88803a000a38 (&c->snapshot_create_lock){.+.+}-{4:4}, at: bch2_truncate+0x166/0x2d0 fs/bcachefs/io_misc.c:292 #2: ffff88803a004398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:158 [inline] #2: ffff88803a004398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:249 [inline] #2: ffff88803a004398 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x7e1/0xd30 fs/bcachefs/btree_iter.c:3228 #3: ffff88803a0266d0 (&c->gc_lock){++++}-{4:4}, at: bch2_btree_update_start+0x682/0x14e0 fs/bcachefs/btree_update_interior.c:1197 1 lock held by syz-executor/13256: 6 locks held by kworker/u8:3/13525: #0: ffff88801baed948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801baed948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc9000cf77d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc9000cf77d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fcddf90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x16a/0xcc0 net/core/net_namespace.c:586 #3: ffffffff8fceaac8 ( rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 net/mac80211/main.c:1664 #4: ffff88806a2f0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: wiphy_lock include/net/cfg80211.h:6019 [inline] #4: ffff88806a2f0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x12b/0x700 net/mac80211/iface.c:2285 #5: ffffffff8e941af8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:329 [inline] #5: ffffffff8e941af8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:976 2 locks held by syz-executor/14621: #0: ffffffff8f47e940 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8f47e940 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8f47e940 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:555 #1: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #1: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:326 [inline] #1: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xd04/0x24f0 net/core/rtnetlink.c:4000 1 lock held by syz.8.2154/14666: #0: ffffffff8fceaac8 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x86e/0x1340 net/core/dev_ioctl.c:807 2 locks held by syz.7.2157/14668: 1 lock held by syz.3.2158/14675: #0: ffff88807bcc76e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline] #0: ffff88807bcc76e0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x17c/0x3d0 mm/util.c:578 2 locks held by syz.3.2158/14676: #0: ffff88807bcc3c60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:106 [inline] #0: ffff88807bcc3c60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2bd/0xc40 mm/mmap.c:1675 #1: ffff88802f85e298 (&anon_vma->rwsem){++++}-{4:4}, at: lock_anon_vma_root mm/rmap.c:250 [inline] #1: ffff88802f85e298 (&anon_vma->rwsem){++++}-{4:4}, at: unlink_anon_vmas+0xd5/0x5f0 mm/rmap.c:408 2 locks held by syz.3.2158/14690: #0: ffff88807bcc76e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline] #0: ffff88807bcc76e0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x17c/0x3d0 mm/util.c:578 #1: ffff88802f85e298 (&anon_vma->rwsem){++++}-{4:4}, at: anon_vma_lock_read include/linux/rmap.h:136 [inline] #1: ffff88802f85e298 (&anon_vma->rwsem){++++}-{4:4}, at: validate_mm+0x2c8/0x590 mm/vma.c:612 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline] watchdog+0xffb/0x1040 kernel/hung_task.c:397 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 14676 Comm: syz.3.2158 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:lock_acquire+0xff/0x550 kernel/locking/lockdep.c:5822 Code: 0f a3 1d c4 41 ad 0e 73 16 e8 2d 60 0a 00 84 c0 75 0d 80 3d 33 72 97 0e 00 0f 84 f9 02 00 00 48 c7 c0 50 8f 1e 90 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 ff 02 00 00 83 3d 2d 74 ad 0e 00 0f 84 RSP: 0018:ffffc9000bef6f60 EFLAGS: 00000212 RAX: 1ffffffff203d1ea RBX: 0000000000000001 RCX: ffffffff81711ae4 RDX: 0000000000000000 RSI: ffffffff8c6157c0 RDI: ffffffff8c615780 RBP: ffffc9000bef70b0 R08: ffffffff901e5cb7 R09: 1ffffffff203cb96 R10: dffffc0000000000 R11: fffffbfff203cb97 R12: 1ffff920017dedf4 R13: dffffc0000000000 R14: 0000000000000000 R15: 00007fcc00f80809 FS: 00007fcc01d6c6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002800 CR3: 000000005f4bc000 CR4: 0000000000350ef0 Call Trace: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] is_bpf_text_address+0x46/0x2a0 kernel/bpf/core.c:768 kernel_text_address+0xa7/0xe0 kernel/extable.c:125 __kernel_text_address+0xd/0x40 kernel/extable.c:79 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_orc.c:369 arch_stack_walk+0xfd/0x150 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 save_stack+0xfb/0x1f0 mm/page_owner.c:156 __reset_page_owner+0x76/0x430 mm/page_owner.c:297 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_folios+0xf37/0x1a20 mm/page_alloc.c:2704 folios_put_refs+0x76c/0x860 mm/swap.c:962 folio_batch_release include/linux/pagevec.h:101 [inline] shmem_undo_range+0x64c/0x1cf0 mm/shmem.c:1040 shmem_truncate_range mm/shmem.c:1152 [inline] shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1280 evict+0x4ea/0x9a0 fs/inode.c:796 __dentry_kill+0x20d/0x630 fs/dcache.c:625 dput+0x19f/0x2b0 fs/dcache.c:867 __fput+0x5ba/0xa50 fs/file_table.c:458 task_work_run+0x251/0x310 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcc00f80809 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcc01d6bf28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 RAX: ffffffffffffffea RBX: 000000000000007a RCX: 00007fcc00f80809 RDX: 00007fcc01d6bf40 RSI: 000000000000007a RDI: 00007fcc01d6bf40 RBP: 00007fcc00ff393e R08: 0000000000000000 R09: 000000000000007a R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fcc01145fa0 R15: 00007ffdb1c638b8