INFO: task syz-executor.3:4935 blocked for more than 143 seconds. Not tainted 5.15.154-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:22416 pid: 4935 ppid: 3525 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 wait_on_state fs/btrfs/extent_io.c:868 [inline] wait_extent_bit+0x3f9/0x530 fs/btrfs/extent_io.c:906 lock_extent_bits+0x10d/0x1e0 fs/btrfs/extent_io.c:1469 btrfs_page_mkwrite+0x5f2/0xd60 fs/btrfs/inode.c:8953 do_page_mkwrite+0x1a9/0x440 mm/memory.c:2892 wp_page_shared+0x179/0x690 mm/memory.c:3229 handle_pte_fault mm/memory.c:4639 [inline] __handle_mm_fault mm/memory.c:4756 [inline] handle_mm_fault+0x2a3d/0x5950 mm/memory.c:4854 do_user_addr_fault arch/x86/mm/fault.c:1388 [inline] handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x271/0x740 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568 RIP: 0010:copy_user_generic_unrolled+0x89/0xc0 arch/x86/lib/copy_user_64.S:92 Code: 38 4c 89 47 20 4c 89 4f 28 4c 89 57 30 4c 89 5f 38 48 8d 76 40 48 8d 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 <4c> 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a RSP: 0018:ffffc9000115f668 EFLAGS: 00050202 RAX: ffffffff8408ca01 RBX: 0000000020000958 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffc9000115f720 RDI: 0000000020000920 RBP: ffffc9000115f7d0 R08: 0000000000000000 R09: fffff5200022beeb R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000038 R13: 00007ffffffff000 R14: ffffc9000115f720 R15: 0000000020000920 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline] _copy_to_user+0xef/0x130 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:200 [inline] fiemap_fill_next_extent+0x231/0x410 fs/ioctl.c:144 emit_last_fiemap_cache fs/btrfs/extent_io.c:5487 [inline] extent_fiemap+0x13e9/0x1650 fs/btrfs/extent_io.c:5697 btrfs_fiemap+0x121/0x160 fs/btrfs/inode.c:8576 ioctl_fiemap fs/ioctl.c:219 [inline] do_vfs_ioctl+0x1934/0x2b70 fs/ioctl.c:814 __do_sys_ioctl fs/ioctl.c:872 [inline] __se_sys_ioctl+0x81/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fbbf4a35e69 RSP: 002b:00007fbbf2fa80c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fbbf4b63f80 RCX: 00007fbbf4a35e69 RDX: 0000000020000900 RSI: 00000000c020660b RDI: 0000000000000004 RBP: 00007fbbf4a8247a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fbbf4b63f80 R15: 00007ffd97209168 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8c91fae0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 4 locks held by kworker/u4:1/144: 2 locks held by getty/3258: #0: ffff888024ec7098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002bab2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158 2 locks held by kworker/1:3/3556: #0: ffff888011c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90004c27d20 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 3 locks held by kworker/0:6/3559: #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90004c77d20 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffff8880649ac400 (&nsim_dev->port_list_lock#2){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x56/0xab0 drivers/net/netdevsim/dev.c:757 3 locks held by syz-executor.3/4935: #0: ffff88807cd2c728 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff88807cd2c728 (&mm->mmap_lock){++++}-{3:3}, at: do_user_addr_fault arch/x86/mm/fault.c:1329 [inline] #0: ffff88807cd2c728 (&mm->mmap_lock){++++}-{3:3}, at: handle_page_fault arch/x86/mm/fault.c:1476 [inline] #0: ffff88807cd2c728 (&mm->mmap_lock){++++}-{3:3}, at: exc_page_fault+0x181/0x740 arch/x86/mm/fault.c:1532 #1: ffff888077f88558 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x1a9/0x440 mm/memory.c:2892 #2: ffff888074739838 (&ei->i_mmap_lock){++++}-{3:3}, at: btrfs_page_mkwrite+0x4a2/0xd60 fs/btrfs/inode.c:8942 8 locks held by kworker/1:20/6527: #0: ffff888016ded938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90004097d20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffff888147cb9220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff888147cb9220 (&dev->mutex){....}-{3:3}, at: hub_event+0x208/0x54c0 drivers/usb/core/hub.c:5768 #3: ffff88805cb8c220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88805cb8c220 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0xfa/0x8c0 drivers/usb/core/hub.c:2239 #4: ffff88807823a1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88807823a1a8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1044 [inline] #4: ffff88807823a1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xc2/0x7f0 drivers/base/dd.c:1259 #5: ffff888066591ab0 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #5: ffff888066591ab0 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1044 [inline] #5: ffff888066591ab0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xc2/0x7f0 drivers/base/dd.c:1259 #6: ffffffff8d50ba88 (input_mutex){+.+.}-{3:3}, at: __input_unregister_device+0x10c/0x320 drivers/input/input.c:2205 #7: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #7: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x280/0x740 kernel/rcu/tree_exp.h:845 2 locks held by kworker/0:18/7028: #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc900040c7d20 (xfrm_state_gc_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 8 locks held by syz-executor.1/7914: #0: ffff888023f6c460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x29a/0xe50 fs/read_write.c:590 #1: ffff8880607df088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0 fs/kernfs/file.c:287 #2: ffff88801df7dae8 (kn->active#233){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20b/0x4f0 fs/kernfs/file.c:288 #3: ffffffff8d362d48 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xf1/0x470 drivers/net/netdevsim/bus.c:344 #4: ffff8880649ab178 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff8880649ab178 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1044 [inline] #4: ffff8880649ab178 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xc2/0x7f0 drivers/base/dd.c:1259 #5: ffff8880649ac400 (&nsim_dev->port_list_lock#2){+.+.}-{3:3}, at: nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1359 [inline] #5: ffff8880649ac400 (&nsim_dev->port_list_lock#2){+.+.}-{3:3}, at: nsim_dev_reload_destroy+0x118/0x240 drivers/net/netdevsim/dev.c:1561 #6: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3a/0x140 drivers/net/netdevsim/netdev.c:381 #7: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #7: ffffffff8c9240a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x350/0x740 kernel/rcu/tree_exp.h:845 3 locks held by syz-executor.3/8004: #0: ffff88807a1531c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: __tty_hangup+0xc3/0x6b0 drivers/tty/tty_io.c:599 #1: ffff88807a153098 (&tty->ldisc_sem){++++}-{0:0}, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:300 [inline] #1: ffff88807a153098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_lock+0x68/0xb0 drivers/tty/tty_ldisc.c:324 #2: ffffffff8c923fb0 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x9c/0x4e0 kernel/rcu/tree.c:4039 2 locks held by syz-executor.4/8024: #0: ffff88801c000918 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_put+0xfb/0x790 block/bdev.c:912 #1: ffff8881474e3468 (&lo->lo_mutex){+.+.}-{3:3}, at: lo_release+0x4d/0x1f0 drivers/block/loop.c:2070 1 lock held by syz-executor.2/8030: #0: ffff8880b9a3a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:475 1 lock held by syz-executor.2/8032: #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: do_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:417 [inline] #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: ipv6_setsockopt+0x45f/0x43a0 net/ipv6/ipv6_sockglue.c:1006 1 lock held by syz-executor.2/8033: #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: do_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:417 [inline] #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: ipv6_setsockopt+0x45f/0x43a0 net/ipv6/ipv6_sockglue.c:1006 1 lock held by syz-executor.2/8034: #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: do_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:417 [inline] #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: ipv6_setsockopt+0x45f/0x43a0 net/ipv6/ipv6_sockglue.c:1006 1 lock held by syz-executor.2/8035: #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: do_ipv6_setsockopt net/ipv6/ipv6_sockglue.c:417 [inline] #0: ffffffff8d9e7508 (rtnl_mutex){+.+.}-{3:3}, at: ipv6_setsockopt+0x45f/0x43a0 net/ipv6/ipv6_sockglue.c:1006 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.154-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xe72/0xeb0 kernel/hung_task.c:295 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 5777 Comm: kworker/u4:8 Not tainted 5.15.154-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: phy7 ieee80211_iface_work RIP: 0010:_ieee802_11_parse_elems_crc+0x6c4/0x3020 net/mac80211/util.c:1023 Code: 00 e8 90 18 c9 f7 e9 8d 00 00 00 e8 86 18 c9 f7 e9 83 00 00 00 e8 7c 18 c9 f7 eb 7c e8 75 18 c9 f7 eb 75 e8 6e 18 c9 f7 eb 6e 67 18 c9 f7 eb 67 e8 60 18 c9 f7 eb 60 e8 59 18 c9 f7 eb 59 e8 RSP: 0018:ffffc90002ff7340 EFLAGS: 00000213 RAX: 0000000000000000 RBX: ffff88802343688e RCX: 000000000000008b RDX: 0000000000000028 RSI: ffffffff8dc25e00 RDI: 0000000000000032 RBP: ffffc90002ff76a8 R08: 0000000000000001 R09: ffffffff89b7427d R10: 0000000000000028 R11: ffff88801e495940 R12: 0000000000000000 R13: 0000000000000032 R14: 0000000000000006 R15: ffff88802343688d FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f255c8faf38 CR3: 000000007db46000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ieee802_11_parse_elems_crc+0xc6a/0x1130 net/mac80211/util.c:1498 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2238 [inline] ieee80211_bss_info_update+0x86d/0xc80 net/mac80211/scan.c:212 ieee80211_rx_bss_info net/mac80211/ibss.c:1123 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1614 [inline] ieee80211_ibss_rx_queued_mgmt+0x175e/0x2af0 net/mac80211/ibss.c:1643 ieee80211_iface_process_skb net/mac80211/iface.c:1441 [inline] ieee80211_iface_work+0x78f/0xcc0 net/mac80211/iface.c:1495 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300